[DPEDE-1784](deps): Bump systeminformation from 5.31.5 to 5.31.17

[dependabot]

Bumps systeminformation from 5.31.5 to 5.31.17.

Release notes

Sourced from systeminformation's releases.

v5.31.17

Full Changelog: sebhildebrandt/systeminformation@v5.31.16...v5.31.17

v5.31.16

Full Changelog: sebhildebrandt/systeminformation@v5.31.15...v5.31.16

v5.31.15

Full Changelog: sebhildebrandt/systeminformation@v5.31.14...v5.31.15

v5.31.14

Full Changelog: sebhildebrandt/systeminformation@v5.31.13...v5.31.14

v5.31.13

Full Changelog: sebhildebrandt/systeminformation@v5.31.12...v5.31.13

v5.31.12

Full Changelog: sebhildebrandt/systeminformation@v5.31.11...v5.31.12

v5.31.11

Full Changelog: sebhildebrandt/systeminformation@v5.31.10...v5.31.11

v5.31.10

Full Changelog: sebhildebrandt/systeminformation@v5.31.9...v5.31.10

v5.31.9

Full Changelog: sebhildebrandt/systeminformation@v5.31.8...v5.31.9

v5.31.8

Full Changelog: sebhildebrandt/systeminformation@v5.31.7...v5.31.8

v5.31.7

Full Changelog: sebhildebrandt/systeminformation@v5.31.6...v5.31.7

v5.31.6

Full Changelog: sebhildebrandt/systeminformation@v5.31.5...v5.31.6

Changelog

Sourced from systeminformation's changelog.

Changelog

Major Changes - Version 5

New Functions

• audio() detailed audio information
• bluetoothDevices() detailed information detected bluetooth devices
• dockerImages() detailed information docker images
• dockerVolumes() detailed information docker volumes
• printers() detailed printer information
• usb() detailed USB information
• wifiInterfaces() detected Wi-Fi interfaces
• wifiConnections() active Wi-Fi connections

Breaking Changes

Be aware, that the new version 5.x is NOT fully backward compatible to version 4.x ...

We had to make several interface changes to keep systeminformation as consistent as possible. We highly recommend to go through the complete list and adapt your own code to be again compatible to the new version 5.

Function	Old	New (V5)	Comments
unsupported values	-1	null	values which are unknown orunsupported on platform
battery()	hasbatterycyclecountischargingdesignedcapacitymaxcapacityacconnectedtimeremaining	hasBatterycycleCountisChargingdesignedCapacitymaxCapacityacConnectedtimeRemaining	pascalCase conformity
blockDevices()	fstype	fsType	pascalCase conformity
cpu()	speedminspeedmax	speedMinspeedMax	pascalCase conformity
cpu().speedcpu().speedMincpu().speedMax	string values	now returningnumerical values	better value handling
cpuCurrentspeed()		cpuCurrentSpeed()	function name changedpascalCase conformity
currentLoad()	avgloadcurrentloadcurrentload_usercurrentload_systemcurrentload_nicecurrentload_idlecurrentload_irqraw_currentload	avgLoadcurrentLoadcurrentLoadUsercurrentLoadSystemcurrentLoadNicecurrentLoadIdlecurrentLoadIrqrawCurrentLoad	pascalCase conformity
dockerContainerStats()	mem_usagemem_limitmem_percentcpu_percentcpu_statsprecpu_statsmemory_stats	memUsagememLimitmemPercentcpuPercentcpuStatsprecpuStatsmemoryStats	pascalCase conformity
dockerContainerProcesses()	pid_host	pidHost	pascalCase conformity
graphics().display	pixeldepthresolutionxresolutionysizexsizey	pixelDepthresolutionXresolutionYsizeXsizeY	pascalCase conformity
networkConnections()	localaddresslocalportpeeraddresspeerport	localAddresslocalPortpeerAddresspeerPort	pascalCase conformity
networkInterfaces()	carrier_changes	carrierChanges	pascalCase conformity
processes()	mem_vszmem_rsspcpupcpuupcpuspmem	memVszmemRsscpucpuucpusmem	pascalCase conformityrenamed attributes
processLoad()	result as object	result as array of objects	function now allows to provide more thanone process (as a comma separated list)
services()	pcpupmem	cpumem	renamed attributes
vbox()	HPETPAEAPICX2APICACPIIOAPICbiosAPICmodeTRC	hpetpaeapicx2ApicacpiioApicbiosApicModertc	pascalCase conformity

Other Improvements and Changes

• baseboard(): added memMax, memSlots
• bios(): added language and features (linux)
• blockDevices() added raid group member (linux)
• cpu(): extended AMD processor list

... (truncated)

Commits

• 9e79988 5.31.17
• c697de0 fsSize() fixed parsing - spaces (linux)
• ee6b544 getNvidiaSmi() System32 fastpath (windows), wifiConnections() query by UUID (...
• 8ff6471 fsSize() fixed parsing (linux)
• f5b9315 5.31.16
• 0e4bf2e getLoad(), getFullLoad() adapted (windows)
• b702b03 getLoad(), getFullLoad() adapted (windows)
• 85af093 5.31.15
• 6f799d3 code refacroting, hardening
• 2ad8065 smaller lib hardening changes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[lumn-sonarent]

SonarQube Quality Gate

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[lumen-jenkins-prod]

The CI pipeline has run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2116/1/. ✅

[lumen-jenkins-prod]

You can check this PRs instance in https://nginx-pr-2116-ux-chi.rke-odc-test.corp.intranet (internal)

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Routine patch of an unused package that fixes two high-severity OS command injection advisories; dependency and security axes are clear, but critical CI confidence is low (61.5% pass rate on master) — a human must confirm the failures are pre-existing before merging.

TL;DR

• Merge: 🔍 review, then merge — verify the failing critical checks on master are pre-existing and unrelated to this bump (the systeminformation-specific CI run for this PR succeeded), then merge.
• Breaks your code? ✅ Most likely not — systeminformation is not imported anywhere in your source.
• Security? ✅ this bump fixes GHSA-5xpp-75jx-m839 and GHSA-hvx9-hwr7-wjj9
• Update: systeminformation — you have 5.31.5, this PR installs 5.31.17 (patch, spans 12 releases). Fixes 2 high-severity OS command injection advisories; no code impact.

Signal	Value	Interpretation
Bump type	patch	Twelve consecutive patch releases within the 5.31.x series; semver patch scope means bug/security fixes only — no API changes expected.
Dependency risk	low	Patch bump; the changelog for 5.31.6–5.31.17 contains only "Full Changelog" links with no documented breaking changes. systeminformation is not imported in this repo's source, so blast radius is zero regardless.
Security risk	low	No advisories affect 5.31.17. This bump fixes two high-severity OS command injection advisories (GHSA-5xpp-75jx-m839 and GHSA-hvx9-hwr7-wjj9, highest CVSS 7.8). See Security advisories section.
CI health risk	high	26 critical runs on master; pass rate 61.5% (threshold for medium is ≥70%), flakiness 0% → ci_confidence: low. Failures are concentrated in multi-package Dependabot PRs (e.g. the @babel/preset-env group, js-yaml updates); the Push on master workflow ran 8/8 clean. The systeminformation-specific run (Update #1462639330) passed. Informational excluded: none identified.
API usage in repo	false	Zero import sites found across all forms searched (from 'systeminformation', require('systeminformation'), import('systeminformation'), export … from 'systeminformation'). Confirmed absent from source — not a blank index.
Cross-repo signal	standalone	No publishable root manifest was found in the repo root.
Data completeness	complete	All 5 signals obtained: classification, API usage, release notes, CI health, cascade scan.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low (pass rate 61.5% on 26 runs, below the 70% medium threshold).

Escalation category: ci-health (the dependency and security dimensions are both low; the sole escalation driver is failing CI checks on master).

Confidence breakdown — score: 0.85.

• ✅ Patch bump: no breaking API changes expected in the 5.31.x series

• ✅ No in-repo usage (api_usage_found: false): zero blast radius regardless of internal changes

• ✅ No active CVEs: advisory_ids is empty; 5.31.17 is outside every advisory's affected range

• ✅ No cascade conflicts: no other open Dependabot PRs bump systeminformation

• ✅ All 5 signals obtained: complete picture

• ⚠️ Critical CI confidence is low (pass rate 61.5% < 70%): −0.15

• 💡 To reach a lower route: Fix the failing critical checks on master so CI confidence rises to medium or high. The failures appear pre-existing (multiple unrelated Dependabot PRs also fail); fixing those will unblock auto-eligible routing for future patches. Note that fixing informational workflows will NOT change the route — only critical checks (test, build, lint, typecheck) count toward CI confidence.

What AiFEL checked

1. Triage — classified patch (systeminformation 5.31.5→5.31.17).
2. Symbol extraction — none found (0 import sites, 0 files matched across all npm import forms).
3. Release-notes comparator — 12 patch releases (5.31.6–5.31.17); changelog entries contain only "Full Changelog" GitHub compare links with no documented breaking changes or API modifications.
4. CI health — 26 critical runs: pass 61.5%, flaky 0% → confidence low; informational excluded: none.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. systeminformation is not imported anywhere in this repo's source, so there is no blast radius regardless of what changed internally across the 12 patch releases.

Security advisories

✅ Nothing still affects 5.31.17

✅ Resolved by this bump (2): GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9 — no action needed (highest was CVSS 7.8).

✅ This bump resolves both known advisories that affected 5.31.5 and none affect 5.31.17 — clear on the security axis.

Advisory details (fixed by this bump)

GHSA-hvx9-hwr7-wjj9 (CVE-2026-44724) — CVSS 7.8 (high): Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name; affects ≥4.17.0, ≤5.31.5; first patched 5.31.6. Fixed by this bump — merge is the fix.

GHSA-5xpp-75jx-m839 (CVE-2026-50289) — CVSS not scored, severity high: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux; affects ≤5.31.6; first patched 5.31.7. Fixed by this bump — merge is the fix.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	systeminformation	5.31.5	5.31.17	routine patch — fixes GHSA-5xpp-75jx-m839 and GHSA-hvx9-hwr7-wjj9 (OS command injection, high severity); no code impact

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.85,
  "packages": [{"ecosystem": "npm", "name": "systeminformation", "old_version": "5.31.5", "new_version": "5.31.17"}],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Routine patch bump (5.31.5→5.31.17) of an unused package that fixes two high-severity OS command injection advisories; dependency and security risk are low, but critical CI confidence is low (61.5% pass rate) — escalated on ci-health.",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2116",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience