Critical vulnerability in locutus <=3.0.24

[seismicmike]

Summary

With drupal-twig-extensions installed, the locutus package is included as a dependency at version ^2.0.16, which resolves to 2.0.39, and npm audit reports this as a critical vulnerability.

Are there any plans to update locutus to ^3.0.25?

Details

I am using drupal-twig-extensions via vite-plugin-twig-drupal to render Drupal Single Directory components in Storybook without having to have a Drupal backend running. The approach is similar to this, but I'm not actually using that package.

When I have this set up,
npm audit reports the following:

# npm audit report

locutus  <=3.0.24
Severity: critical
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection - https://github.com/advisories/GHSA-fp25-p6mj-qqg6
Locutus vulnerable to RCE via unsanitized input in create_function() - https://github.com/advisories/GHSA-vh9h-29pq-r5m8
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 - https://github.com/advisories/GHSA-vc8f-x9pp-wf5p
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() - https://github.com/advisories/GHSA-4mph-v827-f877
No fix available
node_modules/locutus
  drupal-twig-extensions  *
  Depends on vulnerable versions of locutus
  node_modules/drupal-twig-extensions
    vite-plugin-twig-drupal  *
    Depends on vulnerable versions of drupal-twig-extensions
    Depends on vulnerable versions of twig
    node_modules/vite-plugin-twig-drupal
  twig  0.10.0 - 1.17.1
  Depends on vulnerable versions of locutus
  node_modules/twig

4 vulnerabilities (3 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

In my particular setup, npm ls locutus reports the following:

└─┬ vite-plugin-twig-drupal@1.6.3
  ├─┬ drupal-twig-extensions@1.0.0-beta.5
  │ └── locutus@2.0.39
  └─┬ twig@1.17.1
    └── locutus@2.0.39 deduped

I have tried using the overrides directive in package.json to force updating locutus to 3.0.34, but when I do that, my Drupal code does not render in the Storybook interface. The console shows this errror:

●  1.78 s for manager and 2.73 s for preview
✘ [ERROR] Could not resolve "locutus/php/datetime/date.js"

    node_modules/drupal-twig-extensions/lib/filters/format_date/definition.js:11:17:
      11 │ import date from 'locutus/php/datetime/date.js';
         ╵                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  The module "./esm/php/datetime/date.js.js" was not found on the file system:

    node_modules/locutus/package.json:138:16:
      138 │       "import": "./esm/*.js",
          ╵                 ~~~~~~~~~~~~

  You can mark the path "locutus/php/datetime/date.js" as external to exclude it from the bundle,
  which will remove this error and leave the unresolved path in the bundle.

│
■  Vite error while updating dependencies:
│  Error: Build failed with 1 error:
│  node_modules/drupal-twig-extensions/lib/filters/format_date/definition.js:11:17:
│  ERROR: Could not resolve "locutus/php/datetime/date.js"
│  at failureErrorWithLog
│  (./node_modules/vite/node_modules/esbuild/lib/main.js:1467:15)
│  at ./node_modules/vite/node_modules/esbuild/lib/main.js:926:25
│  at ./node_modules/vite/node_modules/esbuild/lib/main.js:1345:9
│  at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

Are there any plans to update the use of locutus to be compatible with 3.x and resolve this npm audit issue?

[alex-ahumada]

I can see there's a related PR (#61) but no release yet as tests are failing.