bump qs to remove that insecurrrr warning