chore: eliminate direct cross-spawn dependency (#28570)

## **Description**

We recently updated `cross-spawn` to solve a yarn audit, but actually we
can do one better. This eliminates the direct dependency on
`cross-spawn`. It runs on Windows by adding one `shell: true`.

We still have some indirect dependencies on `cross-spawn`, so we still
need that resolution.

@Gudahtt because he last updated `cross-spawn`
@davidmurdoch because he's also a Windows user

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/28368?quickstart=1)

## **Related issues**

Followup to #28522

<!--## **Manual testing steps**
## **Screenshots/Recordings**
### **Before**
### **After**
## **Pre-merge author checklist**
## **Pre-merge reviewer checklist**-->

attribution.txt

@@ -5044,33 +5044,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
-******************************
-
-cross-spawn
-7.0.3 <https://github.com/moxystudio/node-cross-spawn>
-The MIT License (MIT)
-
-Copyright (c) 2018 Made With MOXY Lda <[email protected]>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-
 ******************************
 
 crypto

development/build/task.js

@@ -1,5 +1,5 @@
 const EventEmitter = require('events');
-const spawn = require('cross-spawn');
+const { spawn } = require('node:child_process');
 
 const tasks = {};
 const taskEvents = new EventEmitter();
@@ -84,6 +84,7 @@ function runInChildProcess(
       ],
       {
         env: process.env,
+        shell: true,
       },
     );
 

development/lib/run-command.js

@@ -1,5 +1,5 @@
 const fs = require('fs');
-const spawn = require('cross-spawn');
+const { spawn } = require('node:child_process');
 
 /**
  * Run a command to completion using the system shell.

lavamoat/build-system/policy.json

@@ -2110,56 +2110,6 @@
         "chokidar>anymatch>picomatch": true
       }
     },
-    "cross-spawn": {
-      "builtin": {
-        "child_process.spawn": true,
-        "child_process.spawnSync": true,
-        "fs.closeSync": true,
-        "fs.openSync": true,
-        "fs.readSync": true,
-        "path.delimiter": true,
-        "path.normalize": true,
-        "path.resolve": true
-      },
-      "globals": {
-        "Buffer.alloc": true,
-        "process.chdir": true,
-        "process.cwd": true,
-        "process.env": true,
-        "process.platform": true
-      },
-      "packages": {
-        "cross-spawn>path-key": true,
-        "cross-spawn>shebang-command": true,
-        "cross-spawn>which": true
-      }
-    },
-    "cross-spawn>path-key": {
-      "globals": {
-        "process.env": true,
-        "process.platform": true
-      }
-    },
-    "cross-spawn>shebang-command": {
-      "packages": {
-        "cross-spawn>shebang-command>shebang-regex": true
-      }
-    },
-    "cross-spawn>which": {
-      "builtin": {
-        "path.join": true
-      },
-      "globals": {
-        "process.cwd": true,
-        "process.env.OSTYPE": true,
-        "process.env.PATH": true,
-        "process.env.PATHEXT": true,
-        "process.platform": true
-      },
-      "packages": {
-        "@sentry/cli>which>isexe": true
-      }
-    },
     "debounce-stream>duplexer": {
       "builtin": {
         "stream": true

package.json

@@ -250,7 +250,7 @@
     "@ledgerhq/hw-app-eth/axios": "^0.28.0",
     "@ledgerhq/hw-app-eth@npm:^6.39.0": "patch:@ledgerhq/hw-app-eth@npm%3A6.39.0#~/.yarn/patches/@ledgerhq-hw-app-eth-npm-6.39.0-866309bbbe.patch",
     "@ledgerhq/evm-tools@npm:^1.2.3": "patch:@ledgerhq/evm-tools@npm%3A1.2.3#~/.yarn/patches/@ledgerhq-evm-tools-npm-1.2.3-414f44baa9.patch",
-    "cross-spawn@npm:^5.0.1": "^7.0.5",
+    "cross-spawn@npm:^5.0.1": "^7.0.6",
     "@solana/web3.js@npm:^1.95.0": "^1.95.8"
   },
   "dependencies": {
@@ -556,7 +556,6 @@
     "concurrently": "^8.2.2",
     "copy-webpack-plugin": "^12.0.2",
     "core-js-pure": "^3.38.0",
-    "cross-spawn": "^7.0.5",
     "crypto-browserify": "^3.12.0",
     "css-loader": "^6.10.0",
     "css-to-xpath": "^0.1.0",

yarn.lock

@@ -15822,7 +15822,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.5":
+"cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.6":
   version: 7.0.6
   resolution: "cross-spawn@npm:7.0.6"
   dependencies:
@@ -26569,7 +26569,6 @@ __metadata:
     copy-to-clipboard: "npm:^3.3.3"
     copy-webpack-plugin: "npm:^12.0.2"
     core-js-pure: "npm:^3.38.0"
-    cross-spawn: "npm:^7.0.5"
     crypto-browserify: "npm:^3.12.0"
     css-loader: "npm:^6.10.0"
     css-to-xpath: "npm:^0.1.0"