diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index b71a9b3d5..1a98a9d3a 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,8 +1,21 @@
 Release notes
 =============
 
+
+Version v40.2.0
+-----------------
+
+- Remove unused indexes from advisory model https://github.com/aboutcode-org/vulnerablecode/pull/2434
+- Add config and job to clean up old pipeline runs https://github.com/aboutcode-org/vulnerablecode/pull/2451
+- Use X-User-Agent for Swagger API requests https://github.com/aboutcode-org/vulnerablecode/pull/2459
+- Include `datasource_id` in advisory API response https://github.com/aboutcode-org/vulnerablecode/pull/2461
+- Remove unsupported retrieve endpoint from PackageAdvisoriesViewSet https://github.com/aboutcode-org/vulnerablecode/pull/2463
+- Correctly compute next runtime for pipelines https://github.com/aboutcode-org/vulnerablecode/pull/2464
+
+
 Version v40.1.0
----------------------
+-----------------
+
 - Add support for CWE weakness curation https://github.com/aboutcode-org/vulnerablecode/pull/2380
 - Update VulnerableCode documentation for advisories https://github.com/aboutcode-org/vulnerablecode/pull/2374
 - fix: disable ALTCHA session validation by default https://github.com/aboutcode-org/vulnerablecode/pull/2385
diff --git a/setup.cfg b/setup.cfg
index 2370b2cc8..51fd18dec 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = vulnerablecode
-version = 40.1.0
+version = 40.2.0
 license = Apache-2.0 AND CC-BY-SA-4.0
 
 # description must be on ONE line https://github.com/pypa/setuptools/issues/1390
diff --git a/vulnerablecode/__init__.py b/vulnerablecode/__init__.py
index 4db6406fb..f5ee6614b 100644
--- a/vulnerablecode/__init__.py
+++ b/vulnerablecode/__init__.py
@@ -14,7 +14,7 @@
 
 import git
 
-__version__ = "40.1.0"
+__version__ = "40.2.0"
 
 
 PROJECT_DIR = Path(__file__).resolve().parent