Bump version to 2.40.0

Author: jeremyevans

CHANGELOG

@@ -1,4 +1,4 @@
-=== master
+=== 2.40.0 (2025-08-22)
 
 * Use HTTP header instead of meta tag for otp unlock not yet available page (jeremyevans)
 

doc/release_notes/2.40.0.txt

@@ -0,0 +1,15 @@
+= New Features
+
+* A reset_password_request_for_unverified_account configuration method
+  is now available. This allows you to configure the behavior if an
+  unverified account requests a password reset. If the method is not
+  used, the default behavior remains to show an error for the login
+  parameter.
+
+= Other Improvements
+
+* In the otp_unlock feature, instead of using a meta refresh tag in
+  the HTML, a refresh HTTP header is used. This should fix the page
+  not automatically refreshing in some browsers. You can customize
+  this behavior by using the
+  otp_unlock_not_available_set_refresh_header configuration method.

lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 39
+  MINOR = 40
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.