fix: replace deprecated url.parse() with WHATWG URL API

[rit3sh-x]

Summary

Replaces the deprecated Node.js url.parse() with the WHATWG URL API in the parseURL
function, fixing #1747.

Node.js 19.8+ emits [DEP0169] DeprecationWarning because url.parse() is "prone to errors
that have security implications. CVEs are not issued for url.parse() vulnerabilities."

Changes

• lib/utils/index.ts: Rewrote parseURL to use new URL() instead of url.parse()
• Removed import { parse as urllibParse } from "url" (URL is a global)

Property mapping

url.parse()	new URL()	Notes
.auth	.username + .password	decodeURIComponent() for percent-encoded chars
.hostname	.hostname	Direct mapping
.port	.port	Returns '' instead of null (both falsy)
.pathname	.pathname	Same behavior for redis:// scheme
.query	.searchParams	Converted to plain object via forEach
.slashes	N/A	Replaced with regex protocol check + isPath flag

Test results

Suite	Result
Unit tests	119/119 passing
Functional tests (live Redis)	553 passing (2 pre-existing failures unrelated)
Cluster tests (live Redis)	17/17 passing
TypeScript (tsc --noEmit)	0 errors
ESLint	0 errors

Test plan

• All 12 parseURL unit tests pass with identical output
• Passwords with colons (pass:word) handled via decodeURIComponent
• Unix socket paths (/tmp.sock) preserved
• Bare host:port (127.0.0.1:6379) works
• redis:// and rediss:// URLs parse db, auth, host, port correctly
• Query params (family, db, custom keys) merged into result
• Full functional + cluster test suite verified with live Redis via Docker

Closes #1747

---

Note

Medium Risk
Changes Redis connection URL parsing logic, which can subtly affect how hosts, auth, paths, and query params are interpreted across schemes and edge cases. Risk is mitigated by limited scope but could impact connection configuration compatibility.

Overview
Rewrites parseURL in lib/utils/index.ts to use the WHATWG URL API (and removes the deprecated url.parse import), avoiding Node’s [DEP0169] deprecation warning.

The new implementation explicitly distinguishes protocol URLs vs bare host:port vs unix-socket paths, rebuilds query options from searchParams, decodes username/password, and normalizes host parsing (including bracketed IPv6) before merging options into the returned result.

^{Written by Cursor Bugbot for commit 7283f45. This will update automatically on new commits. Configure here.}

[jit-ci]

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[rit3sh-x]

Updated with IPv6 fix: new URL().hostname returns bracketed IPv6
addresses (e.g. [::1]) which breaks net.connect() since net.isIP('[::1]') returns 0. Added
.replace(/^\[|\]$/g, '') to strip brackets and restore compatibility with the old url.parse() behavior.

[PavelPashov]

This seems to be a duplicate of #2081

[rit3sh-x]

Thanks for pointing that out!

I’ll take a look at the PR. If my changes overlap, I’m happy to close this and contribute there let me know what you’d prefer.