Dependency on a vulnerable version of the Swiper library

[mgax]

Currently @samvera/clover-iiif depends on a vulnerable version of swiper.

mgax@smurf temp % npm install '@samvera/clover-iiif'
npm warn ERESOLVE overriding peer dependency

added 261 packages in 10s

97 packages are looking for funding
  run `npm fund` for details
mgax@smurf temp % trivy fs package-lock.json
2026-03-18T16:09:11+02:00       INFO    [vuln] Vulnerability scanning is enabled
2026-03-18T16:09:11+02:00       INFO    [secret] Secret scanning is enabled
2026-03-18T16:09:11+02:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-03-18T16:09:11+02:00       INFO    [secret] Please see https://trivy.dev/docs/v0.69/guide/scanner/secret#recommendation for faster secret detection
2026-03-18T16:09:11+02:00       INFO    [npm] To collect the license information of packages, "npm install" needs to be performed beforehanddir="node_modules"
2026-03-18T16:09:11+02:00       INFO    Number of language-specific files       num=1
2026-03-18T16:09:11+02:00       INFO    [npm] Detecting vulnerabilities...

Report Summary

┌───────────────────┬──────┬─────────────────┬─────────┐
│      Target       │ Type │ Vulnerabilities │ Secrets │
├───────────────────┼──────┼─────────────────┼─────────┤
│ package-lock.json │ npm  │        1        │    -    │
└───────────────────┴──────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


package-lock.json (npm)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                   Title                    │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────┤
│ swiper  │ CVE-2026-27212 │ CRITICAL │ fixed  │ 9.4.1             │ 12.1.2        │ Prototype pollution in swiper              │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-27212 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────┘
mgax@smurf temp % node --version
v25.8.1
mgax@smurf temp % npm --version
11.11.0

[mathewjordan]

Thank you for noting @mgax. FYI, We are considering moving away from Swiper in the next major version. I don't know if you have opinions about this.

[mgax]

FYI, We are considering moving away from Swiper in the next major version. I don't know if you have opinions about this.

I don't have any opinion, I was just doing maintenance on a project and ticking off trivy findings. But thanks for reaching out 😊