chore(deps): update golang

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	patch	1.26.4 → 1.26.5
golang (source)	stage	digest	792443b → 2005724
mcr.microsoft.com/devcontainers/go	final	digest	232b16d → a05706c

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.26.5 (patch) + Docker image digest updates
Semver bump type: patch

Changes:

• Security fix: CVE-2026-39822 — os package root escape via symlink + trailing slash
• Security fix: crypto/tls PSK handling in ECH outer client hello
• Bug fixes in runtime (5), cmd/go (2), net (1), os/signal (1)

Breaking changes: None

Security concerns: None for this codebase. CVE-2026-39822 affects os.Root/os.OpenRoot which this project does not use. The crypto/tls ECH fix is not relevant as this project does not import crypto/tls directly or use ECH features.

Impact on codebase: No affected patterns found. The diff is limited to go.mod version bump (1.26.4 → 1.26.5) and Docker image digest updates in Dockerfile and .devcontainer/Dockerfile.

CI status: ✅ build, lint, test all passing

Recommendation: SAFE TO MERGE

Notes: This is a standard Go patch release with security fixes that do not affect this codebase. The runtime and toolchain bug fixes are beneficial. As a security patch release, merging promptly is recommended.

— Claude Code