[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.25.0 → 1.27.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.0 -> 1.27.2 (minor, multi-release jump)
Semver bump type: minor (spans two minor releases: 1.26 and 1.27)

Changes:

• Go 1.26: GreenTea GC enabled by default, crypto random parameters ignored, net/http.ServeMux redirect changed from 301 to 307, io.ReadAll allocation behavior changed, net/url.Parse rejects malformed URLs, image/jpeg encoder/decoder replaced, .gosymtab ELF section removed
• Go 1.27: encoding/json backed by v2 implementation (rejects invalid UTF-8 and duplicate keys by default), net.UnixConn EOF behavior changed, compress/flate output may differ, asynctimerchan GODEBUG removed (timer channels always unbuffered), PowerPC switched to ELFv2 ABI, macOS 13+ required, Unicode upgraded to 17

Breaking changes: Multiple across both releases (see above). However, the codebase has minimal exposure:

• No direct net/http, io.ReadAll, net/url.Parse, image/jpeg, compress/flate, net.UnixConn, go/types, or timer channel usage
• encoding/json used only in one test file (test/e2e/e2e_test.go) for standard Kubernetes API response parsing -- low risk
• crypto/x509, crypto/tls, crypto/rand used in controller and tests for CRL management -- standard patterns, no deprecated APIs
• All fmt.Errorf with percent-w calls wrap error interface values, not pointer types -- passes new vet check
• No GODEBUG/GOEXPERIMENT settings in the codebase

Security concerns: None. The Go version bump includes security hardening (crypto random enforcement, stricter URL parsing). No supply chain concerns -- this is a Go toolchain update from the official source.

Impact on codebase: Direct code impact is low. The codebase does not use most of the changed APIs. Indirect impact via controller-runtime, client-go, and cert-manager dependencies is managed by their maintainers (all at recent versions).

CI status: FAILING

• lint job failed at Run linters step
• build / build job failed at Build image step

Root cause of CI failure: The PR only updates go.mod but does NOT update the Dockerfiles:

• Dockerfile line 2: still references golang:1.25 base image
• .devcontainer/Dockerfile line 1: still references go:1.25-trixie base image

This version mismatch between go.mod (1.27.2) and the build container (1.25) causes the build to fail.

Recommendation: REVIEW REQUIRED

Notes:

1. The Dockerfile and .devcontainer/Dockerfile must be updated to Go 1.27 base images before this PR can merge
2. The lint failure is likely also caused by the Go version mismatch (linter running on Go 1.25 against go.mod requiring 1.27.2)
3. Once Dockerfiles are updated and CI passes, the actual code risk is low -- the codebase does not use the APIs that have breaking changes
4. Consider testing the GreenTea GC behavior under the operator workload, though it is generally transparent
5. The encoding/json v2 backend (Go 1.27) is worth monitoring in integration/e2e tests for any subtle behavior differences in Kubernetes object serialization via controller-runtime

-- Claude Code

[claude]

The base image on line 1 still uses go:1.25-trixie while go.mod now requires go 1.27.2. Since Go 1.21+, the go directive acts as a minimum version — Go 1.25 will refuse to compile, breaking the devcontainer.

The FROM line needs updating to a Go 1.27 image (with the correct digest). Consider adding a # renovate: annotation above it so future Go bumps update it automatically.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.0 → 1.27.2 (two minor version jump) + golangci-lint 2.5.0 → 2.15.0
Semver bump type: minor (×2)

Changes:

• Go module directive bumped from 1.25.0 to 1.27.2 (skipping 1.26)
• golangci-lint bumped from 2.5.0 to 2.15.0 across Dockerfile, Makefile, and CI workflow
• New .golangci.yml exclusion: goconst linter disabled for test files
• go.mod require blocks reordered (direct deps separated from indirect)
• Devcontainer, Dockerfile, docs updated for Go 1.27

Breaking changes (Go 1.26):

• crypto random parameters now ignored in favor of secure internal source — this codebase uses rand.Reader in x509.CreateRevocationList(), which is safe (behavior only improves)
• net/http.ServeMux trailing-slash redirects changed from 301 to 307 — not affected (no direct net/http usage in source)
• image/jpeg encoder/decoder replaced — not affected (no usage)
• PKCS#1 v1.5 encryption deprecated — not affected (no usage)

Breaking changes (Go 1.27):

• encoding/json backed by json/v2, rejects invalid UTF-8 and duplicate keys by default — very low risk (only one json.Unmarshal in e2e tests for a k8s token response)
• TLS GODEBUG overrides permanently removed (tlsrsakex, tls3des, tls10server, tlsunsafeekm) — not affected (codebase does not use these)
• crypto/tls.Config.Rand deprecated — not affected (not used in codebase)
• net.UnixConn EOF handling change — not affected (not used)
• bzr VCS support removed — not affected
• compress/flate output may differ — not affected
• Unicode upgraded to 17 — negligible impact for a k8s operator

Security concerns: None negative. Positive security improvements:

• TLS 1.0 server support, 3DES, and RSA-only key exchanges permanently removed
• Post-quantum hybrid key exchanges enabled by default
• Crypto functions always use secure random source

Impact on codebase:

• crypto/x509: Used extensively for CRL management (ParseCertificate, ParsePKCS8PrivateKey, CreateRevocationList, ParseRevocationList). No deprecated APIs used. rand.Reader parameter in CreateRevocationList is now ignored (safe).
• crypto/tls: Standard tls.Config usage in cmd/main.go and tests. No deprecated Config.Rand usage.
• encoding/json: Single json.Unmarshal in e2e tests. Standard usage, unaffected by json/v2 strictness.
• No usage of io.ReadAll, net.UnixConn, image/jpeg, timer channels, or HTTP ServeMux.

Recommendation: REVIEW REQUIRED

Notes:

• CI checks are still queued/in-progress — verify all pass before merging
• Non-bot commits detected (g-carre alongside scality-renovate[bot]) — cannot auto-approve; requires human review
• The two-minor-version jump is substantial but codebase analysis shows no usage of affected APIs
• golangci-lint 2.5.0 → 2.15.0 is a significant jump; the new goconst exclusion for test files suggests the upgrade surfaced new lint findings that were addressed
• Overall code risk is low — the Go version bump is safe for this codebase's usage patterns

— Claude Code

[g-carre]

LGTM