bump FTW dependency to 0.0.40

FTW is used in many plugins, and had a file descriptor leak that was closed in 0.0.40