Upgrade request, includes a security patch for `qs`