bump request to 2.40.0 to avoid a qs based security vulnerability