Upgrade `qs` to protect against security vunerability

https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking
Use a pinned version for external dep qs