From 450be48006a566ab2c7317ff82808ea44ed7f141 Mon Sep 17 00:00:00 2001
From: Bilal Atique <bilalbinatique@gmail.com>
Date: Fri, 6 Nov 2026 18:36:13 +0500
Subject: [PATCH] fix(api): update systeminformation to 5.33.19

The root resolutions pin was ^5.24.0, so yarn.lock kept
systeminformation 5.30.7. npm audit reports seven advisories for that
version, five of them high. Two are command injections in
networkInterfaces() on Linux: GHSA-5xpp-75jx-m839 (fixed in 5.31.7) and
GHSA-hvx9-hwr7-wjj9 (fixed in 5.31.6). The API installs the package
through @opentelemetry/host-metrics, so it ships in the API image.

Raise the pin to ^5.33.19, the newest 5.x release. Only the
systeminformation entry in yarn.lock changes.
---
 .changeset/systeminformation-command-injection.md | 11 +++++++++++
 package.json                                      |  2 +-
 yarn.lock                                         |  8 ++++----
 3 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/systeminformation-command-injection.md

diff --git a/.changeset/systeminformation-command-injection.md b/.changeset/systeminformation-command-injection.md
new file mode 100644
index 0000000000..128eb622b0
--- /dev/null
+++ b/.changeset/systeminformation-command-injection.md
@@ -0,0 +1,11 @@
+---
+'@hyperdx/api': patch
+---
+
+fix: update systeminformation to 5.33.19
+
+The root `resolutions` pin let the lockfile keep systeminformation 5.30.7, which
+has known command injection advisories, including two high-severity ones in
+`networkInterfaces()` on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The
+API installs it through `@opentelemetry/host-metrics`. The pin now starts at
+5.33.19, the newest 5.x release, which fixes all of them.
diff --git a/package.json b/package.json
index 6659ab07d9..cdcdf52b50 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,7 @@
     "diff": "^5.2.2",
     "on-headers": "^1.1.0",
     "fast-xml-parser": "^4.5.6",
-    "systeminformation": "^5.24.0",
+    "systeminformation": "^5.33.19",
     "@asyncapi/specs": "6.11.1"
   },
   "resolutionsNotes": {
diff --git a/yarn.lock b/yarn.lock
index ef8daba12c..39ef209655 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -29898,12 +29898,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"systeminformation@npm:^5.24.0":
-  version: 5.30.7
-  resolution: "systeminformation@npm:5.30.7"
+"systeminformation@npm:^5.33.19":
+  version: 5.33.19
+  resolution: "systeminformation@npm:5.33.19"
   bin:
     systeminformation: lib/cli.js
-  checksum: 10c0/62588fabe62ec258d56055e609a075fe1eb1da2f090adc8c53e025ad8947d6eb9d3d2889646973fafba9528e06958decbb1def2b989af0363a952c5aff65fbae
+  checksum: 10c0/cb95464c1ab9b5deabd0141d0ae22db29ced520f321c2b5cbcdea84eff5d0cf65fbb521a9945f8dc98e560bc9fc57cbe06e68dd2d34c53a4c3a59eb61d0535b3
   conditions: (os=darwin | os=linux | os=win32 | os=freebsd | os=openbsd | os=netbsd | os=sunos | os=android)
   languageName: node
   linkType: hard