URL: Stop normalizePath throwing on a malformed percent sequence

[konnen916]

What?

Closes #81085

normalizePath throws a URIError when a query parameter contains a malformed percent sequence. This switches it to the package's own safeDecodeURIComponent.

Why?

normalizePath decodes each parameter with bare decodeURIComponent, so a lone % in a value takes the whole call down:

normalizePath( '/wp/v2/posts?search=50%off' );
// URIError: URI malformed

This is the same failure that was fixed for getQueryArgs in #45561, where the throw was breaking Calypso. That PR introduced safeDecodeURIComponent for exactly this, and normalizePath was not updated at the time.

It reaches past the function because the preloading middleware in @wordpress/api-fetch calls normalizePath on every key of the preloaded data and on options.path for every request that passes through it. One unencoded %, in a hand-written path or in a server-generated preload key, takes out the middleware instead of failing a single request, and it surfaces during normalization rather than as an API error.

How?

One line plus the import, matching #45561: decodeURIComponent becomes safeDecodeURIComponent, which returns the component untouched when decoding fails.

Well-formed input is unaffected. Malformed input now normalizes instead of throwing, and the function stays order-stable, which is the property it exists to provide:

normalizePath( '/foo/bar?a=5&b=50%off' ) === normalizePath( '/foo/bar?b=50%off&a=5' );
// true

Testing Instructions

1. Open a post or page.
2. Open the console.
3. Run wp.url.normalizePath( '/wp/v2/posts?search=50%off' ).
4. On trunk it throws URIError: URI malformed. With this branch it returns /wp/v2/posts?search=50%25off.

Or run the package tests:

npm run test:unit -- packages/url

Two tests are added, one asserting it no longer throws and one asserting it stays order-stable when a parameter is malformed. packages/api-fetch also passes, since it is the consumer of this function.

Testing Instructions for Keyboard

Not applicable, this is a package-level change with no UI.

Screenshots or screencast

Not applicable.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @konnen916.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: konnen916.

Co-authored-by: hbhalodia <hbhalodia@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

👋 Thanks for your first Pull Request and for helping build the future of Gutenberg and WordPress, @konnen916! In case you missed it, we'd love to have you join us in our Slack community.

If you want to learn more about WordPress development in general, check out the Core Handbook full of helpful information.

[konnen916]

Thanks, fixed both.

The lint error was the dependency group comment block I put above the import. No other .ts file in packages/url uses one, get-query-args.ts included, so I removed it and the file now matches its siblings. npx eslint packages/url/src/normalize-path.ts is clean and the package suite passes, 503 tests.

I also took your CHANGELOG wording, and rebased on trunk since it had picked up a conflict from the 4.53.0 section being cut.

[hbhalodia]

Thanks @konnen916, LGTM! and works well. Below is the test report.

Without patch

Screen.Recording.2026-08-14.at.1.02.22.PM.mov

With patch

Screen.Recording.2026-08-14.at.1.03.04.PM.mov

Unit tests

  normalizePath
    ✓ returns same value if no query parameters
    ✓ returns a stable path (1 ms)
    ✓ sorts urldecoded values and returns property urlencoded query string
    ✓ should not blow up on malformed params (1 ms)
    ✓ returns a stable path when a param is malformed

[github-actions]

Congratulations on your first merged pull request, @konnen916! We'd like to credit you for your contribution in the post announcing the next WordPress release, but we can't find a WordPress.org profile associated with your GitHub account. When you have a moment, visit the following URL and click "link your GitHub account" under "GitHub Username" to link your accounts:

https://profiles.wordpress.org/me/profile/edit/

And if you don't have a WordPress.org account, you can create one on this page:

https://login.wordpress.org/register

Kudos!