DEP0169 DeprecationWarning: url.parse() when url.resolve() used

[MikeMcC399]

Version

v25.4.0 - v25.6.0

Platform

Linux ubuntu-24.04 6.17.0-14-generic #14~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Jan 15 15:52:10 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

url

What steps will reproduce the bug?

Run example from Legacy URL API url.resolve(from, to)

const url = require('node:url');
url.resolve('/one/two/three', 'four');         // '/one/two/four'
url.resolve('http://example.com/', '/one');    // 'http://example.com/one'
url.resolve('http://example.com/one', '/two'); // 'http://example.com/two'

How often does it reproduce? Is there a required condition?

For the above steps, it always reproduces in Node.js 25.4.0 - 25.6.0. It is a regression from Node.js 25.3.0.

If the url.resolve() call is embedded in an npm package, it depends how the corresponding module is called, whether or not a deprecation warning appears. See the additional information section below for examples.

What is the expected behavior? Why is that the expected behavior?

The example with only url.resolve() should run without producing a deprecation warning.

The history section of url.resolve(from, to) states that the deprecation was revoked in v15.13.0, v14.17.0 and there is no entry for any higher version.

DEP0169 lists url.parse() explicitly. It does not include any direct reference to url.resolve().

What do you see instead?

$ node url-resolve.js
(node:5802) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)

Additional information

I originally noticed this with Cypress, on Ubuntu 24.04.3 LTS, Node.js 25.6.0, with steps to reproduce:

cd $(mktemp -d)
npm install cypress
npx cypress install --force

where the call is from /node_modules/cypress/dist/tasks/download.js.

The following steps however do NOT cause any deprecation warning, even though download is also run:

rm -rf ~/.cache/Cypress
cd $(mktemp -d)
npm install cypress

[Renegade334]

url.resolve(from, to) is essentially url.parse(from).resolve(url.parse(to)) so this falls under DEP0169, similar to url.format(string).

Not sure there's anything to do but mark it as indirectly deprecated as well. url.resolve() does silently accept Url object arguments, but since the only useful way to get one is from url.parse(), it doesn't really seem worth documenting.

[MikeMcC399]

@Renegade334

Thanks for pointing out the relationship!

It seems that the change in behavior may have been caused by #60991 in 25.4.0

For Node.js <25.4.0 in Cypress, using the npm module cypress, no DEP0169 was emitted, and my understanding of the code both before and after #60991 is that there should be no deprecation warning if the call comes from a node_modules location.

I see that #60991 is planned for backporting in #61661 for 24.13.1 so this may cause an increase in the number of users seeing similar displays of DEP0169 if it is merged including this PR.

At the moment it does not look like this is a documentation issue from my perspective. It seems more like an unintended change where some situations needing the DEP0169 warning suppressed are actually allowing it to warn when it should not be warning.

---

Whatever the outcome here, I will still bring this up as an issue in the cypress repo, as it should be possible to migrate their download.ts module to use the WHATWG URL API instead of the Legacy URL API.