Skip to content

doc: include url.resolve() in DEP0169 application deprecation#62002

Merged
nodejs-github-bot merged 3 commits intonodejs:mainfrom
MikeMcC399:dep0169-url-resolve-addition
Mar 2, 2026
Merged

doc: include url.resolve() in DEP0169 application deprecation#62002
nodejs-github-bot merged 3 commits intonodejs:mainfrom
MikeMcC399:dep0169-url-resolve-addition

Conversation

@MikeMcC399
Copy link
Contributor

Fixes: #61816
Refs: #61780 (supersedes)

Situation

DEP0169: Insecure url.parse() lists an Application deprecation (non-node_modules code only) for url.parse() that was applied in v24.0.0.

The text notes that passing a string to url.format() also invokes the deprecation warning, since url.parse() is called internally.

The same reasoning also applies to url.resolve(), although this is not documented here.

Change

Builds on work from @legendecas in PR #61780.

Related to #55017 for v24.0.0:

For DEP0116: Legacy URL API:

For DEP0116: Legacy URL API:

For url.resolve()

  • Add history note that it is deprecated again through DEP0169
  • Mark as deprecated

Mark url.resolve() as deprecated
Update also DEP0116 with cross-reference to DEP0169
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/userland-migrations

@nodejs-github-bot nodejs-github-bot added the doc Issues and PRs related to the documentations. label Feb 26, 2026
@MikeMcC399 MikeMcC399 marked this pull request as ready for review February 26, 2026 10:05
@MikeMcC399
Copy link
Contributor Author

Previews

image
image
image

@Renegade334
Copy link
Member

Like url.format(urlString), there should be a sentence in the method's description body that explains why this is the case.

Because it invokes the deprecated [`url.parse()`][] internally, `url.resolve()` is itself deprecated.

@Renegade334 Renegade334 added url Issues and PRs related to the legacy built-in url module. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. labels Feb 26, 2026
@MikeMcC399
Copy link
Contributor Author

@Renegade334

Like url.format(urlString), there should be a sentence in the method's description body that explains why this is the case.

Because it invokes the deprecated [`url.parse()`][] internally, `url.resolve()` is itself deprecated.

Thanks for the suggestion! I've added it in, and I added "internally" to the comment in url.format(urlString) so that they are aligned.

@Renegade334 Renegade334 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. labels Feb 26, 2026
Copy link
Member

@AugustinMauroy AugustinMauroy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO missing explaining of what is the alternative

@MikeMcC399
Copy link
Contributor Author

@AugustinMauroy

IMO missing explaining of what is the alternative

The alternative is already described on the existing page https://nodejs.org/docs/latest/api/url.html#urlresolvefrom-to


The proposed change adds the history, deprecation banner and explanation of the deprecation.

image

Copy link
Member

@AugustinMauroy AugustinMauroy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup my bad !

@MikeMcC399
Copy link
Contributor Author

@AugustinMauroy

yup my bad !

No problem! There are a lot of interrelated bits, and this change is really just catching up the documentation to match reality since v24.0.0.

Copy link
Member

@gurgunday gurgunday left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@addaleax addaleax added the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 2, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 2, 2026
@nodejs-github-bot nodejs-github-bot merged commit d198813 into nodejs:main Mar 2, 2026
27 checks passed
@nodejs-github-bot
Copy link
Collaborator

Landed in d198813

@MikeMcC399 MikeMcC399 deleted the dep0169-url-resolve-addition branch March 3, 2026 06:34
aduh95 pushed a commit that referenced this pull request Mar 10, 2026
Mark url.resolve() as deprecated
Update also DEP0116 with cross-reference to DEP0169

PR-URL: #62002
Fixes: #61816
Refs: #61780
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Mar 12, 2026
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | patch | `25.8.0` → `25.8.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v25.8.1`](https://github.com/nodejs/node/releases/tag/v25.8.1): 2026-03-11, Version 25.8.1 (Current), @&#8203;aduh95

[Compare Source](nodejs/node@v25.8.0...v25.8.1)

##### Notable Changes

- \[[`ea87eea71a`](nodejs/node@ea87eea71a)] - **module**: fix extensionless CJS files in `"type": "module"` packages (Matteo Collina) [#&#8203;62083](nodejs/node#62083)

##### Commits

- \[[`bab750d1b3`](nodejs/node@bab750d1b3)] - **build**: do not depend on V8 deps on `--without-bundled-v8` builds (Antoine du Hamel) [#&#8203;62033](nodejs/node#62033)
- \[[`b26d1c7fcb`](nodejs/node@b26d1c7fcb)] - **crypto**: make --use-system-ca per-env rather than per-process (Aditi) [#&#8203;60678](nodejs/node#60678)
- \[[`e362635abf`](nodejs/node@e362635abf)] - **crypto**: add missing AES dictionaries (Filip Skokan) [#&#8203;62099](nodejs/node#62099)
- \[[`6f975db8af`](nodejs/node@6f975db8af)] - **crypto**: fix importKey required argument count check (Filip Skokan) [#&#8203;62099](nodejs/node#62099)
- \[[`3beaf9c5fc`](nodejs/node@3beaf9c5fc)] - **deps**: update amaro to 1.1.8 (Node.js GitHub Bot) [#&#8203;62151](nodejs/node#62151)
- \[[`53afb0edd8`](nodejs/node@53afb0edd8)] - **deps**: update sqlite to 3.52.0 (Node.js GitHub Bot) [#&#8203;62150](nodejs/node#62150)
- \[[`a13ed052a1`](nodejs/node@a13ed052a1)] - **deps**: update merve to 1.2.0 (Node.js GitHub Bot) [#&#8203;62149](nodejs/node#62149)
- \[[`2c850577b7`](nodejs/node@2c850577b7)] - **deps**: patch resb crate (Richard Lau) [#&#8203;62138](nodejs/node#62138)
- \[[`37862a6728`](nodejs/node@37862a6728)] - **deps**: V8: cherry-pick [`aa0b288`](nodejs/node@aa0b288f87cc) (Richard Lau) [#&#8203;62136](nodejs/node#62136)
- \[[`09191ad8b4`](nodejs/node@09191ad8b4)] - **deps**: update ada to 3.4.3 (Node.js GitHub Bot) [#&#8203;62049](nodejs/node#62049)
- \[[`8d63a178fd`](nodejs/node@8d63a178fd)] - **doc**: copyedit `addons.md` (Antoine du Hamel) [#&#8203;62071](nodejs/node#62071)
- \[[`83719ffb64`](nodejs/node@83719ffb64)] - **doc**: correct `util.convertProcessSignalToExitCode` validation behavior (René) [#&#8203;62134](nodejs/node#62134)
- \[[`eeee7c7fb1`](nodejs/node@eeee7c7fb1)] - **doc**: add efekrskl as triager (Efe) [#&#8203;61876](nodejs/node#61876)
- \[[`db150b2e69`](nodejs/node@db150b2e69)] - **doc**: fix markdown for `expectFailure` values (Jacob Smith) [#&#8203;62100](nodejs/node#62100)
- \[[`d55a441e60`](nodejs/node@d55a441e60)] - **doc**: add title to index (Aviv Keller) [#&#8203;62046](nodejs/node#62046)
- \[[`cc46204b48`](nodejs/node@cc46204b48)] - **doc**: include url.resolve() in DEP0169 application deprecation (Mike McCready) [#&#8203;62002](nodejs/node#62002)
- \[[`1d91a7261e`](nodejs/node@1d91a7261e)] - **doc,module**: add missing doc for syncHooks.deregister() (Joyee Cheung) [#&#8203;61959](nodejs/node#61959)
- \[[`5198573bee`](nodejs/node@5198573bee)] - **http**: fix use-after-free when freeParser is called during llhttp\_execute (Gerhard Stöbich) [#&#8203;62095](nodejs/node#62095)
- \[[`f8793f80df`](nodejs/node@f8793f80df)] - **lib**: fix source map url parse in dynamic imports (Chengzhong Wu) [#&#8203;61990](nodejs/node#61990)
- \[[`5439d0e0cf`](nodejs/node@5439d0e0cf)] - **meta**: bump actions/download-artifact from 7.0.0 to 8.0.0 (dependabot\[bot]) [#&#8203;62063](nodejs/node#62063)
- \[[`27fd21943a`](nodejs/node@27fd21943a)] - **meta**: bump actions/upload-artifact from 6.0.0 to 7.0.0 (dependabot\[bot]) [#&#8203;62062](nodejs/node#62062)
- \[[`5b266f3295`](nodejs/node@5b266f3295)] - **meta**: bump step-security/harden-runner from 2.14.2 to 2.15.0 (dependabot\[bot]) [#&#8203;62064](nodejs/node#62064)
- \[[`ea87eea71a`](nodejs/node@ea87eea71a)] - **module**: fix extensionless CJS files in `"type": "module"` packages (Matteo Collina) [#&#8203;62083](nodejs/node#62083)
- \[[`851228cd60`](nodejs/node@851228cd60)] - **sqlite**: handle stmt invalidation (Guilherme Araújo) [#&#8203;61877](nodejs/node#61877)
- \[[`19efe60548`](nodejs/node@19efe60548)] - **src**: expose async context frame debugging helper to JS (Anna Henningsen) [#&#8203;62103](nodejs/node#62103)
- \[[`0257e8072f`](nodejs/node@0257e8072f)] - **src**: make AsyncWrap subclass internal field counts explicit (Anna Henningsen) [#&#8203;62103](nodejs/node#62103)
- \[[`975dafbe3b`](nodejs/node@975dafbe3b)] - **src**: release context frame in AsyncWrap::EmitDestroy (Gerhard Stöbich) [#&#8203;61995](nodejs/node#61995)
- \[[`f2c08c7888`](nodejs/node@f2c08c7888)] - **src**: use validate\_ascii\_with\_errors instead of validate\_ascii (Сковорода Никита Андреевич) [#&#8203;61122](nodejs/node#61122)
- \[[`0278461d83`](nodejs/node@0278461d83)] - **stream**: optimize webstreams pipeTo (Mattias Buelens) [#&#8203;62079](nodejs/node#62079)
- \[[`4d62e95bfa`](nodejs/node@4d62e95bfa)] - **stream**: fix brotli error handling in web compression streams (Filip Skokan) [#&#8203;62107](nodejs/node#62107)
- \[[`4bdcaf2865`](nodejs/node@4bdcaf2865)] - **stream**: improve Web Compression spec compliance (Filip Skokan) [#&#8203;62107](nodejs/node#62107)
- \[[`a5b1be2045`](nodejs/node@a5b1be2045)] - **stream**: fix UTF-8 character corruption in fast-utf8-stream (Matteo Collina) [#&#8203;61745](nodejs/node#61745)
- \[[`5632446c4e`](nodejs/node@5632446c4e)] - **stream**: fix TransformStream race on cancel with pending write (Marco) [#&#8203;62040](nodejs/node#62040)
- \[[`f90fa9cd1a`](nodejs/node@f90fa9cd1a)] - **stream**: accept ArrayBuffer in CompressionStream and DecompressionStream (조수민) [#&#8203;61913](nodejs/node#61913)
- \[[`00319eaa3a`](nodejs/node@00319eaa3a)] - **test**: update WPT for url to [`c928b19`](nodejs/node@c928b19ab0) (Node.js GitHub Bot) [#&#8203;62148](nodejs/node#62148)
- \[[`456abc7d20`](nodejs/node@456abc7d20)] - **test**: update WPT for WebCryptoAPI to [`c9e9558`](nodejs/node@c9e955840a) (Node.js GitHub Bot) [#&#8203;62147](nodejs/node#62147)
- \[[`82770cb7d3`](nodejs/node@82770cb7d3)] - **test**: improve WPT report runner (Filip Skokan) [#&#8203;62107](nodejs/node#62107)
- \[[`cfc847d233`](nodejs/node@cfc847d233)] - **test**: update WPT compression to [`ae05f5c`](nodejs/node@ae05f5cb53) (Filip Skokan) [#&#8203;62107](nodejs/node#62107)
- \[[`80f78f2737`](nodejs/node@80f78f2737)] - **test**: update WPT for WebCryptoAPI to [`42e4732`](nodejs/node@42e47329fd) (Node.js GitHub Bot) [#&#8203;62048](nodejs/node#62048)
- \[[`8048e0508c`](nodejs/node@8048e0508c)] - **test**: fix skipping behavior for `test-runner-run-files-undefined` (Antoine du Hamel) [#&#8203;62026](nodejs/node#62026)
- \[[`699a6214c6`](nodejs/node@699a6214c6)] - **tools**: revert timezone update GHA workflow to ubuntu-latest (Richard Lau) [#&#8203;62140](nodejs/node#62140)
- \[[`1a453b550c`](nodejs/node@1a453b550c)] - **tools**: improve error handling in test426 update script (Rich Trott) [#&#8203;62121](nodejs/node#62121)
- \[[`710dde5ee2`](nodejs/node@710dde5ee2)] - **tools**: fix `--node-builtin-modules-path` value in `shell.nix` (Antoine du Hamel) [#&#8203;62102](nodejs/node#62102)
- \[[`dcb1cbb21f`](nodejs/node@dcb1cbb21f)] - **tools**: bump the eslint group across 1 directory with 2 updates (dependabot\[bot]) [#&#8203;62092](nodejs/node#62092)
- \[[`7d0b758583`](nodejs/node@7d0b758583)] - **tools**: fix daily wpt workflow nighly release version lookup (Filip Skokan) [#&#8203;62076](nodejs/node#62076)
- \[[`3e8c816f2e`](nodejs/node@3e8c816f2e)] - **tools**: fix example in release proposal linter (Richard Lau) [#&#8203;62074](nodejs/node#62074)
- \[[`772d3d270d`](nodejs/node@772d3d270d)] - **tools**: bump minimatch from 3.1.3 to 3.1.5 in /tools/clang-format (dependabot\[bot]) [#&#8203;62013](nodejs/node#62013)
- \[[`92f3b42672`](nodejs/node@92f3b42672)] - **tools**: bump eslint to v10, babel to v8.0.0-rc.2 (Huáng Jùnliàng) [#&#8203;61905](nodejs/node#61905)
- \[[`deead95ec5`](nodejs/node@deead95ec5)] - **url**: suppress warnings from url.format/url.resolve inside node\_modules (René) [#&#8203;62005](nodejs/node#62005)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42MS43IiwidXBkYXRlZEluVmVyIjoiNDMuNjEuNyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90IiwiYXV0b21hdGlvbjpib3QtYXV0aG9yZWQiLCJkZXBlbmRlbmN5LXR5cGU6OnBhdGNoIl19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. doc Issues and PRs related to the documentations. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. url Issues and PRs related to the legacy built-in url module.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DEP0169 DeprecationWarning: url.parse() when url.resolve() used (non node_modules) >=v24.0.0

7 participants