[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	patch	1.27.0 → 1.27.3
golang (source)	stage	digest	f44f6e8 → 2920bb1
golangci/golangci-lint		minor	v2.14.0 → v2.15.0
golangci/golangci-lint		minor	2.14.0 → 2.15.0
golangci/golangci-lint	uses-with	minor	v2.14.0 → v2.15.0

---

Release Notes

golangci/golangci-lint

v2.15.0

Compare Source

Released on 2026-10-16

1. Linters new features or changes
   • errcheck: from 1.20.0 to 1.30.0
   • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
   • gocognit: from 1.2.1 to 1.3.0
   • golines: from 0.15.0 to 0.16.0
   • govet-modernize: from 0.50.0 to 0.52.0
   • loggercheck: from 0.12.0 to 0.13.0
   • predeclared: from 0.2.2 to 0.3.0
   • wrapcheck: from 2.12.0 to 2.13.0
2. Linters bug fixes
   • bidichk: from 0.3.3 to 0.3.4
   • canonicalheader: from a25c71c to e18e5c5
   • gofumpt: improve deprecation logs
   • gosec: improve concurrency default value
   • iface: from 1.5.1 to 1.5.3
   • paralleltest: from 1.0.15 to 1.0.16
   • revive: from 1.17.0 to 1.17.1
   • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
   • rowserrcheck: from c5f79b8 to e0740d5
   • staticcheck: from 0.8.1 to 0.8.2
3. Bug fixes
   • fix: compute custom version hash with module versions
   • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

• The replaced options still exists, and partially works, but they are deprecated.
• The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
• The check the value map has been replaced by mapliteral.
• The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
• The option ignore-enum-types (string) has been replaced by ignore-types (slice).
• New report messages.
• The linter is a now a "slow" linter.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.27.0 -> 1.27.1 (patch)
Files changed: go.mod only (go directive)

Changes (Go 1.27.1 bug fixes):

• database/sql: deadlock fix in Rows.Next vs concurrent Rows.Close
• encoding/json: regression fix for quoted null with ,string tag; v2 decoder EOF fix
• net/http: Request.Body.Close returning io.EOF on partially-read bodies
• Compiler: linker symbol fix for generic methods; s390x and ARM64 SIGILL fixes
• debug/elf, cmd/fix: minor fixes

Breaking changes: None -- standard patch release with bug fixes only

Security concerns: None -- no CVEs referenced

Impact on codebase:

• database/sql (#81151): Not affected -- project uses pgx directly, no database/sql import
• encoding/json (#81083, #81012): Not affected -- no ,string JSON tag usage; uses json.Marshal/json.Unmarshal only (not v2 decoder)
• net/http (#81027): Not affected -- no Body.Close patterns; request body reading handled by snappy/protobuf decoder
• Compiler s390x/ARM64 fixes: Not affected -- builds target linux/amd64
• debug/elf, simd: Not used

CI status: All checks passing (build, lint, test, integration-test on PG 16/17/18)

Recommendation: SAFE TO MERGE

Notes: This is a straightforward Go patch bump. None of the 12 bug fixes in Go 1.27.1 affect code paths used by this project. All CI checks pass.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change:

• Go toolchain (go.mod directive): 1.27.0 -> 1.27.3
• golang:1.27 builder image (Dockerfile): digest f44f6e8 -> 2920bb1 (a rebuild of the same tag)
• golangci-lint (pre-merge.yaml lint job, .devcontainer/Dockerfile): v2.14.0 -> v2.15.0

Semver bump type: patch (Go), digest (image), minor (golangci-lint, CI and dev tooling only)

Changes:

• Go 1.27.1 (2026-09-01): bug fixes in cgo, the compiler, the runtime, database/sql, encoding/json, net/http, os
• Go 1.27.2 (2026-10-08): security fixes in the go command, crypto/tls, html/template, net/http, net/textproto, os; bug fixes in the compiler, linker, runtime, compress/flate, encoding/json
• Go 1.27.3 (2026-10-19): security fix in crypto/x509
• golangci-lint 2.15.0: linter upgrades (errcheck 1.30.0, staticcheck 0.8.2, revive 1.17.1, wrapcheck 2.13.0, gosec concurrency default, ...). The exhaustive config options were renamed.

Breaking changes: None affect this repo. .golangci.yaml does not enable exhaustive, so its option renames do not apply. Linters this repo does enable (errcheck, revive, staticcheck, wrapcheck, gosec) were upgraded and could report new findings. The lint job decides that.

Security concerns: This bump fixes security issues and adds none. The net/http fixes apply to the HTTP server (/write, /read, /health). The crypto/tls/crypto/x509 fixes apply to PostgreSQL TLS connections (POSTGRESQL_DATABASE_SSL_MODE=verify-*) and the gRPC stack. The shipped binary only gets these fixes once this PR is merged and the image is rebuilt. No new module dependencies: go.sum and the require blocks are unchanged.

Impact on codebase: No source changes. The PR is four one-line version/digest bumps (go.mod, Dockerfile, .devcontainer/Dockerfile, .github/workflows/pre-merge.yaml).

CI status (at evaluation time, after the 2026-10-29 rebase): lint, test, build and integration-test (16/17/18) were all still running.

Recommendation: REVIEW REQUIRED

Notes: The changes look safe, and the Go security fixes are a good reason to merge soon. A human must approve because:

1. scality-renovate[bot] opened the PR (dependabot did not), so it cannot be approved automatically;
2. no Pre Merge check had finished, including lint, which is where golangci-lint v2.15.0 runs for the first time. Merge once they are green.

— Claude Code