upgrade packages to handle qs vunerability

Waiting for winston upgrade