chore(deps): update go module directive to v1.26.5

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
go (source)	golang	patch	1.26.4 → 1.26.5	1.26.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.26.5 (patch) + Docker image digest updates
Semver bump type: patch

Changes:

• Go toolchain patch bump from 1.26.4 to 1.26.5
• Docker base image digest updates for golang and devcontainers/go (track the new Go version)
• No source code changes — only go.mod, Dockerfile, and .devcontainer/Dockerfile

Go 1.26.5 includes (11 issues):

• Security: CVE-2026-39822 — os.Root escape via symlink + trailing slash; crypto/tls ECH/PSK fix
• Runtime: 5 bug fixes (GC AVX-512 crash, map concurrency on ppc64le, fork+race SIGSEGV on darwin/arm64, version parsing, moveSliceNoCap)
• cmd/go: GOFIPS140 interaction fix, test caching with T.Chdir
• os/signal: NotifyContext error cause mismatch with context.Canceled
• net: Windows DNS test fix

Breaking changes: None

Security concerns: None — the security fixes are beneficial. CVE-2026-39822 (os.Root escape) does not affect this codebase: the adapter only uses os.Exit() and os.Getenv(), never os.Root or symlink-traversal APIs. crypto/tls is not directly imported. The os/signal.NotifyContext fix (#79499) is relevant to cmd/main.go:44 but harmless: the codebase never checks errors.Is(err, context.Canceled) on the signal context.

Impact on codebase: No affected patterns found. All fixes are either in packages not used by this project or in code paths not exercised.

Recommendation: SAFE TO MERGE (once CI is green)

Notes: CI checks (build, test) are still in progress and renovate/stability-days is pending. Merge after all checks pass. This is a standard Go patch release with security hardening — recommended to merge promptly.

— Claude Code