chore(deps): update go module directive to v1.26.5

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.25.6 → 1.26.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[ezekiel-alexrod]

On hold for now.

• Branch is stale (based on main from June 15): only detect-modules ran, no tests/lint. Needs a rebase and a full green CI first.
• GO_VERSION: 1.25 in pre-merge.yaml should be bumped along with this, otherwise CI relies on implicit GOTOOLCHAIN auto-download.
• raidmgmt is a library: bumping the go directive forces Go ≥ 1.26.4 on all consumers. We'll check they're ready before merging.

Will rebase and merge once the above is aligned.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 → 1.26.5 (minor)
Semver bump type: minor

Changes:

• Go language version bumped from 1.25 to 1.26 (minor release)
• github.com/vektra/mockery/v3 dependency removed from go.mod/go.sum
• Green Tea GC enabled by default (10–40% GC overhead reduction)
• Post-quantum TLS key exchanges enabled by default
• new() accepts expressions, self-referential generic constraints now allowed
• Various stdlib behavioral changes (see details below)

Breaking changes: Go 1.26 introduces several behavioral changes in stdlib packages (net/url.Parse rejects malformed URLs, net/http ServeMux uses 307 instead of 301 for trailing-slash redirects, crypto/* random parameter ignored, image/jpeg different output, io.ReadAll allocation changes). However, none of these affect this codebase — raidmgmt shells out to CLI tools and parses text/JSON output; it does not use net/url, net/http, crypto/*, image/jpeg, io.ReadAll, or any other affected stdlib package.

Security concerns: None. Go 1.26 strengthens crypto defaults (post-quantum TLS, deprecated PKCS#1 v1.5). No dependency source changes to scan (only go.mod/go.sum modified, no vendor directory).

Impact on codebase: No affected patterns found. Codebase grep confirms zero usage of any Go 1.26 breaking-change surface area.

Recommendation: REVIEW REQUIRED

Notes:

• CI is failing: The build-e2e job fails because the workflow hardcodes GO_VERSION: 1.25 with GOTOOLCHAIN=local, but go.mod now requires go >= 1.26.5. The CI workflow needs to be updated to install Go 1.26 before this PR can merge.
• mockery/v3 removed: The PR removes github.com/vektra/mockery/v3 v3.7.1 from go.mod — verify this is intentional and not still needed.
• From a source compatibility standpoint, the Go 1.26 upgrade is safe for this codebase.

— Claude Code