[DPEDE-1784](deps): Bump systeminformation from 5.31.5 to 5.31.6

[dependabot]

Bumps systeminformation from 5.31.5 to 5.31.6.

Release notes

Sourced from systeminformation's releases.

v5.31.6

Full Changelog: sebhildebrandt/systeminformation@v5.31.5...v5.31.6

Changelog

Sourced from systeminformation's changelog.

Changelog

Major Changes - Version 5

New Functions

• audio() detailed audio information
• bluetoothDevices() detailed information detected bluetooth devices
• dockerImages() detailed information docker images
• dockerVolumes() detailed information docker volumes
• printers() detailed printer information
• usb() detailed USB information
• wifiInterfaces() detected Wi-Fi interfaces
• wifiConnections() active Wi-Fi connections

Breaking Changes

Be aware, that the new version 5.x is NOT fully backward compatible to version 4.x ...

We had to make several interface changes to keep systeminformation as consistent as possible. We highly recommend to go through the complete list and adapt your own code to be again compatible to the new version 5.

Function	Old	New (V5)	Comments
unsupported values	-1	null	values which are unknown orunsupported on platform
battery()	hasbatterycyclecountischargingdesignedcapacitymaxcapacityacconnectedtimeremaining	hasBatterycycleCountisChargingdesignedCapacitymaxCapacityacConnectedtimeRemaining	pascalCase conformity
blockDevices()	fstype	fsType	pascalCase conformity
cpu()	speedminspeedmax	speedMinspeedMax	pascalCase conformity
cpu().speedcpu().speedMincpu().speedMax	string values	now returningnumerical values	better value handling
cpuCurrentspeed()		cpuCurrentSpeed()	function name changedpascalCase conformity
currentLoad()	avgloadcurrentloadcurrentload_usercurrentload_systemcurrentload_nicecurrentload_idlecurrentload_irqraw_currentload	avgLoadcurrentLoadcurrentLoadUsercurrentLoadSystemcurrentLoadNicecurrentLoadIdlecurrentLoadIrqrawCurrentLoad	pascalCase conformity
dockerContainerStats()	mem_usagemem_limitmem_percentcpu_percentcpu_statsprecpu_statsmemory_stats	memUsagememLimitmemPercentcpuPercentcpuStatsprecpuStatsmemoryStats	pascalCase conformity
dockerContainerProcesses()	pid_host	pidHost	pascalCase conformity
graphics().display	pixeldepthresolutionxresolutionysizexsizey	pixelDepthresolutionXresolutionYsizeXsizeY	pascalCase conformity
networkConnections()	localaddresslocalportpeeraddresspeerport	localAddresslocalPortpeerAddresspeerPort	pascalCase conformity
networkInterfaces()	carrier_changes	carrierChanges	pascalCase conformity
processes()	mem_vszmem_rsspcpupcpuupcpuspmem	memVszmemRsscpucpuucpusmem	pascalCase conformityrenamed attributes
processLoad()	result as object	result as array of objects	function now allows to provide more thanone process (as a comma separated list)
services()	pcpupmem	cpumem	renamed attributes
vbox()	HPETPAEAPICX2APICACPIIOAPICbiosAPICmodeTRC	hpetpaeapicx2ApicacpiioApicbiosApicModertc	pascalCase conformity

Other Improvements and Changes

• baseboard(): added memMax, memSlots
• bios(): added language and features (linux)
• blockDevices() added raid group member (linux)
• cpu(): extended AMD processor list

... (truncated)

Commits

• da1cbf5 5.31.6
• 87dbb60 fix: smaller issues
• 1d1bddf fix: smaller issues
• f69576f fix: networkInterfaces() ci wip
• 78624d1 fix: networkInterfaces() ci
• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2049/1/. ❌

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2049/2/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Patch bump of systeminformation 5.31.5→5.31.6 fixes a known high-severity advisory and carries no in-repo impact; escalated solely because the repo's critical CI pass rate (64.3%) falls below the auto-merge threshold.

TL;DR

• Merge: 🔍 review, then merge — the dependency and security axes are clear; confirm critical CI is passing on this branch before merging (the failing checks are pre-existing repo instability, not caused by this PR).
• Breaks your code? ✅ Most likely not — systeminformation is not imported anywhere in this repo.
• Security? ✅ this bump fixes GHSA-hvx9-hwr7-wjj9 (CVSS 7.8) — no advisories affect 5.31.6.
• Update: systeminformation — you have 5.31.5, this PR installs 5.31.6 (patch, 1 release). Routine security patch: closes a Linux command-injection advisory, no code changes required.

Signal	Value	Interpretation
Bump type	patch	z-component only (5.31.5→5.31.6); semver-compatible security/bug fix; no breaking changes expected or documented.
Dependency risk	low	Patch bump with zero in-repo usage (0 import sites detected by node-scan) and no breaking changes in the changelog range. Safe to merge from a dependency standpoint.
Security risk	low	No advisories affect 5.31.6. This bump fixes GHSA-hvx9-hwr7-wjj9 (CVE-2026-44724, CVSS 7.8 — Linux command injection via networkInterfaces()). All 12 other historical advisories for this package were already patched by intermediate versions prior to 5.31.5.
CI health risk	high	28 critical runs observed on the default branch; pass rate 64.3% (18/28 succeeded), flakiness 0% → ci_confidence: low. Multiple Dependabot-update and push workflows are failing. This is pre-existing repo instability unrelated to this bump.
API usage in repo	false	Node-scan searched all import forms of systeminformation (ESM import, require, dynamic import(), re-export) across the repo — 0 hits in 0 files. Package is not used in source.
Cross-repo signal	standalone	No publishable root manifest found in the repo root.
Data completeness	complete	All 5 signals obtained: classification, api_usage, release_notes, ci_health, cascade.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI pass rate is 64.3% (below the 70% threshold), triggering the CI low → escalate rule.

Escalation category: ci-health

Confidence breakdown — score: 0.75.

• ✅ Patch bump — semver-compatible; no breaking changes documented.

• ✅ No in-repo usage of systeminformation — blast radius is zero.

• ✅ No advisories affect 5.31.6; this bump fixes one CVSS 7.8 advisory.

• ✅ Zero cascade conflicts.

• ⚠️ Critical CI confidence is low (pass_rate 0.643 < 0.70, 28 critical runs) — −0.15.

• ⚠️ Sparse release notes for 5.31.5→5.31.6 (changelog contains only a "Full Changelog" comparison link, no detail) — −0.10.

• 💡 To reach a lower route: Bring the repo's critical CI pass rate above 70% on master (fix the pre-existing failing workflows). This PR itself has no dependency or security concerns — the escalation is entirely due to the repo's CI health baseline, not this bump. Fixing an informational workflow will NOT change the route; only critical-check pass rate matters.

What AiFEL checked

1. Triage — classified patch (systeminformation 5.31.5→5.31.6).
2. Symbol extraction — 0 import sites across 0 files (node-scan; confirmed not imported in source).
3. Release-notes comparator — changelog for 5.31.5→5.31.6 is sparse (only a "Full Changelog" GitHub comparison link); no breaking changes documented.
4. CI health — 28 critical runs: pass 64.3%, flaky 0% → confidence low; informational excluded: none.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. systeminformation is not imported anywhere in this repository (0 usage sites detected by node-scan), so no call sites exist that could be affected by this bump.

Security advisories

✅ Nothing still affects 5.31.6

✅ Resolved by this bump (1): GHSA-hvx9-hwr7-wjj9 (CVE-2026-44724 — Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name) — no action needed (CVSS 7.8, high).

All 12 remaining historical advisories for systeminformation (CVEs ranging from 2020–2026) were already patched by intermediate versions prior to 5.31.5; none affect 5.31.6.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	systeminformation	5.31.5	5.31.6	Routine security patch — fixes GHSA-hvx9-hwr7-wjj9 (CVSS 7.8); no code impact

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.75,
  "packages": [
    {
      "ecosystem": "npm",
      "name": "systeminformation",
      "old_version": "5.31.5",
      "new_version": "5.31.6"
    }
  ],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Patch bump of systeminformation 5.31.5→5.31.6; fixes GHSA-hvx9-hwr7-wjj9 (CVSS 7.8 Linux command injection); no in-repo usage (0 sites); escalated on ci-health (critical pass_rate 64.3%, below 70% threshold).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2049",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience

[dependabot]

Superseded by #2116.

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources