SPFx 1.23.0: @microsoft/sp-adaptive-card-extension-base still resolves vulnerable transitive dependency swiper@8.4.7

[shirishmawande]

Category

Bug

Version

• SPFx: 1.23.0
• Node.js: 22.22.2
• pnpm: 11.3.0

Describe the bug

While upgrading SPFx solutions to 1.23.0, I observed that @microsoft/sp-adaptive-card-extension-base@1.23.0 still resolves the transitive dependency swiper@8.4.7.

In environments with vulnerability enforcement and dependency governance, this causes installation issues and requires consumers to maintain dependency overrides as a workaround.

Observed Behavior

The dependency graph resolves:

@microsoft/sp-adaptive-card-extension-base@1.23.0
└── swiper@8.4.7

During installation, the vulnerable Swiper version is still requested as part of the dependency tree.

To complete the installation successfully, an override is required:

pnpm:
overrides:
swiper: 12.1.3
(or another approved non-vulnerable version)

Expected Behavior

SPFx 1.23.0 packages should not depend on vulnerable package versions that require consumers to maintain manual overrides.

Ideally:

• The dependency should be updated to a non-vulnerable Swiper version.
• Or guidance should be provided if the current version is intentionally retained.

[Ashlesha-MSFT]

Hello @shirishmawande,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[Ashlesha-MSFT]

Hello @shirishmawande,

We were able to reproduce the behavior where @microsoft/sp-adaptive-card-extension-base@1.23.0 resolves the transitive dependency swiper@8.4.7, which may trigger security policy violations in environments with dependency governance or vulnerability enforcement.

We are raising a bug internally for this issue, and the engineering team will take a closer look. We’ll evaluate whether an updated dependency version is required or if further guidance is needed for consumers in the meantime.

We’ll update this thread once there is more clarity or a fix is available.

Thanks for the detailed investigation.