[ThoSap]

Why

Quarkus 3.40.1.2 (LTS) fixes three security advisories: two in its dependencies and one in quarkus-vertx-http.

What changed

The operator builds on Quarkus 3.40.1.2. On the runtime classpath, this moves:

• Brotli4j from 1.23.0 to 1.24.0: GHSA-x524-jrqf-vwq6, critical.
• jackson-databind from 2.21.7 to 2.21.8: GHSA-m8xf-2cr7-77ph, critical.
• The path matcher of the management interface gets a fix: GHSA-4547-585x-4r9w, high.

Review notes

• The operator's current configuration does not expose it to these advisories. It has no HTTP decompression, no class-name polymorphism in Jackson, and no separate management interface. The update removes the vulnerable versions from the image, so scanners stop reporting them.
• GHSA-4547-585x-4r9w does not name a fixed version. The release commit "Update ImmutablePathMatcher to have the root path always end with forward slash" is the fix.
• The Operator SDK BOM 3.40.1.2 is the same as 3.40.1.1 except for its version, so quarkus-helm stays at 1.4.1.

Test scope

• CI runs the tests and the Helm install test.

Risk: needs a human review, assessed at 66c9e3b

• No self-review exists for this branch. The repository does not run the freshness Action, so a risk:low label would not be removed after a later push.