url: suppress warnings from url.format/url.resolve inside node_modules

Renegade334 · aduh95 · commit 8357ebfe54d7 · 2026-04-10T15:54:18.000+02:00
PR-URL: #62005 Fixes: #61724 Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
diff --git a/lib/url.js b/lib/url.js
@@ -131,7 +131,7 @@ const {
 let urlParseWarned = false;
 
 function urlParse(url, parseQueryString, slashesDenoteHost) {
-  if (!urlParseWarned && !isInsideNodeModules(2)) {
+  if (!urlParseWarned && !isInsideNodeModules(4)) {
     urlParseWarned = true;
     process.emitWarning(
       '`url.parse()` behavior is not standardized and prone to ' +
diff --git a/test/fixtures/node_modules/url-deprecations.js b/test/fixtures/node_modules/url-deprecations.js
diff --git a/test/parallel/test-url-parse-deprecation.js b/test/parallel/test-url-parse-deprecation.js
@@ -0,0 +1,23 @@
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+
+const assert = require('assert');
+const url = require('url');
+
+const fixturePath = fixtures.path('node_modules', 'url-deprecations.js');
+
+// Application deprecation for url.parse()
+url.parse('foo');
+common.expectWarning('DeprecationWarning',
+                     [/`url\.parse\(\)` behavior is not standardized/, 'DEP0169']);
+
+// No warnings from inside node_modules
+common.spawnPromisified(process.execPath, [fixturePath]).then(
+  common.mustCall(({ code, signal, stderr }) => {
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+    assert.doesNotMatch(stderr, /\[DEP0169\]/);
+  })
+);
diff --git a/test/parallel/test-url-parse-invalid-input.js b/test/parallel/test-url-parse-invalid-input.js
@@ -89,14 +89,6 @@ if (common.hasIntl) {
       }));
   });
 
-  // Warning should only happen once per process.
-  common.expectWarning({
-    DeprecationWarning: {
-      // eslint-disable-next-line @stylistic/js/max-len
-      DEP0169: '`url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.',
-      DEP0170: `The URL ${badURLs[0]} is invalid. Future versions of Node.js will throw an error.`,
-    },
-  });
   badURLs.forEach((badURL) => {
     url.parse(badURL);
   });
