chore(deps): update go module directive to v1.27.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
go (source)	golang	minor	1.26.4 → 1.27.0	1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.27.0 (minor)
Semver bump type: minor

Changes:
Go 1.27 is a significant release with many changes. Key items:

• Language: Generic methods, generalized struct literal key selectors, broader function type inference
• Runtime: asynctimerchan GODEBUG removed — timer channels always unbuffered; goroutine labels in tracebacks; size-specialized malloc
• Standard library: encoding/json backed by v2 implementation; compress/flate output changed; net/http response body auto-drain on close; HTTP/2 client priority signals; net.UnixConn EOF handling changed; crypto/ecdsa hash length validation; Unicode 15→17
• Toolchain: bzr VCS support removed; go test runs stdversion vet by default; go test -json output format changed; go mod tidy merges duplicate require blocks; removed GODEBUGs (tlsrsakex, tls3des, tls10server, x509keypairleaf, gotypesalias)
• Platforms: macOS 13 minimum required; ppc64 ELFv2 ABI

Breaking changes: Multiple — see above. However, most do not affect this codebase.

Security concerns: None specific to this bump. The removed TLS/crypto GODEBUGs improve security posture by eliminating legacy cipher suites.

Impact on codebase:

• encoding/json: Not used — no impact from v2 backend change
• crypto/tls, net/http, encoding/xml, compress/*: Not imported — no impact
• asynctimerchan removal: The codebase uses time.NewTicker in symlink_poller.go with a standard select pattern (case <-ticker.C:) — safe with unbuffered channels
• time.AfterFunc in watcher.go: Unaffected (does not use channels)
• os.Root: No breaking changes in Go 1.27 — no impact
• filepath.Match: No breaking changes — no impact
• log/slog: No breaking changes — no impact
• GODEBUG///go:debug: Not used in codebase — no impact from rejection of removed settings
• Unicode 15→17: No string/rune-sensitive logic — no impact

CI status:

• ❌ lint — FAILING: golangci-lint v2.12.2 was built with Go 1.26 and rejects Go 1.27 as target (can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.0)). Needs a golangci-lint release built with Go 1.27.
• ❌ build / build — FAILING: Dockerfile pins golang:1.26 by digest. With go.mod now requiring go 1.27 and GOTOOLCHAIN=local, go mod download fails. Dockerfile base image must be updated to golang:1.27.
• ❌ generate — FAILING: "Verify generated mocks are up to date" — likely the same Go version mismatch when running go generate with mockery.
• ⏳ test — in progress at time of review
• ⏭️ verify-capabilities — skipped (depends on build)

Recommendation: REVIEW REQUIRED

Notes:

1. CI is broken and requires coordinated updates. This PR only changes go.mod, but a Go 1.27 upgrade also needs:
   • Dockerfile base image: golang:1.26 → golang:1.27 (with updated digest)
   • devcontainer base image: mcr.microsoft.com/devcontainers/go:1.26-trixie → 1.27-trixie
   • golangci-lint: v2.12.2 may need a newer version built with Go 1.27 support
   • README: Go version requirement Go 1.26+ → Go 1.27+
2. The codebase itself appears safe. None of the Go 1.27 breaking changes affect the packages or patterns used by file-reflector. The time.NewTicker usage follows the recommended select pattern. No JSON, crypto/tls, net/http, or other affected standard library packages are imported.
3. This is a minor version bump, not a patch. While the code impact is low, the toolchain coordination makes this a non-trivial update. Recommend addressing all the above items in this PR before merging.

— Claude Code