Update request to 2.40.x

Versions < 2.40.0 of `request` contain a vulnerable `qs` dependency, see mikeal/request#992