cross-spawn is pulled in through the webpack-cli package, which is a dev dependency of pydata-sphinx-theme, so the package isn't affected.