updated npm packages (qs had a security issue)