fix(host-metrics): bump minimum systeminformation version to 5.21.20 (security)

[yoanyomba2023]

…n vulnerability in systeminformation

Which problem is this PR solving?

In the current version of the systeminformation library used by the host metrics package, a pretty serious vulnerability exists. That being the arbitrary command injection. This pull request addresss that by bumping the version of the library.

Short description of the changes

This changes is only comprised of a version bump.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: yoanyomba2023 (5b33b83)
• ✅ login: pichlermarc / name: Marc Pichler (4cb5e3a, 598f9f9)

[pichlermarc]

Hi @yoanyomba2023 thanks for opening this PR and letting us know about this.

While this is not exploitable in the way we use it in the @opentelemetry/host-metrics package (we don't use any of the functions with direct user input), and we do pull in the latest version (as we use a caret-range for this package), I agree that we should bump the minimum supported version to what you proposed.

---

A side note: please use GitHub's Report a vulnerability button on the Security tab for any future vulnerability reports as outlined in our security policy. This opens a private communication channel where maintainers can review reports of any potential vulnerabilities before publicly disclosing them via a GitHub security advisory. It also allows us to work on a fix in a private fork to ensure we don't give malicious actors a head-start before a fix for our users is available, and it also notifies Maintainers in a different way a PR would. All this allows us to address fixes quicker than via a regular PR.

[pichlermarc]

I took the liberty to sync the package-lock.json and changed the PR title so that release-please properly triggers a release. 🙂

[codecov]

Codecov Report

Merging #1868 (598f9f9) into main (7e335c7) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1868   +/-   ##
=======================================
  Coverage   91.45%   91.45%           
=======================================
  Files         144      144           
  Lines        7406     7406           
  Branches     1483     1483           
=======================================
  Hits         6773     6773           
  Misses        633      633           

[yoanyomba2023]

I took the liberty to sync the package-lock.json and changed the PR title so that release-please properly triggers a release. 🙂

hey @pichlermarc than you so much for the approval. On the module (host metrics) npm page, the version is still 0.34.0 which was released a month ago. Please reference: https://www.npmjs.com/package/@opentelemetry/host-metrics.

I was wondering if the release failed by chance or didn't run?
Could you re-trigger the pipeline run if possilble?

[trentm]

I was wondering if the release failed by chance or didn't run?

@yoanyomba2023 There just hasn't yet been a release of packages in this repo since this issue was merged two weeks ago.
It will be included in the next release; see #1855
I don't know exactly when that will be released, but I'm guessing fairly soon.