Upgrade `qs` to protect against security vunerability

See https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking
I observe that most of the dependencies use `~` for the version range. Should we stay with the convention?