[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
golang (source)	stage	digest	d200d2d → fa3d596
golang (source)	image	digest	2920bb1 → e519d3b

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: digest-only refresh, tags unchanged

• agent/Dockerfile builder stage: golang:1.27.3-alpine@sha256:d200d2d… -> @sha256:fa3d596…
• agent/.devcontainer/devcontainer.json: golang:1.27@sha256:2920bb1… -> @sha256:e519d3b…

Semver bump type: none (digest only)

Changes:

• Upstream rebuild of the same Go tags (1.27.3 / 1.27). These rebuilds usually pick up base OS (Alpine / Debian) package updates. The Go toolchain version stays the same.

Breaking changes: None expected. The Go version is unchanged, so it still satisfies the go.mod directive.

Security concerns: None identified. A base-image refresh usually brings OS-level security patches. The Alpine image is used only in the builder stage. The shipped image is still gcr.io/distroless/static:nonroot, pinned by its own digest, and the binary is built with CGO_ENABLED=0, so the runtime image does not change. The devcontainer image only affects local development. I could not check the new digests against Docker Hub from this environment.

Impact on codebase: Minimal. The build uses go mod download, go build, and apk add libcap + setcap, all of which work the same on a rebuilt image.

Recommendation: REVIEW REQUIRED (procedural only)

Notes: On its own merits this change is low risk. It is not auto-approved for two reasons: (1) the PR is authored by scality-renovate[bot], and only dependabot PRs are eligible for automatic approval; (2) CI (agent-ci lint/test/image/e2e, rpm-ci el8/el9) was still running when this evaluation was done. Merge once CI is green.

— Claude Code