[janhoy]

Makes Solr 9.11.0 the default, up from 9.10.0.

Operator work

None needed. I went through the 9.10 → 9.11 changes for everything the operator depends on:

• JWT blockUnknown now defaults to true — the operator only ever writes solr.BasicAuthPlugin, and writes blockUnknown explicitly, so nothing changes.
• Basic Auth now rejects a password equal to its username — the operator's bootstrapped credentials are randomly generated.
• /{core}/replication and /update/extract permission tightening — the operator calls neither.
• New solr.xml allowZkHosts setting — optional cross-collection-join hardening, already reachable through a custom solr.xml ConfigMap, so not exposed as a CRD field here.
• UPGRADECOREINDEX, Luke shard aggregation, LocalTikaExtractionBackend and gosu removal — no operator touchpoint.

One behaviour change earns an upgrade note: a Solr 9.11 node refuses to start if its major.minor is below that of a node already running in the cluster, so rolling a live cluster back to an older Solr no longer works.

Security

9.11.0 carries the 9.10.1 fixes for three CVEs that all affect "Solr 9.10.0 and earlier":

• CVE-2026-22022, a RuleBasedAuthorizationPlugin predefined-permission bypass. This one does reach operator-managed clusters, since the operator bootstraps that plugin — but its generated security.json already contains the documented mitigation ({ "name": "all", "role":["admin"] }), so operator defaults were never exposed. Users supplying their own security.json may be.
• CVE-2026-22444, standalone-mode core creation — not reachable, the operator only runs SolrCloud.
• CVE-2025-66516, XXE via XFA in PDFs — reachable for users who enable the extraction module.

Both charts record the CVE fixes in their changelog. artifacthub.io/containsSecurityUpdates is flipped to "true" on the Solr chart only — the operator's own code carries no security fix, it just changes which Solr version newly created clusters start on.

Compatibility matrix

Unchanged: 9.11 falls inside the existing 9.4+ column and the v0.10.x row already reads YES.

Changelog

A changed entry in both helm/solr/Chart.yaml and helm/solr-operator/Chart.yaml, plus a security entry in the Solr chart.

Worth being precise about who this reaches, because the obvious reading is wrong. helm/solr/values.yaml ships tag: "" and the chart omits the field entirely when it is empty (helm/solr/templates/solrcloud.yaml), so a new SolrCloud comes up on DefaultSolrVersion — but the operator then writes that tag back into the spec (withDefaults fills an empty tag, and the controller persists the change with r.Update), and a later helm upgrade leaves an absent field alone. So the new default reaches newly created SolrClouds only; a running cluster keeps the Solr version already in its spec and is not upgraded by upgrading the operator. The changelog entries and the v0.10.0 upgrade note both say so, and the upgrade note says how to move an existing cluster.

An earlier revision of this PR claimed the opposite in all four places. Thanks @Copilot for catching it on #870 — stating that running clusters had picked up three CVE fixes would have misled in the dangerous direction.

Drive-by

local-tutorial.adoc installed 9.10.0 and then "upgraded" to 9.10.0, so its Upgrade to newer version section demonstrated nothing — both sites were collapsed onto one version by the blanket sed in #807. The install step now uses 9.10.0 and the upgrade step 9.11.0.

Testing

make test, check-manifests, check-generated, check-helm and check-docs all pass.

make e2e-tests was not run — it fails before the suite starts, on #859: kind load of the registry-pulled solr:9.11.0 dies on Docker 29's containerd image store with ctr: content digest ...: not found. Unrelated to this change, and #860 is open against it. CI's e2e workflow is permanently disabled, so it is evidence of nothing either way; this bump is worth a local e2e run before merge, on a machine where #859 does not bite.

Produced with the solr-version-support skill proposed in #866, which encodes the 15 duplicated version sites, the sizing rules above, the compatibility matrix and the both-charts changelog requirement — none of which any make target checks.

---

🤖 AI assisted

[Copilot]

🟡 Changes recommended

Upgrade documentation needs corrections so users can accurately determine whether existing clusters receive the security fixes and understand downgrade restrictions.

2 open issues

• Document persisted Solr tags and explicit upgrade path · New
• Correct downgrade safeguard behavior and override documentation · New

What changed in this PR

Updates the operator’s default Solr version from 9.10.0 to 9.11.0 and aligns charts, examples, documentation, and test defaults.

Changes:

• Sets Solr 9.11.0 as the default across runtime configuration and test tooling.
• Updates chart release notes and security metadata.
• Adds upgrade guidance and restores a genuine version upgrade in the local tutorial.

File	Description
tests/​scripts/​manage_e2e_tests.sh	Updates default test image and help text.
tests/​e2e/​suite_test.go	Updates the default e2e Solr image.
helm/​solr/​README.md	Updates documented versions and commands.
helm/​solr/​Chart.yaml	Updates app version, changelog, and security metadata.
helm/​solr-operator/​Chart.yaml	Adds release notes and updates example images.
hack/​release/​smoke_test/​test_cluster.sh	Updates smoke-test image defaults and help.
example/​test_solrprometheusexporter.yaml	Updates the exporter image tag.
example/​test_solrcloud.yaml	Updates the example Solr image tag.
example/​test_solrcloud_toleration_example.yaml	Updates the toleration example’s image tag.
example/​test_solrcloud_private_repo.yaml	Updates the private-repository image tag.
example/​test_solrcloud_backuprepos.yaml	Updates the backup example’s image tag.
docs/​modules/​upgrade-notes/​pages/​upgrade-notes.adoc	Adds default-version and downgrade guidance.
docs/​modules/​getting-started/​pages/​local-tutorial.adoc	Demonstrates upgrading to 9.11.0.
dev-docs/​e2e-testing.md	Documents the new default test image.
api/​v1beta1/​solrcloud_types.go	Sets DefaultSolrVersion to 9.11.0.

_{Review effort: Balanced}