chore(deps): bump the npm-minor-patch group with 3 updates

[dependabot]

Bumps the npm-minor-patch group with 3 updates: swiper, @types/node and postcss.

Updates swiper from 14.0.7 to 14.1.0

Release notes

Sourced from swiper's releases.

v14.1.0

Bug Fixes

• core: keep module defaults when params come from another realm (4bb6caf)
• core: make elementOffset viewport-relative again (1115f9e), closes #8209
• types: preserve module options in breakpoints (d598495), closes #8207

Changelog

Sourced from swiper's changelog.

14.1.0 (2026-08-06)

Bug Fixes

• core: keep module defaults when params come from another realm (4bb6caf)
• core: make elementOffset viewport-relative again (1115f9e), closes #8209
• types: preserve module options in breakpoints (d598495), closes #8207

Commits

• 6138c2a 14.1.0
• 576ae5b Merge branch 'master' of https://github.com/nolimits4web/swiper
• a7b1fef Merge pull request #8208 from cexbrayat/8207-fix-breakpoint-module-options
• d944b4d Enhance comments in SwiperOptions interface
• 916acac Merge branch 'master' of https://github.com/nolimits4web/swiper
• bf3bf56 Merge pull request #8210 from jmwerk/fix/element-offset-viewport-relative
• 988b8d2 Simplify comments for elementOffset function
• 4bb6caf fix(core): keep module defaults when params come from another realm
• 1115f9e fix(core): make elementOffset viewport-relative again
• d598495 fix(types): preserve module options in breakpoints
• See full diff in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Updates postcss from 8.5.25 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

🔍 Dependency Update Analysis

This PR bundles 3 minor/patch npm updates. No GHSA/CVE security advisories are associated with these packages, but postcss 8.5.26 includes a notable defensive fix.

---

📦 Package Analysis

swiper: 14.0.7 → 14.1.0

• Type: Direct dependency (package.json)
• Usage: ❌ Not actively used — only referenced as commented-out @import lines in SCSS files
• Changes: Bug fixes only (elementOffset viewport-relative fix, module defaults fix, type fixes)
• Risk: ✅ None

@types/node: 26.1.2 → 26.2.0

• Type: Direct dev dependency (package.json)
• Usage: ✅ TypeScript type definitions used across the project
• Changes: Type definition updates only
• Risk: ✅ None — dev-only, no runtime impact

postcss: 8.5.25 → 8.5.26

• Type: Direct dependency (package.json, used via postcss.config.js)
• Usage: ✅ Actively used for CSS processing (PostCSS config present)
• Changes:
  • Fixed list.split() regression
  • Track symlinks in path protection for source map loading — this resolves a potential path traversal concern when loading source maps via symlinks
• Risk: ✅ Low — patch update, defensive security improvement

---

🔒 Security Note on PostCSS

The symlink-tracking fix in postcss 8.5.26 (Resolve symlinks before the previous-source-map containment check) is a hardening improvement for source map path protection. While no CVE has been assigned, updating is advisable as it closes a potential path traversal edge case in build tooling.

---

✅ Recommendation

Package	Recommendation
swiper	✅ Safe to merge — minor update, package not actively used
@types/node	✅ Safe to merge — dev-only type update
postcss	✅ Safe to merge — patch with defensive security improvement

Overall: ✅ Safe to merge. All updates are patch/minor with no breaking changes expected. The postcss update includes a beneficial hardening fix.

---

This analysis was automatically generated by the Security Advisory Responder agent.

Generated by Security Advisory Responder for issue #431 · ● 217K · ◷