From c8a255b884029852f96ba7a7f4e4816313e178a8 Mon Sep 17 00:00:00 2001
From: iberdinsky-skilld <iberdinsky@skilld.cloud>
Date: Sun, 22 Mar 2026 21:50:26 +0100
Subject: [PATCH] locutus upgrade CVE-2026-29091

---
 package-lock.json | 34 +++++++++++++++++++++++++++++-----
 package.json      |  2 +-
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index cc891fc..bbdf4c2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "license": "(MIT OR GPL-2.0-only)",
       "dependencies": {
         "drupal-attribute": "^1.0.2",
-        "locutus": "^2.0.16",
+        "locutus": "^3.0.24",
         "lodash.clonedeep": "^4.5.0"
       },
       "devDependencies": {
@@ -6317,11 +6317,13 @@
       }
     },
     "node_modules/locutus": {
-      "version": "2.0.16",
-      "resolved": "https://registry.npmjs.org/locutus/-/locutus-2.0.16.tgz",
-      "integrity": "sha512-pGfl6Hb/1mXLzrX5kl5lH7gz25ey0vwQssZp8Qo2CEF59di6KrAgdFm+0pW8ghLnvNzzJGj5tlWhhv2QbK3jeQ==",
+      "version": "3.0.24",
+      "resolved": "https://registry.npmjs.org/locutus/-/locutus-3.0.24.tgz",
+      "integrity": "sha512-ErfAZ82Q2RNuk3NPDliKG7f5kc3E/hHh/vz17TAGCyctqao2xoFkNKrkyfHYMFXG1mNQt14kJJ1yPDKm6p3SkQ==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 10"
+        "node": ">= 22",
+        "yarn": ">= 1"
       }
     },
     "node_modules/lodash": {
@@ -9021,6 +9023,17 @@
         "@types/node": "^12.0.8"
       }
     },
+    "node_modules/twig/node_modules/locutus": {
+      "version": "2.0.39",
+      "resolved": "https://registry.npmjs.org/locutus/-/locutus-2.0.39.tgz",
+      "integrity": "sha512-v2iub44UtGpbIv+pFkkYhZ+JsbIM0bJsQcQ1+VayUNGVA/YhM8+CkBiRACcpuuE9Q0xI1pgNzGNwzZDCp1MCww==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10",
+        "yarn": ">= 1"
+      }
+    },
     "node_modules/twig/node_modules/minimatch": {
       "version": "3.0.8",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.8.tgz",
@@ -9076,6 +9089,17 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/twing/node_modules/locutus": {
+      "version": "2.0.39",
+      "resolved": "https://registry.npmjs.org/locutus/-/locutus-2.0.39.tgz",
+      "integrity": "sha512-v2iub44UtGpbIv+pFkkYhZ+JsbIM0bJsQcQ1+VayUNGVA/YhM8+CkBiRACcpuuE9Q0xI1pgNzGNwzZDCp1MCww==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10",
+        "yarn": ">= 1"
+      }
+    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
diff --git a/package.json b/package.json
index bc37c35..7b106df 100644
--- a/package.json
+++ b/package.json
@@ -89,7 +89,7 @@
   },
   "dependencies": {
     "drupal-attribute": "^1.0.2",
-    "locutus": "^2.0.16",
+    "locutus": "^3.0.24",
     "lodash.clonedeep": "^4.5.0"
   },
   "optionalPeerDependencies": {