build(deps): bump kubernetes group to 0.36.1, controller-runtime to 0.24.1, Go to 1.26.3

Brings REL_5_8 in line with the dependency baseline already running on
main (PRs #4479 and #4483) so that the branch picks up:

  - k8s.io/* 0.35.2 -> 0.36.1
  - k8s.io/apiextensions-apiserver / apiserver 0.35.0 -> 0.36.0
  - k8s.io/kube-openapi refreshed to the v0.36.1 timestamp
  - k8s.io/klog/v2 2.130.1 -> 2.140.0
  - k8s.io/utils refreshed
  - sigs.k8s.io/controller-runtime 0.23.1 -> 0.24.1
  - sigs.k8s.io/apiserver-network-proxy/konnectivity-client 0.31.2 -> 0.34.0
  - sigs.k8s.io/structured-merge-diff/v6 to a stable v6.3.2
  - go directive 1.25.0 -> 1.26.3 (matches main)
  - golang.org/x/time 0.9.0 -> 0.14.0
  - google.golang.org/protobuf 1.36.11 -> 1.36.12 pre-release

This supersedes Dependabot PR #4476: that PR mixes k8s 0.36.0 with
controller-runtime 0.23.3, which fails to compile because client-go
v0.36 added a HasSyncedChecker method to ResourceEventHandlerRegistration
that controller-runtime 0.23.x does not implement. Bumping cr to 0.24.1
is the supported combination.

Required source / config backports (mirror PR #4483 on main):

  - config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml:
    `make generate-crd` strips the now-obsolete "ProcMountType feature
    flag" sentence from the procMount field description, since the gate
    was promoted to GA in Kubernetes 1.36.

  - internal/controller/postgrescluster/volumes.go: handle the new
    `corev1.PersistentVolumeClaimUnused` condition (KEP-4901, K8s 1.36)
    in the existing no-op `case` so that the `exhaustive` linter is
    satisfied.

  - internal/controller/postgrescluster/pgbackrest.go: fix a `go vet`
    warning that surfaced under Go 1.26 by adding a %q verb to the
    `EventRecorder.Eventf` call that was passing `repoName` without a
    matching format directive.

  - .golangci.yaml: add SA1019 exclusions for two new deprecations:
      * `managed.FieldsV1.Raw` (k8s.io/apimachinery v0.36 deprecated
        direct field access; tests still exercise the legacy field).
      * `scheme.Builder` (controller-runtime v0.24 deprecated; the
        recommended replacement requires restructuring our api packages
        and is left for a follow-up).

`generate-rbac` is unchanged from REL_5_8 and was not regenerated here
because controller-gen tries to parse `internal/postgres/...`, which
transitively imports `pg_query_go` and fails to build on macOS hosts
(unrelated to this bump).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ValClarkson

.golangci.yaml

@@ -189,6 +189,19 @@ linters:
         text: >-
           client.Apply is deprecated
 
+      # k8s.io/apimachinery v0.36 deprecated direct access to managed.FieldsV1.Raw
+      # in favor of GetRawBytes/SetRawBytes. Tests still use the old field.
+      - linters: [staticcheck]
+        path: internal/controller/postgrescluster/apply_test\.go
+        text: managed.FieldsV1.Raw is deprecated
+
+      # controller-runtime v0.24 deprecated scheme.Builder, but the recommended
+      # alternative requires restructuring our api packages. Allow current usage
+      # until a follow-up migrates to the new helper.
+      - linters: [staticcheck]
+        path: pkg/apis/postgres-operator.crunchydata.com/.*/groupversion_info\.go
+        text: scheme.Builder is deprecated
+
 # https://golangci-lint.run/usage/formatters
 formatters:
   enable:

config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml

@@ -10241,7 +10241,6 @@ spec:
                                   procMount denotes the type of proc mount to use for the containers.
                                   The default value is Default which uses the container runtime defaults for
                                   readonly paths and masked paths.
-                                  This requires the ProcMountType feature flag to be enabled.
                                   Note that this field cannot be set when spec.os.name is windows.
                                 type: string
                               readOnlyRootFilesystem:
@@ -16060,7 +16059,6 @@ spec:
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:

go.mod

@@ -1,7 +1,7 @@
 module github.com/crunchydata/postgres-operator
 
 // If this is changing when you don't want it to, see hack/go-get.sh
-go 1.25.0
+go 1.26.3
 
 require (
 	github.com/go-logr/logr v1.4.3
@@ -22,12 +22,12 @@ require (
 	golang.org/x/crypto v0.51.0
 	golang.org/x/tools v0.45.0
 	gotest.tools/v3 v3.5.2
-	k8s.io/api v0.35.2
-	k8s.io/apimachinery v0.35.2
-	k8s.io/client-go v0.35.2
-	k8s.io/component-base v0.35.2
-	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
-	sigs.k8s.io/controller-runtime v0.23.1
+	k8s.io/api v0.36.1
+	k8s.io/apimachinery v0.36.1
+	k8s.io/client-go v0.36.1
+	k8s.io/component-base v0.36.1
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a
+	sigs.k8s.io/controller-runtime v0.24.1
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -41,7 +41,7 @@ require (
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
@@ -51,7 +51,6 @@ require (
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/google/btree v1.1.3 // indirect
 	github.com/google/cel-go v0.26.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
@@ -62,18 +61,17 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
-	github.com/spf13/cobra v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -102,28 +100,29 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
 	golang.org/x/mod v0.36.0 // indirect
 	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.44.0 // indirect
 	golang.org/x/term v0.43.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	google.golang.org/grpc v1.80.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.35.0 // indirect
-	k8s.io/apiserver v0.35.0 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
+	k8s.io/apiextensions-apiserver v0.36.0 // indirect
+	k8s.io/apiserver v0.36.0 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/streaming v0.36.1 // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 )