This is currently blocked by T216165: Drop PHP 7.0 support from MediaWiki
The latest release of the library, which is compatible with php 7.1, is currently 3.5.8.
Not blocked anymore hence resetting task status (for future reference, setting blocking tasks as subtasks is welcome :)
Declining in favour of T224667: Bump endroid/qr-code to latest php 7.2 compatible version as it's 7.2 in master/REL1_34, and REL1_33 is 7.0. Never had a release that required >= 7.1