chore(deps): update go module directive to v1.26.6

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
go (source)	golang	patch	1.26.4 → 1.26.6	1.27.0 (+1)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.26.6 (patch)
Scope: go.mod directive only (1 file, 1 line)

Changes (1.26.5 + 1.26.6 combined):

• Security fixes (1.26.5): crypto/tls, os
• Security fixes (1.26.6): go command, crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, net/url — a broad security release touching 8 areas
• Bug fixes: compiler, runtime, linker, net, os, syscall, crypto/tls

Breaking changes: None documented. However, Go 1.26.7 was subsequently released to fix a regression in unencrypted HTTP/2 introduced in 1.26.6. This project does not use unencrypted HTTP/2 (h2c) — confirmed by searching the codebase — so the regression does not apply here.

Security concerns: None adverse. This is a security release; the net/http and crypto/tls fixes are directly relevant since this adapter runs HTTP and gRPC servers. Merging promptly is recommended.

Impact on codebase: The net/http and crypto/tls security patches apply to code paths this project uses (HTTP server in pkg/presentation/http/, gRPC server in pkg/presentation/storeapi/). No API changes — these are internal fixes.

CI status:

• ✅ lint: passed
• ✅ test: passed
• ❌ build / build: FAILED — go mod download fails during Docker build because the Dockerfile (golang:1.26@sha256:792443b...) pins a Go 1.26.x image older than 1.26.6. Since Go 1.21+, the toolchain enforces the go directive as a minimum version, so the pinned image's toolchain rejects go 1.26.6. The Dockerfile base image digest needs to be updated to a golang:1.26.6 image.

Recommendation: REVIEW REQUIRED

Notes:

1. Build is broken. The Dockerfile base image digest must be updated to include Go 1.26.6. Renovate updated go.mod but not the Dockerfile digest — this is a known gap when the two are managed by separate renovate rules.
2. Once the Dockerfile is updated and CI is green, this is a straightforward security patch bump and safe to merge.
3. Consider whether to skip directly to Go 1.26.7 (which fixes the HTTP/2 regression from 1.26.6), even though this project is unaffected by that specific regression.

— Claude Code