diff --git a/_service b/_service
index c59472a..64eabf1 100644
--- a/_service
+++ b/_service
@@ -3,7 +3,7 @@
     <param name="url">https://github.com/anchore/grype</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="revision">v0.38.0</param>
+    <param name="revision">v0.40.0</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>
     <param name="versionrewrite-pattern">v(.*)</param>
@@ -17,6 +17,6 @@
     <param name="compression">gz</param>
   </service>
   <service name="go_modules" mode="disabled">
-    <param name="archive">grype-0.38.0.tar.gz</param>
+    <param name="archive">grype-0.40.0.tar.gz</param>
   </service>
 </services>
diff --git a/_servicedata b/_servicedata
index 222074e..d3958cf 100644
--- a/_servicedata
+++ b/_servicedata
@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/anchore/grype</param>
-              <param name="changesrevision">06d28dad9f7e7d9aa65fc16d45c6ce785826664c</param></service></servicedata>
\ No newline at end of file
+              <param name="changesrevision">0703bae9778e661e2cc21d5caa816cda30472b14</param></service></servicedata>
\ No newline at end of file
diff --git a/grype-0.38.0.tar.gz b/grype-0.38.0.tar.gz
deleted file mode 100644
index ab972ba..0000000
--- a/grype-0.38.0.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:c8878268176a28745830f5d022ceafec521d40d45e0c253fbc7f3558c433403d
-size 1045026
diff --git a/grype-0.40.0.tar.gz b/grype-0.40.0.tar.gz
new file mode 100644
index 0000000..a048fcc
--- /dev/null
+++ b/grype-0.40.0.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e252c8fe06fe54cfa95c695528787c4f08c1c6ea978936c1be0f3c2e368ccc43
+size 1048099
diff --git a/grype.changes b/grype.changes
index eb31b6b..1e762c7 100644
--- a/grype.changes
+++ b/grype.changes
@@ -1,3 +1,29 @@
+-------------------------------------------------------------------
+Wed Jun 22 08:33:50 UTC 2022 - kastl@b1-systems.de
+
+- Update to version 0.40.0:
+  * update grype to latest syft patch v0.48.1 (#790)
+  * fix: add golang to documentation (#788)
+  * fix: accept templates with custom functions (#786)
+  * add db staleness check (#785)
+  * feat: add compose workflow for local dev (#783)
+  * ignore gemfile rich version for semVer comparison (#776)
+  * Support namespace and language as additional criteria for ignoring vulnerability matches (#780)
+
+-------------------------------------------------------------------
+Wed Jun 22 08:19:33 UTC 2022 - kastl@b1-systems.de
+
+- Update to version 0.39.0:
+  * update syft version to v0.47.0 (#781)
+  * use anchore fork of glebarez/sqlite (#778)
+  * template: Check sanity for template file (#674)
+  * Add announcement for Anchore OSS Meetup (#775)
+  * Bump github.com/hashicorp/go-getter from 1.5.11 to 1.6.1 (#770)
+  * publish release to reduce user friction (#766)
+  * Update Syft to v0.46.3 (#761)
+  * Add reference to logrus logging levels (#758)
+  * README: add MacPorts install info (#759)
+
 -------------------------------------------------------------------
 Mon Jun  6 19:46:12 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>
 
diff --git a/grype.spec b/grype.spec
index 3c9d52a..1d71787 100644
--- a/grype.spec
+++ b/grype.spec
@@ -19,7 +19,7 @@
 %define __arch_install_post export NO_BRP_STRIP_DEBUG=true
 
 Name:           grype
-Version:        0.38.0
+Version:        0.40.0
 Release:        0
 Summary:        A vulnerability scanner for container images and filesystems
 License:        Apache-2.0
diff --git a/vendor.tar.gz b/vendor.tar.gz
index 2e78cbd..b5b99ee 100644
--- a/vendor.tar.gz
+++ b/vendor.tar.gz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:edafbf6bcaee52faf420c961038c930dd6c0eed34870f6ae0f707795c22457f2
-size 44975197
+oid sha256:acdc079911d59bc081949a972108bef6877b47787df5072fdf359f20eeea6740
+size 50906507