René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"DEP0169 DeprecationWarning: url.parse() when url.resolve() used (node_modules context)","articleBody":"### Version\n\n24.x \u0026 25.x - see https://github.com/nodejs/node/issues/61724#issuecomment-3883242909 for details\n\n### Platform\n\n```text\nLinux ubuntu-24.04 6.17.0-14-generic #14~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Jan 15 15:52:10 UTC 2 x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\nurl\n\n### What steps will reproduce the bug?\n\nRun example from Legacy URL API [url.resolve(from, to)](https://nodejs.org/docs/latest/api/url.html#urlresolvefrom-to)\n\n```js\nconst url = require('node:url');\nurl.resolve('/one/two/three', 'four');         // '/one/two/four'\nurl.resolve('http://example.com/', '/one');    // 'http://example.com/one'\nurl.resolve('http://example.com/one', '/two'); // 'http://example.com/two'\n```\n\n\n### How often does it reproduce? Is there a required condition?\n\nFor the above steps, it always reproduces in Node.js 25.4.0 - 25.6.0. It is a regression from Node.js 25.3.0.\n\nIf the `url.resolve()` call is embedded in an npm package, it depends how the corresponding module is called, whether or not a deprecation warning appears. See the additional information section below for examples.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nThe example with only `url.resolve()` should run without producing a deprecation warning.\n\nThe history section of [url.resolve(from, to)](https://nodejs.org/docs/latest/api/url.html#urlresolvefrom-to) states that the deprecation was revoked in v15.13.0, v14.17.0 and there is no entry for any higher version.\n\n[DEP0169](https://nodejs.org/docs/latest/api/deprecations.html#DEP0169) lists [url.parse()](https://nodejs.org/docs/latest/api/url.html#urlparseurlstring-parsequerystring-slashesdenotehost) explicitly. It does not include any direct reference to `url.resolve()`.\n\n### What do you see instead?\n\n```text\n$ node url-resolve.js\n(node:5802) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.\n(Use `node --trace-deprecation ...` to show where the warning was created)\n```\n\n\n### Additional information\n\nI originally noticed this with Cypress, on Ubuntu 24.04.3 LTS, Node.js 25.6.0, with steps to reproduce:\n\n```shell\ncd $(mktemp -d)\nnpm install cypress\nnpx cypress install --force\n```\n\nwhere the call is from `/node_modules/cypress/dist/tasks/download.js`.\n\nThe following steps however do **NOT** cause any deprecation warning, even though download is also run:\n\n```shell\nrm -rf ~/.cache/Cypress\ncd $(mktemp -d)\nnpm install cypress\n```\n","author":{"url":"https://github.com/MikeMcC399","@type":"Person","name":"MikeMcC399"},"datePublished":"2026-02-07T18:06:41.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":21},"url":"https://github.com/61724/node/issues/61724"}