Migration to 1.40+

Rolling back to the previous MACMA version (1.39.x) is possible, as long as certain Keycloak features are not used (workflows and organizations). Both are neither used by MACMA nor recommended and require manual set-up in Keycloak’s administrative user interface.
Non-UTF-8 database character encoding deprecated; future versions may refuse to start with a non-UTF-8 database.
Bosch Oracle standard is

NLS_CHARACTERSET: [AL32UTF8] NLS_NCHAR_CHARACTERSET: [AL16UTF16]

and as such safe to use if your DB matches these standards.
Configuration 'KEYCLOAK_HA_CACHE_STACK=kubernetes' is now deprecated and defaults to jdbc-ping in future, search for custom configuration and change manual overrides to ' jdbc-ping'
Valid redirect URIs for clients do not accept wildcards for hostname anymore

The wildcard comparison for valid redirect URIs does not affect the hostname anymore. Previously patterns like https://example.com* were accepted and lead to allow unintended domains like https://example.com.other.domain.com. Since this release, the hostname does not accept such type of wildcard and those patterns will be managed as if the wildcard is after the hostname https://example.com/. The full wildcard for the hostname https:// is still accepted because its interpretation cannot be misunderstood.

Note that OAuth 2.0 recommends exact string matching in the Security Best Current Practice and draft for OAuth 2.1 enforces it. Keycloak recommends to not use any wildcard valid redirect URI for clients. See Unspecific redirect URIs in the Server Administration Guide for more information.