update qs dependency to 2.3.1

Pulled out of #1189, changelog reviewed and confirmed that we're okay to upgrade