updated dependencies, because qs is listed on nodesecurity

problem is, that broadway 0.2.x has a dependency to qs 0.5.6. And qs 0.5.6 is listed on https://nodesecurity.io/advisories with "qs Denial-of-Service Memory Exhaustion" and "qs Denial-of-Service Extended Event Loop Blocking".