chore(deps): update golang

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	patch	1.26.4 → 1.26.5
golang	stage	digest	792443b → 3aff665
mcr.microsoft.com/devcontainers/go	final	digest	232b16d → 638cb8e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.26.5 (patch) + Docker image digest updates

Changes:

• Security fix — crypto/tls: PSK omission in ECH outer client hello (#80175)
• Security fix — os (CVE-2026-39822): Root escape via symlink plus trailing slash (#79027)
• Bug fixes: runtime (GC AVX-512 SIGILL, concurrent map read on ppc64le, version parsing, SIGSEGV with -race on darwin/arm64), cmd/go (GOFIPS140, test caching with T.Chdir), os/signal (NotifyContext error cause), net (TestLookupCNAME)
• Docker image digests updated for golang:1.26 and mcr.microsoft.com/devcontainers/go:1.26-trixie

Breaking changes: None

Security concerns: None for this project — crypto/tls is not imported directly, and the os.Root API (CVE-2026-39822) is not used. The os package is used only for os.Interrupt, os.Stderr, and os.Exit.

Impact on codebase: No affected patterns found. The security and bug fixes target code paths this project does not exercise.

CI status: Build and test checks are still in progress. Lint passed.

Recommendation: SAFE TO MERGE (once CI is green)

Notes: Standard Go patch release with security backports. The fixes are in subsystems (crypto/tls ECH, os.Root) this adapter does not use. The runtime bug fixes improve general stability. Merge after CI passes and the Renovate stability-days check clears.

— Claude Code