[janhoy]

This PR is generated by the new skill in #864. Please review the upgrades and also take a look at the skill.

---

Routine dependency sweep, and it turns out to be a security one: the Kubernetes client libraries move to 1.37, controller-runtime to 0.25 and Helm to 3.22, which pulls golang.org/x/net to 0.61.0 and golang.org/x/text to 0.43.0 and closes six vulnerabilities that govulncheck confirms were call-path reachable from the operator — five HTTP/2 denial-of-service issues and an infinite loop on invalid input.

Sets and spans crossed: the Kubernetes set (api, apimachinery, client-go and the indirect k8s.io/* entries) v0.36.2 → v0.37.1; controller-runtime v0.24.1 → v0.25.2; helm.sh/helm/v3 v3.21.2 → v3.22.1; cert-manager v1.20.2 → v1.21.3; the Ginkgo/Gomega/testify test stack; and the pinned tools — controller-gen v0.21.0 → v0.23.0, kind v0.30.0 → v0.33.0, yq v4.53.3 → v4.54.1, envtest assets 1.36.0 → 1.37.0.

Not mechanical, worth a reviewer's eye: cert-manager 1.21 renamed cmmeta.ObjectReference to IssuerReference (same fields), which is three call sites in tests/e2e/utils_tls_test.go — cert-manager is imported only by the e2e tests, never by production code. The kustomize tool pin takes its major, v4.5.7 → v5.8.0, in a separate commit: the v4 line ended in 2022, only kustomize edit add resource and edit set image are used and both are unchanged in v5; I verified make prepare-deploy-kustomize and a full kustomize build config/default (v5.8.0 rather than v5.8.3 keeps the pinned Go 1.26 toolchain). helm.sh/helm v4 exists and is deliberately not in this PR — one test file, but it deserves its own review.

The regenerated CRDs are ~1950 added lines and purely additive: the new optional pod fields that come with the Kubernetes 1.37 API types (gRPC probe protocol/mode, projected-volume user/defaultUser). Every removed line is upstream description rewording; no field, validation or default was dropped, and generated RBAC is unchanged.

For the record, the Kubernetes support gap has widened — the charts declare kubeVersion >= 1.22.0-0 while the libraries now build against 1.37 and the oldest version actually tested is 1.26.6. This PR deliberately does not touch kubeVersion or the compatibility matrix; raising the declared floor is a breaking change for existing users and should be its own PR timed to a release.

Changelog: a security entry and a changed entry in helm/solr-operator/Chart.yaml (with containsSecurityUpdates flipped to "true"), and a changed entry in helm/solr/Chart.yaml for the widened CRD schema.

Ran make lint and make test, both clean. Did not run make e2e-tests — note CI's e2e workflow is permanently disabled, so it is evidence of nothing; the cert-manager rename above is in e2e code, so that suite is worth a local run before merge.

[janhoy]

Rebased on a newer Go toolchain so kustomize is no longer held back.

kustomize v5.8.3 requires Go 1.27 while go.mod pinned 1.26, so the previous commit took v5.8.0 to avoid silently pulling a second toolchain. This bumps Go to 1.27 (current stable; 1.26 remains upstream-supported) and takes v5.8.3. The toolchain moves in four places at once — go.mod, build/Dockerfile, and the go-version matrix in check.yaml and smoke-tests.yaml — because the Makefile's version gate rejects a mismatch in either direction, a newer toolchain included.

Nothing else was being held back: re-running the upgrade detector against the new floor reports every module and tool pin current. make prepare produced no generated-file churn, as kustomize only drives the deploy kustomization and not manifest generation.

This is also the first change to follow the skill's new rule from #864: resolve the Go toolchain before judging any other candidate, so dependencies are evaluated against the Go version you are moving to, not the one you are moving from. make list-upgrades now annotates any candidate that needs a newer Go than go.mod pins, which is how this case surfaced rather than being discovered by hand. The changelog entries are also reworded to the tighter style that skill now requires.

[Copilot]

🔵 Needs a closer look

The combined dependency and toolchain upgrades need human review and local e2e validation, especially with e2e CI disabled.

1 open issue

• Align Go toolchain pins with the stated compatibility constraint · New

What changed in this PR

This PR refreshes the Solr Operator’s dependencies and build tools, incorporates reported security fixes, and regenerates CRDs for Kubernetes 1.37 API types.

Changes:

• Updates runtime and test dependencies, tool pins, and Go requirements to 1.27.
• Adds optional pod fields to the SolrCloud and SolrPrometheusExporter schemas.
• Adapts e2e issuer references and refreshes chart changelogs and dependency-license records.

File	Description
tests/​e2e/​utils_tls_test.go	Uses cert-manager’s renamed IssuerReference type.
Makefile	Updates build tools and envtest assets; switches to Kustomize v5.
helm/​solr/​Chart.yaml	Documents the expanded SolrCloud schema.
helm/​solr-operator/​crds/​crds.yaml	Refreshes the bundled CRDs.
helm/​solr-operator/​Chart.yaml	Records dependency upgrades and security updates.
go.sum	Updates dependency checksums.
go.mod	Upgrades dependencies and requires Go 1.27.
dependency_licenses.csv	Refreshes dependency-license references.
config/​crd/​bases/​solr.apache.org_solrprometheusexporters.yaml	Adds optional pod fields and updates upstream descriptions.
config/​crd/​bases/​solr.apache.org_solrclouds.yaml	Adds optional pod fields and updates upstream descriptions.
config/​crd/​bases/​solr.apache.org_solrbackups.yaml	Updates the generator-version annotation.
build/​Dockerfile	Uses the Go 1.27 builder image.
.github/​workflows/​smoke-tests.yaml	Moves smoke tests to Go 1.27.
.github/​workflows/​check.yaml	Moves checks to Go 1.27.

_{Review effort: Balanced}