Update rollout-operator in helm/jsonnet to v0.40.0

[lamida]

Updates rollout-operator to v0.40.0 in both Helm and Jsonnet, following the shape of #16440.

Jsonnet

• operations/mimir/jsonnetfile.json: v0.39.0 → v0.40.0
• operations/mimir/jsonnetfile.lock.json: pins 946f0864 (the v0.40.0 tag)
• 50 operations/mimir-tests/* fixtures regenerated via make build-jsonnet-tests
• root CHANGELOG.md entry in the Jsonnet section

Helm

• mimir-distributed/Chart.yaml: rollout-operator dependency 0.51.1 → 0.52.0
• mimir-distributed/Chart.lock: regenerated via helm dependency update
• mimir-distributed/CHANGELOG.md + README.md dependency table
• 234 operations/helm/tests/** fixtures regenerated via make build-helm-tests

Chart 0.52.0 comes from grafana/helm-charts#4218, now merged and published to the Helm repo index, so the dependency resolves normally.

What changes in the rendered manifests

Both the Jsonnet fixtures (50 files) and the Helm fixtures (234 files) show the same substantive changes:

-        image: grafana/rollout-operator:v0.39.0
+        image: grafana/rollout-operator:v0.40.0
-        - -zpdb.pod-ready-annotation-patch-timeout=5s
-  - patch

plus, in the Helm fixtures only, the chart/appVersion labels:

-    helm.sh/chart: rollout-operator-0.51.1
+    helm.sh/chart: rollout-operator-0.52.0
-    app.kubernetes.io/version: "v0.39.0"
+    app.kubernetes.io/version: "v0.40.0"

The flag and RBAC removals come from rollout-operator#498: ZPDB cross-zone eviction delays now read the Pod Ready condition's lastTransitionTime instead of PATCHing the grafana.com/ready-time annotation. The flag is deprecated (no effect, warns when supplied) and the patch verb on pods is no longer needed. The equivalent change was made in the rollout-operator chart in #4218, so Helm and Jsonnet stay in sync.

Worth a reviewer's eye: dropping the patch verb couples these manifests to rollout-operator v0.40.0+. Anyone overriding the image back to v0.39.0 or earlier would run an operator that still tries to PATCH pods without permission.

Why now

CVE-driven: grpc v1.83.0 → v1.83.2 clears CVE-2026-84304 (HIGH, 21 days of SLO remaining), plus CVE-2026-84303 and CVE-2026-84445, on both the rollout-operator and rollout-operator-boringcrypto images. Deployed cells track the charts and jsonnet, so this PR is what actually delivers the fix. v0.40.0 also ships Go 1.26 → 1.27 (#494).

Verification

• make build-jsonnet-tests — exit 0; aggregate fixture diff contains only the lines above
• make build-helm-tests — exit 0; re-run against the published 0.52.0 chart produces no further changes to the 234 fixtures
• make doc — exit 0; only the dependency-table row changed
• helm dependency update resolves 0.52.0 from https://grafana.github.io/helm-charts; Chart.lock digest sha256:1786343b…

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e396d5f. Configure here.}

[cursor]

Helm lockfile not updated

Medium Severity

Chart.yaml pins rollout-operator to 0.52.0, but Chart.lock still records 0.51.1 with the old digest. helm dependency build and installs that honor the lockfile resolve the previous chart (image v0.39.0) instead of the CVE-fixed v0.40.0 release.

 

^{Reviewed by Cursor Bugbot for commit e396d5f. Configure here.}