fix(dashmate): bump systeminformation and ajv to fix npm audit failures

[thepastaclaw]

Issue

The JS NPM security audit CI check is failing across all open PRs due to newly published npm advisories.

Root Cause

Newly published advisories are causing yarn npm audit --environment production --all --recursive to fail:

1. systeminformation (high) — Command Injection vulnerabilities
   • GHSA-5vv4-hvf7-2h46: Unsanitized locate output in versions()
   • GHSA-9c88-49p5-5ggf: Unsanitized interface parameter in wifi.js
   • Direct dependency in packages/dashmate/package.json
2. ajv (moderate) — GHSA-2g4f-4pwh-qvx6: ReDoS via $data option
   • Direct dependency in dapi, dashmate, wasm-dpp — bumped from 8.12.0 → 8.18.0
   • ajv@6.12.6 remains as eslint transitive (eslint depends on ajv@^6.12.4, no upstream fix) — excluded
3. bn.js (moderate) — GHSA-378v-28hj-76wf: Infinite loop (transitive via dashcore-lib → elliptic → bn.js@4.x, needs major version bump) — excluded
4. minimatch (high) — GHSA-3ppc-4f35-3m26: ReDoS via wildcards (transitive via @oclif/core, karma-webpack, mocha; all on minimatch 3.x-9.x, vuln covers < 10.2.1) — excluded

Fix

• Bump systeminformation from ^5.27.14 to ^5.31.1 (fixes both CVEs directly)
• Bump ajv from ^8.6.0 to ^8.18.0 in dapi, dashmate, wasm-dpp (fixes the 8.x advisory directly)
• Deduplicateajv@8.x across the lockfile to 8.18.0 (table@6.8.1 was pulling in 8.12.0)
• Exclude ajv@6 (eslint), bn.js (dashcore-lib), minimatch (mocha/oclif) — transitive deps that cannot be bumped without major parent package updates

Verification

$ yarn npm audit --environment production --all --recursive
➤ YN0001: No audit suggestions

Impact

Fixes the JS NPM security audit CI check for all affected open PRs.

[coderabbitai]

Warning

Rate limit exceeded

@thepastaclaw has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 12 minutes and 45 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[thepastaclaw]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[PastaPastaPasta]

CI is happy, makes enough sense to me

[shumkov]

👍