@depup/systeminformation 5.33.6-depup.0 → 5.33.8-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/systeminformation
 
 | Field | Value |
 |-------|-------|
-| Original | [systeminformation](https://www.npmjs.com/package/systeminformation) @ 5.33.6 |
-| Processed | 2026-08-30 |
+| Original | [systeminformation](https://www.npmjs.com/package/systeminformation) @ 5.33.8 |
+| Processed | 2026-09-06 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-08-30T00:59:35.001Z",
+  "timestamp": "2026-09-06T01:00:18.743Z",
   "totalUpdated": 0
 }

package/lib/audio.js

@@ -55,7 +55,7 @@ function parseAudioType(str, input, output) {
   if (str.indexOf('mikr') >= 0) {
     result = 'Microphone';
   }
-  if (str.indexOf('phone') >= 0) {
+  if (str.indexOf('phone') >= 0 && str.indexOf('headphone') < 0) {
     result = 'Phone';
   }
   if (str.indexOf('controll') >= 0) {
@@ -111,11 +111,16 @@ function parseLinuxAudioAlsa(stdout) {
   const lines = cards.split('\n');
   lines.forEach((line, i) => {
     // ' 1 [Device         ]: USB-Audio - USB Audio Device'
-    const card = line.match(/^\s*(\d+)\s+\[(.+?)\s*\]:\s*(\S+)\s+-\s+(.*)$/);
-    if (card) {
+    const card = line.match(/^\s*(\d+)\s+\[(.+?)\s*\]:\s*(.*)$/);
+    if (card && card[3].trim()) {
       const index = card[1];
-      const driver = card[3];
-      const name = card[4].trim();
+      // some drivers (e.g. bcm2835) print an unterminated driver string, gluing the name to it
+      const sep = card[3].lastIndexOf(' - ');
+      const name = (sep >= 0 ? card[3].substring(sep + 3) : card[3]).trim();
+      let driver = (sep >= 0 ? card[3].substring(0, sep) : '').trim();
+      if (name && driver.endsWith(name)) {
+        driver = driver.substring(0, driver.length - name.length).trim();
+      }
       // second line holds the long name, which is prefixed with the manufacturer on USB devices
       const longName = (lines[i + 1] || '').trim();
       const manufacturer = longName.indexOf(name) > 0 ? longName.substring(0, longName.indexOf(name)).trim() : '';

package/lib/filesystem.js

@@ -1722,6 +1722,10 @@ function diskLayout(callback) {
               const smartDev = JSON.parse(execSync('smartctl --scan -j').toString());
               if (smartDev && smartDev.devices && smartDev.devices.length > 0) {
                 smartDev.devices.forEach((dev) => {
+                  // device names come from smartctl output - never let anything but a plain path reach the shell
+                  if (!/^[\w/.,:\\-]+$/.test(String(dev.name || ''))) {
+                    return;
+                  }
                   workload.push(execPromiseSave(`smartctl -j -a ${dev.name}`, util.execOptsWin));
                 });
               }

package/lib/graphics.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const path = require('path');
 const exec = require('child_process').exec;
 const execSync = require('child_process').execSync;
+const execFileSync = require('child_process').execFileSync;
 const util = require('./util');
 
 const _platform = process.platform;
@@ -481,14 +482,9 @@ function graphics(callback) {
     if (nvidiaSmiExe) {
       const nvidiaSmiOpts =
         '--query-gpu=driver_version,pci.sub_device_id,name,pci.bus_id,fan.speed,memory.total,memory.used,memory.free,utilization.gpu,utilization.memory,temperature.gpu,temperature.memory,power.draw,power.limit,clocks.gr,clocks.mem --format=csv,noheader,nounits';
-      const cmd = `"${nvidiaSmiExe}" ${nvidiaSmiOpts}`;
-      if (_linux) {
-        options.stdio = ['pipe', 'pipe', 'ignore'];
-      }
+      options.stdio = ['pipe', 'pipe', 'ignore'];
       try {
-        const sanitized = cmd + (_linux ? '  2>/dev/null' : '') + (_windows ? '  2> nul' : '');
-        const res = execSync(sanitized, options).toString();
-        return res;
+        return execFileSync(nvidiaSmiExe, nvidiaSmiOpts.split(' '), options).toString();
       } catch {
         util.noop();
       }

package/lib/internet.js

@@ -166,6 +166,12 @@ function inetLatency(host, callback) {
         }
         return resolve(null);
       }
+      if (hostSanitized.startsWith('-')) {
+        if (callback) {
+          callback(null);
+        }
+        return resolve(null);
+      }
       let params;
       if (_linux || _freebsd || _openbsd || _netbsd || _darwin) {
         if (_linux) {

package/lib/network.js

@@ -368,8 +368,8 @@ function getWindowsWiredProfilesInformation() {
 
 function getWindowsWirelessIfaceSSID(interfaceName) {
   try {
-    const result = execSync(`netsh wlan show  interface name="${interfaceName}" | findstr "SSID"`, util.execOptsWin);
-    const SSID = result.split('\r\n').shift();
+    const result = execFileSync('netsh', ['wlan', 'show', 'interface', `name=${util.sanitizeString(interfaceName)}`], util.execOptsWin).toString();
+    const SSID = result.split('\r\n').find((l) => l.includes('SSID')) || '';
     const parseSSID = SSID.split(':').pop().trim();
     return parseSSID;
   } catch {
@@ -420,7 +420,7 @@ function getWindowsIEEE8021x(connectionType, iface, ifaces) {
       const SSID = getWindowsWirelessIfaceSSID(iface);
       if (SSID !== 'Unknown') {
         const ifaceSanitized = util.sanitizeString(SSID);
-        const profiles = execSync(`netsh wlan show profiles "${ifaceSanitized}"`, util.execOptsWin).split('\r\n');
+        const profiles = execFileSync('netsh', ['wlan', 'show', 'profiles', ifaceSanitized], util.execOptsWin).toString().split('\r\n');
         i8021xState = (profiles.find((l) => l.indexOf('802.1X') >= 0) || '').trim();
         i8021xProtocol = (profiles.find((l) => l.indexOf('EAP') >= 0) || '').trim();
       }
@@ -943,7 +943,7 @@ function networkInterfaces(callback, rescan, defaultString) {
                 ip6subnet = ip6linksubnet;
               }
               const iface = dev.split(':')[0].trim();
-              const ifaceSanitized = util.sanitizeString(iface);
+              const ifaceSanitized = util.sanitizeString(iface, true);
               const cmd = `echo -n "addr_assign_type: "; cat /sys/class/net/${ifaceSanitized}/addr_assign_type 2>/dev/null; echo;
             echo -n "address: "; cat /sys/class/net/${ifaceSanitized}/address 2>/dev/null; echo;
             echo -n "addr_len: "; cat /sys/class/net/${ifaceSanitized}/addr_len 2>/dev/null; echo;

package/lib/osinfo.js

@@ -18,7 +18,6 @@ const fs = require('fs');
 const util = require('./util');
 const exec = require('child_process').exec;
 const execSync = require('child_process').execSync;
-const execFile = require('child_process').execFile;
 
 const _platform = process.platform;
 
@@ -775,78 +774,47 @@ function versions(apps, callback) {
           });
         }
         if ({}.hasOwnProperty.call(appsObj.versions, 'postgresql')) {
-          if (_linux) {
-            exec('locate bin/postgres', (error, stdout) => {
-              if (!error) {
-                const safePath = /^[a-zA-Z0-9/_.-]+$/;
-                const postgresqlBin = stdout
-                  .toString()
-                  .split('\n')
-                  .filter((p) => safePath.test(p.trim()))
-                  .sort();
-                if (postgresqlBin.length) {
-                  execFile(postgresqlBin[postgresqlBin.length - 1], ['-V'], (error, stdout) => {
-                    if (!error) {
-                      const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                      appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
+          if (_windows) {
+            util.powerShell('Get-CimInstance Win32_Service | select caption | fl').then((stdout) => {
+              let serviceSections = stdout.split(/\n\s*\n/);
+              serviceSections.forEach((item) => {
+                if (item.trim() !== '') {
+                  let lines = item.trim().split('\r\n');
+                  let srvCaption = util.getValue(lines, 'caption', ':', true).toLowerCase();
+                  if (srvCaption.indexOf('postgresql') > -1) {
+                    const parts = srvCaption.split(' server ');
+                    if (parts.length > 1) {
+                      appsObj.versions.postgresql = parts[1];
                     }
-                    functionProcessed();
-                  });
-                } else {
-                  functionProcessed();
-                }
-              } else {
-                exec('psql -V', (error, stdout) => {
-                  if (!error) {
-                    const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                    appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
-                    appsObj.versions.postgresql = appsObj.versions.postgresql.split('-')[0];
                   }
-                  functionProcessed();
-                });
-              }
+                }
+              });
+              functionProcessed();
             });
           } else {
-            if (_windows) {
-              util.powerShell('Get-CimInstance Win32_Service | select caption | fl').then((stdout) => {
-                let serviceSections = stdout.split(/\n\s*\n/);
-                serviceSections.forEach((item) => {
-                  if (item.trim() !== '') {
-                    let lines = item.trim().split('\r\n');
-                    let srvCaption = util.getValue(lines, 'caption', ':', true).toLowerCase();
-                    if (srvCaption.indexOf('postgresql') > -1) {
-                      const parts = srvCaption.split(' server ');
-                      if (parts.length > 1) {
-                        appsObj.versions.postgresql = parts[1];
-                      }
-                    }
-                  }
-                });
-                functionProcessed();
-              });
-            } else {
-              exec('postgres -V', (error, stdout) => {
-                if (!error) {
-                  const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                  appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
-                  if (appsObj.versions.postgresql.includes('(') && postgresql.length >= 2 && !postgresql[postgresql.length - 2].includes('(')) {
-                    appsObj.versions.postgresql = postgresql[postgresql.length - 2];
-                  }
+            const parsePostgres = (stdout) => {
+              const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
+              let version = postgresql.length ? postgresql[postgresql.length - 1] : '';
+              if (version.includes('(') && postgresql.length >= 2 && !postgresql[postgresql.length - 2].includes('(')) {
+                version = postgresql[postgresql.length - 2];
+              }
+              return version.split('-')[0];
+            };
+            // no `locate`: its output is any user-writable path and must not be executed
+            const tryPostgres = (cmds) => {
+              if (!cmds.length) {
+                return functionProcessed();
+              }
+              exec(cmds[0], (error, stdout) => {
+                if (!error && stdout.toString().trim()) {
+                  appsObj.versions.postgresql = parsePostgres(stdout);
                   functionProcessed();
                 } else {
-                  exec('pg_config --version', (error, stdout) => {
-                    if (!error) {
-                      const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                      appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
-                      if (appsObj.versions.postgresql.includes('(') && postgresql.length >= 2 && !postgresql[postgresql.length - 2].includes('(')) {
-                        appsObj.versions.postgresql = postgresql[postgresql.length - 2];
-                      }
-                    }
-                    functionProcessed();
-                  });
+                  tryPostgres(cmds.slice(1));
                 }
               });
-            }
+            };
+            tryPostgres(['postgres -V', 'pg_config --version', 'psql -V']);
           }
         }
         if ({}.hasOwnProperty.call(appsObj.versions, 'perl')) {

package/lib/wifi.js

@@ -193,7 +193,7 @@ function ifaceListLinux() {
 }
 
 function nmiDeviceLinux(iface) {
-  const cmd = `nmcli -t -f general,wifi-properties,capabilities,ip4,ip6 device show ${iface} 2> /dev/null`;
+  const cmd = `nmcli -t -f general,wifi-properties,capabilities,ip4,ip6 device show ${util.sanitizeString(iface, true)} 2> /dev/null`;
   try {
     const lines = execSync(cmd, util.execOptsLinux).toString().split('\n');
     const ssid = util.getValue(lines, 'GENERAL.CONNECTION');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/systeminformation",
-  "version": "5.33.6-depup.0",
+  "version": "5.33.8-depup.0",
   "description": "Advanced, lightweight system and OS information library (with updated dependencies)",
   "license": "MIT",
   "author": "Sebastian Hildebrandt <hildebrandt@plus-innovations.com> (https://plus-innovations.com)",
@@ -111,8 +111,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "systeminformation",
-    "originalVersion": "5.33.6",
-    "processedAt": "2026-08-30T00:59:35.725Z",
+    "originalVersion": "5.33.8",
+    "processedAt": "2026-09-06T01:00:19.560Z",
     "smokeTest": "passed"
   }
 }