Update dependencies

This fixes a vuln in qs <1.x (depended on by express). I updated
everything else at the same time because why not.