Guard the four unguarded OnePasswordItem references with required()

calibre-web-automated 7.0.0, minecraft-server 6.0.0 and urlaubsverwaltung
10.0.0 each majors: an installation that renders today with an empty itemPath
stops rendering. searxng 1.0.6 is documentation only - its valkey reference is
correctly optional and stays gated by {{- if }}.

Every message names the values path. values.yaml now says per key why it is
required, reusing the wording the charts' NOTES.txt already carry. The
hand-rolled "cwaSecretRef IS UNSET" block in calibre-web-automated's NOTES.txt
is gone: after the guard the render aborts first and that block is
unreachable. minecraft-server's note stays true and now points at the guard.

No "required" array in the schemas, and README guideline 12 now says why. The
plan called for one; measuring it showed it could never fire: the key ships as
null, so it is present at validation time, and JSON Schema's required tests
presence, not null-ness. Making it fire means either dropping the null default
or narrowing the type to "string", and both turn helm lint --strict red on the
chart's own defaults. The schema therefore describes the key as required and
required() enforces it. The README bullet on how null reaches the schema was
also wrong in the case it was being applied to - a null chart default is not
coalesced away - and now distinguishes the three cases.

searxng: the claim "charts in this repo have no dependencies (README,
guideline 13)" in the valkey template, in values.yaml and twice in _helpers.tpl
has been false since #214 and cited the wrong guideline; dependencies are
admissible and are guideline 14. The same sentence survives in other charts'
helpers and needs its own round.

minecraft-server/Chart.yaml

@@ -23,7 +23,7 @@ type: application
 # continuously, so a pod restart could pull a different image than the last one
 # without anything being recorded anywhere. The dated tags are immutable, so the
 # image is now pinned by the chart version like every other chart in this repo.
-version: 5.0.0+up2026.8.2.java25
+version: 6.0.0+up2026.8.2.java25
 appVersion: "2026.8.2-java25"
 
 maintainers:

minecraft-server/templates/NOTES.txt

@@ -204,9 +204,11 @@ OPERATORS ARE SYNCHRONIZED FROM VALUES, NOT FROM THE GAME
 SECRETS — WHICH FIELDS THE 1PASSWORD ITEM MUST CARRY
   The OnePasswordItem CR {{ $secret }} is rendered unconditionally, so
   secrets.minecraftServerRef has to be set even when nothing consumes a key from
-  it; it has no default and would otherwise render an itemPath of null.
+  it; it has no default and would otherwise render an itemPath of null. The
+  template guards it with required(), so a release without it does not render at
+  all — this note tells you why the guard is there, not that you got past it.
 
-    secrets.minecraftServerRef → {{ .Values.secrets.minecraftServerRef | default "NOT SET" }}
+    secrets.minecraftServerRef → {{ .Values.secrets.minecraftServerRef }}
 
   The operator copies the item's FIELDS into the Kubernetes Secret, one key per
   field name. This release consumes:

minecraft-server/templates/minecraft-server.secret.yaml

@@ -3,4 +3,4 @@ kind: OnePasswordItem
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
 spec:
-  itemPath: {{ .Values.secrets.minecraftServerRef }}
+  itemPath: {{ required "A 1Password item reference must be provided (secrets.minecraftServerRef) - the OnePasswordItem is rendered unconditionally, so it is needed even with RCON and CurseForge both off" .Values.secrets.minecraftServerRef }}

minecraft-server/values.schema.json

@@ -28,6 +28,7 @@
       "additionalProperties": false,
       "properties": {
         "minecraftServerRef": {
+          "description": "op:// item path for the 1Password operator. Required even when RCON and the CurseForge downloader are both off: the OnePasswordItem is rendered unconditionally. The item's CONTENT may be empty in that case, the reference may not. Enforced by required() in the template, not here: the null default keeps this type widened, and a schema \"required\" entry could never fire against a key that is present with value null.",
           "type": ["string", "null"]
         }
       }

minecraft-server/values.yaml

@@ -37,9 +37,15 @@ image:
   tagOverride: ""
 
 secrets:
-  # op:// item path for the 1Password operator. Only needs to carry a
-  # "curseforge-api-key" key when curseforge.enabled is true and an
-  # "rcon-password" key when server.rcon.enabled is true.
+  # REQUIRED - op:// item path for the 1Password operator. The OnePasswordItem
+  # CR is rendered unconditionally, so this reference has to be set even when
+  # nothing consumes a key from it; it has no default and would otherwise render
+  # an itemPath of null. The item's CONTENT may be empty in that case: it only
+  # needs to carry a "curseforge-api-key" key when curseforge.enabled is true
+  # and an "rcon-password" key when server.rcon.enabled is true. Without the
+  # value the render aborts - required() in minecraft-server.secret.yaml is the
+  # whole enforcement, and values.schema.json cannot help here (README,
+  # guideline 12).
   #
   # Documented limit (chart 3.0.0): changing this path rolls the pod (the
   # StatefulSet hashes the rendered OnePasswordItem into checksum/secret-ref),