Versions of cross-span before 7.0.5 are vulnerable. See: https://www.cve.org/CVERecord?id=CVE-2024-21538 Can you update the dependency?