chore(deps): update go module directive to v1.27.1

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.25.6 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ezekiel-alexrod]

On hold for now.

• Branch is stale (based on main from June 15): only detect-modules ran, no tests/lint. Needs a rebase and a full green CI first.
• GO_VERSION: 1.25 in pre-merge.yaml should be bumped along with this, otherwise CI relies on implicit GOTOOLCHAIN auto-download.
• raidmgmt is a library: bumping the go directive forces Go ≥ 1.26.4 on all consumers. We'll check they're ready before merging.

Will rebase and merge once the above is aligned.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 -> 1.26.6 (minor)
Semver bump type: minor

Changes:

• Go module directive bumped from 1.25.6 to 1.26.6
• Removed unused github.com/vektra/mockery/v3 dependency from go.mod and go.sum

Breaking changes: None affecting this codebase. Go 1.26 introduces stricter net/url.Parse validation, Green Tea GC as default, linker section reorganization, and deprecates some crypto APIs -- but this codebase uses none of these patterns (verified: no net/url imports, no url.Parse, no crypto/ecdsa or crypto/rsa, no GODEBUG settings, no reflect.Type or reflect.Value).

Security concerns: None. Go 1.26 enables post-quantum TLS key exchanges by default and includes various standard library hardening. No supply chain concerns -- this is a Go toolchain update from the official Go project.

Impact on codebase:

• mockery/v3 removal is safe -- no references found anywhere in the codebase (no imports, no go:generate directives)
• No code uses Go 1.26 breaking-change-affected APIs

Recommendation: REVIEW REQUIRED

Notes:

• CI is failing: The build-e2e job fails because .github/workflows/pre-merge.yaml hardcodes GO_VERSION: 1.25 with GOTOOLCHAIN=local. Go 1.25.13 refuses to build a module requiring Go 1.26.6. Fix: update GO_VERSION from 1.25 to 1.26 in .github/workflows/pre-merge.yaml (line 11).
• Once CI is green, this PR should be safe to merge.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 -> 1.27.1 (minor bump, skips 1.26 entirely)
Semver bump type: minor (two minor versions)

Changes:

• Updates go directive in go.mod from 1.25.6 to 1.27.1
• Removes unused github.com/vektra/mockery/v3 dependency
• Spans two Go releases (1.26 and 1.27) with significant behavioral changes

Breaking changes:

• encoding/json v2 backend (Go 1.27): Rejects invalid UTF-8 and duplicate JSON object keys by default. Error messages changed. This is high risk for this codebase which extensively parses CLI tool JSON output (storcli2, perccli2, ssacli) via json.Unmarshal and json.NewDecoder across 7+ files. If any vendor CLI produces duplicate keys or non-UTF-8 bytes, parsing will silently start failing. Opt-out available via GOEXPERIMENT=nojsonv2 temporarily.
• net/url.Parse (Go 1.26): Rejects malformed hosts with unbracketed colons. Not used in codebase.
• Timer channels always unbuffered (Go 1.27). No timer usage found in codebase.
• compress/flate output changed (Go 1.27). Not directly used.
• Closure symbol names changed (Go 1.27) in compiled binaries.

Security concerns: None identified. No suspicious patterns in the dependency changes. Post-quantum TLS key exchanges enabled by default in Go 1.26, and multiple legacy TLS GODEBUG overrides permanently removed in 1.27 (TLS 1.0 server, RSA key exchange, 3DES), but this codebase does not use crypto/tls or net/http.

Impact on codebase:

• JSON parsing (HIGH): 6 json.Unmarshal/json.NewDecoder calls across 4 files (pkg/utils/json.go, pkg/implementation/storcli2/decode.go, pkg/implementation/raidcontroller/megaraid/runner.go, tests). 80+ JSON struct tags across entity types. All testdata fixtures (120+ JSON files) will be parsed under the new v2 engine.
• CI workflow mismatch (BLOCKER): .github/workflows/pre-merge.yaml hardcodes GO_VERSION: 1.25. A module declaring go 1.27.1 cannot be built with Go 1.25 -- this is the direct cause of the build-e2e failure.
• No usage of net/http, io.ReadAll, timers, or compress/flate found.

Recommendation: REVIEW REQUIRED

Notes:

1. CI is broken. The build-e2e job fails because the pre-merge workflow pins GO_VERSION: 1.25 while this PR sets go 1.27.1 in go.mod. The GO_VERSION env var (also renovate-managed) must be updated to 1.27 in the same PR or coordinated.
2. encoding/json v2 is the highest-risk change. Before merging, run the full test suite under Go 1.27 to validate that all JSON testdata fixtures (120+ files from storcli2/perccli2 CLI output captures) parse correctly under the stricter v2 engine. Pay special attention to duplicate keys and non-UTF-8 bytes in vendor CLI output.
3. Two-version jump (1.25 -> 1.27) means reviewing both Go 1.26 and 1.27 release notes for behavioral changes.
4. The removal of mockery/v3 appears to be unrelated cleanup bundled with the version bump.

-- Claude Code