Repository navigation
DEP0169 DeprecationWarning: url.parse() when url.resolve() used (node_modules context) #61724
Description
Version
24.x & 25.x - see #61724 (comment) for details
Platform
Linux ubuntu-24.04 6.17.0-14-generic #14~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Jan 15 15:52:10 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
Subsystem
url
What steps will reproduce the bug?
Run example from Legacy URL API url.resolve(from, to)
const url = require('node:url');
url.resolve('/one/two/three', 'four'); // '/one/two/four'
url.resolve('http://example.com/', '/one'); // 'http://example.com/one'
url.resolve('http://example.com/one', '/two'); // 'http://example.com/two'How often does it reproduce? Is there a required condition?
For the above steps, it always reproduces in Node.js 25.4.0 - 25.6.0. It is a regression from Node.js 25.3.0.
If the url.resolve() call is embedded in an npm package, it depends how the corresponding module is called, whether or not a deprecation warning appears. See the additional information section below for examples.
What is the expected behavior? Why is that the expected behavior?
The example with only url.resolve() should run without producing a deprecation warning.
The history section of url.resolve(from, to) states that the deprecation was revoked in v15.13.0, v14.17.0 and there is no entry for any higher version.
DEP0169 lists url.parse() explicitly. It does not include any direct reference to url.resolve().
What do you see instead?
$ node url-resolve.js
(node:5802) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)
Additional information
I originally noticed this with Cypress, on Ubuntu 24.04.3 LTS, Node.js 25.6.0, with steps to reproduce:
cd $(mktemp -d)
npm install cypress
npx cypress install --forcewhere the call is from /node_modules/cypress/dist/tasks/download.js.
The following steps however do NOT cause any deprecation warning, even though download is also run:
rm -rf ~/.cache/Cypress
cd $(mktemp -d)
npm install cypress
Activity
MikeMcC399 commentedon Feb 11, 2026
Implementing this would be a quick fix to the regression introduced by #60991 in 24.13.1 and 25.4.0
MikeMcC399 commentedon Feb 11, 2026
That would solve the issue for usage outside of
node_modulesin 24.x & 25.xEdit: follow-on in #61816
MikeMcC399 commentedon Feb 14, 2026
I've moved the deprecation documentation issue to #61816 for clarity. This is about documenting that #55017 added Application deprecation (non-
node_modulescode only) in v24.0.0 explicitly forurl.parse()and the implicit deprecation caused by the dependency ofurl.resolve()onurl.parse()needs to be retroactively added to the documentation for v24.0.0.MikeMcC399 commentedon Feb 14, 2026
With the deprecation documentation issue spun off to #61816, this issue can focus on the regression introduced by #60991 which causes
url.resolve()usage in anode_modulesenvironment under Node.js 24.13.1 and 25.4.0 - 25.6.0 to emit DEP0169.It seems the change from:
to
was too radical and did not take account of a nested call from
urlResolvetourlParse.Deprecation detection / suppression needs to be changed so that invoking
url.resolve()in anode_modulescontext does NOT emit DEP0169, the same as is the case forurl.parse()in anode_modulescontext.[-]DEP0169 DeprecationWarning: url.parse() when url.resolve() used[/-][+]DEP0169 DeprecationWarning: url.parse() when url.resolve() used (node_modules context)[/+]MikeMcC399 commentedon Feb 17, 2026
Also reproducible with the following on Windows using Node.js 24.13.1 installed from MSI package:
MikeMcC399 commentedon Feb 24, 2026
This issue remains reproducible for Node.js 24.14.0 LTS and 25.7.0
produces:
Edit: Still reproducible in Node.js 24.14.1, no longer reproducible in Node.js >=25.8.1 including 25.9.0
MikeMcC399 commentedon Feb 26, 2026
#62002 is submitted to formally confirm deprecation of
url.resolve()in a non-node_modulescontext and to clarify that the definition of DEP0169: Insecure url.parse() as:also applies to
url.resolve(). In other words, there should be no deprecation warning fornode_modulesusage ofurl.resolve()url: suppress warnings from url.format/url.resolve inside node_modules
url: suppress warnings from url.format/url.resolve inside node_modules
url: suppress warnings from url.format/url.resolve inside node_modules
MikeMcC399 commentedon Mar 11, 2026
Verified fixed in Node.js 25.8.1 with test from #61724 (comment) above.
MikeMcC399 commentedon Apr 16, 2026
Verified fixed in Node.js 24.15.0 with test from #61724 (comment) above.