# PocketBase v0.40.6 — Release & Upgrade Intelligence
- **Product:** PocketBase (https://pocketbase.io)
- **Version:** v0.40.6
- **Released:** Oct 23, 2026
- **Impact Score:** 6/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/pocketbase/updates/v0.40.6/

## Executive Summary (TL;DR)
PocketBase version v0.40.6 introduces critical security updates, memory usage protections for thumbnail generation, and shifts future update distribution away from GitHub. Developers should update promptly to mitigate Go security vulnerabilities and benefit from dependency upgrades.

## New Features
- Added a global restriction for the max WxH pixels size when generating a thumb, configurable via PB_THUMBS_MAX_SOURCE_PIXELS

## Improvements
- Replaced the GitHub update command with an update from a new host (ganigeorgiev.com)
- Additional fileblob bucket escape checks for standalone filesystem abstraction usage
- Bumped `golang.org/x/` dependencies and Go GitHub action version to 1.27.3
- Bumped goja and its related dependencies for string allocation optimization and correctness fixes
- Minor UI fixes including superuser IPs description grammar, button loader icon alignment, and dark background corrections