Update cross-fetch

cross-fetch@1.1.1 uses a node-fetch version with vulnerability. Would be good to check whether we can upgrade to latest version for cross-fetch.