url: runtime deprecate url.parse

[anonrig]

We documentation-only deprecated URL.parse on v18, almost 2 years ago. Without a runtime deprecation people will continue to use it and be exposed to security flaws. This is a nudge on the direction for a possible EOL in 3-5 years?

cc @nodejs/tsc

[nodejs-github-bot]

Review requested:

• @nodejs/url

[lpinca]

I don't think this is used for new code and there are a lot of unmaintained but perfectly working and safe modules that will be affected by this for no good reason.

[anonrig]

safe modules that will be affected by this for no good reason.

Even in the deprecation note says that it's not recommended and safe to use it. How can it be safe? url.parse() can result in unwanted/unexpected outputs.

[lpinca]

It is perfectly safe when used on trusted and well defined inputs. For example, there is nothing wrong with url.parse() when used to parse URLs returned by a trusted server like the URLs in the Location and Link headers.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.04%. Comparing base (291d90a) to head (0d329fc).
Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #55017   +/-   ##
=======================================
  Coverage   88.04%   88.04%           
=======================================
  Files         652      652           
  Lines      183764   183753   -11     
  Branches    35862    35859    -3     
=======================================
- Hits       161787   161782    -5     
+ Misses      15233    15223   -10     
- Partials     6744     6748    +4     

Files with missing lines	Coverage Δ
lib/url.js	98.83% <100.00%> (+0.94%)	⬆️

... and 27 files with indirect coverage changes

[lemire]

perfectly working and safe modules that will be affected by this for no good reason.

I am neutral here, but can you elaborate what you mean by 'affected'?

[targos]

For example, the mongodb module uses url.parse. It means that potentially all Node.js applications using it will print a warning, annoying many users who are not the ones that should care about it.