url: runtime deprecate url.parse

Author: anonrig

doc/api/deprecations.md

@@ -3441,6 +3441,10 @@ Node-API callbacks.
 
 <!-- YAML
 changes:
+  - version:
+      - REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/55017
+    description: Runtime deprecation.
   - version:
       - v19.9.0
       - v18.17.0
@@ -3453,7 +3457,7 @@ changes:
     description: Documentation-only deprecation.
 -->
 
-Type: Documentation-only (supports [`--pending-deprecation`][])
+Type: Runtime
 
 [`url.parse()`][] behavior is not standardized and prone to errors that
 have security implications. Use the [WHATWG URL API][] instead. CVEs are not

lib/url.js

@@ -45,7 +45,7 @@ const {
 
 // This ensures setURLConstructor() is called before the native
 // URL::ToObject() method is used.
-const { spliceOne } = require('internal/util');
+const { spliceOne, deprecate } = require('internal/util');
 
 // WHATWG URL implementation provided by internal/url
 const {
@@ -63,8 +63,6 @@ const {
 
 const bindingUrl = internalBinding('url');
 
-const { getOptionValue } = require('internal/options');
-
 // Original url.parse() API
 
 function Url() {
@@ -122,20 +120,7 @@ const {
   CHAR_COLON,
 } = require('internal/constants');
 
-let urlParseWarned = false;
-
 function urlParse(url, parseQueryString, slashesDenoteHost) {
-  if (!urlParseWarned && getOptionValue('--pending-deprecation')) {
-    urlParseWarned = true;
-    process.emitWarning(
-      '`url.parse()` behavior is not standardized and prone to ' +
-      'errors that have security implications. Use the WHATWG URL API ' +
-      'instead. CVEs are not issued for `url.parse()` vulnerabilities.',
-      'DeprecationWarning',
-      'DEP0169',
-    );
-  }
-
   if (url instanceof Url) return url;
 
   const urlObject = new Url();
@@ -1023,7 +1008,11 @@ function pathToFileURL(path, options) {
 module.exports = {
   // Original API
   Url,
-  parse: urlParse,
+  parse: deprecate(
+    urlParse,
+    'url.parse() is deprecated and the behavior is prone to ' +
+    'errors that have security implications. Use new URL() instead.',
+    'DEP0169'),
   resolve: urlResolve,
   resolveObject: urlResolveObject,
   format: urlFormat,