Update github actions package.json for reported vulnerabilities

[bobbrow]

update axios and cross-spawn

[sean-mcmanus]

Shouldn't you update the

"resolutions": {
    "minimatch": "^3.0.5"
  }

?

I'm not sure if there are any issues with these updates without updating the resolutions.

[bobbrow]

Shouldn't you update the

"resolutions": {
    "minimatch": "^3.0.5"
  }

?

I'm not sure if there are any issues with these updates without updating the resolutions.

I fixed axios manually and cross-spawn was done with npm audit fix. If you think I should update something else, I can do that too.

[sean-mcmanus]

I fixed axios manually and cross-spawn was done with npm audit fix. If you think I should update something else, I can do that too.

I'm not sure, because I can't seem to run npm audit.

Unable to authenticate, need: Basic realm="https://pkgsprodwus21.pkgs.visualstudio.com/"

When I get rid of the .npmrc I get different npm audit warnings unrelated to cross-spawn/axios.

[lukka]

@bobbrow was DependaBot ever considered? It would create PR automatically to fix vulnerabilities in package.json.

[bobbrow]

@bobbrow was DependaBot ever considered? It would create PR automatically to fix vulnerabilities in package.json.

dependabot is supposed to be running already. We get PR's from it sometimes. I don't know what its schedule is relative to the scans that run and open bugs in Azure Dev Ops though.