chore(deps): bump react-native-url-polyfill from 3.0.0 to 4.0.0

[dependabot]

Bumps react-native-url-polyfill from 3.0.0 to 4.0.0.

Release notes

Sourced from react-native-url-polyfill's releases.

v4.0.0

v4 replaces the whatwg-url-without-unicode dependency with a purpose-built, dependency-free implementation of the WHATWG URL Standard.

The result is a polyfill that is substantially smaller and faster on Hermes, with stronger standards compliance and test coverage.

65% Smaller

Measured in a production Metro bundle with React Native 0.86.0:

Version	Bundle impact
v3.0.0	73.02 kB
v4.0.0	25.50 kB

That is 47.52 kB less, a 65.1% reduction in added bundle size.

Faster Than v3 on Hermes

Using the standalone Hermes runtime from React Native 0.81.4, v4 was faster than v3's whatwg-url-without-unicode implementation in every comparable workload.

Operation	Improvement
Absolute URL construction	3.60x faster
Relative URL construction	3.28x faster
Percent-encoded URL construction	3.72x faster
URL property getters	2.71x faster
URL setters	3.34x faster
URLSearchParams parsing	7.82x faster
URLSearchParams stringification	2.43x faster
URLSearchParams manipulation	5.52x faster
Repeated URLSearchParams mutation	1.43x faster
URL/search params roundtrip	4.46x faster
Repeated attached searchParams.append()	~259x faster

Most comparable workloads improved by 2.4x to 7.8x.

Faster Than Expo on Hermes

v4 was also faster than Expo's whatwg-url-minimum@0.1.2 implementation in 13 of 14 workloads.

Operation	Improvement
Absolute URL construction	2.31x faster
Relative URL construction	2.14x faster
URL.canParse() with valid input	2.20x faster
URL.parse()	2.25x faster
Percent-encoded URL construction	1.81x faster
URL setters	1.98x faster
URLSearchParams parsing	2.08x faster
URL/search params roundtrip	1.69x faster

... (truncated)

Commits

• 4598e48 Add standalone Hermes benchmark runner (#509)
• caabf0d Fix pre-release package contents and types (#508)
• 52fa9b4 Harden URL WebIDL conformance (#507)
• 9e40bd3 Optimize URLSearchParams mutations and benchmarks (#506)
• 3981bc4 Optimize URL.canParse and normalized parsing (#505)
• ae105bd Optimize UTF-8 percent encoding (#504)
• d60c266 Optimize attached URLSearchParams appends (#503)
• 24562c9 Optimize repeated URLSearchParams mutations (#502)
• 9844b1c Optimize ASCII parser classification (#499)
• 6d135b3 Harden URL conformance with official WPT and Hermes coverage (#501)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drafto	Ready	Preview	Aug 10, 2026 10:09pm

[JakubAnderwald]

Nightly bot: major version bump — flagged for manual review (not auto-merged).

CI is fully green (9/9), but this is a major bump, so it took the analysis path rather than auto-merge.

Package

react-native-url-polyfill: 3.0.0 → 4.0.0 — declared in apps/desktop/package.json only.

Headline finding: this dependency is never imported

react-native-url-polyfill has zero import sites in the repo (searched apps/, packages/, scripts/ for all JS/TS extensions), and no other package depends on it transitively — in pnpm-lock.yaml it appears only as a direct dependency of the apps/desktop importer.

The desktop entry point apps/desktop/index.js:1 imports @/lib/url-polyfill — a local, hand-rolled polyfill at apps/desktop/src/lib/url-polyfill.ts, not this package. That file exists precisely because the npm polyfill did not address the two Hermes issues it documents (URL.protocol read-only, and trailing slashes PostgREST rejects). It patches globalThis.URL itself.

So the upgrade is inert: no code path changes.

Breaking changes relevant to this codebase

None. v4 rewrites the internals — whatwg-url-without-unicode is dropped for a dependency-free WHATWG implementation (65% smaller, 2.4–7.8x faster on Hermes) — but the release notes confirm the documented surface is unchanged:

The documented URL, URLSearchParams, setupURLPolyfill(), and react-native-url-polyfill/auto APIs remain available.

There is no "Breaking Changes" section in the v4.0.0 notes. The one caveat — "Applications relying on undocumented quirks of the previous whatwg-url-based implementation should verify their URL handling after upgrading" — cannot bite us, since nothing imports the package.

Breaking changes NOT relevant

• Rewritten URL/URLSearchParams parsing and percent-encoding behaviour — unused.
• Dropped transitive whatwg-url-without-unicode@8.0.0-3 / webidl-conversions@5.0.0 — unused; the lockfile simply removes them.
• Stricter WebIDL conformance (upstream chore(web): extract note mutation handlers into use-note-actions hook #507) — unused.

Peer dependency impacts

None. The peer range is unchanged at react-native: '*' in both 3.0.0 and 4.0.0. No cascading updates required. Unrelated incidental lockfile churn: electron-to-chromium 1.5.389 → 1.5.392 and a @babel/core peer-key reshuffle on next/@sentry/nextjs.

Desktop fossil note

Merging does not touch the shipped desktop app. Per ADR-0027 the primary checkout's node_modules is a fossil that is never reinstalled — verified still intact: React 19.1.4, react-native-macos 0.81.6, react-native-url-polyfill 3.0.0. It will stay at 3.0.0 after merge, while package.json claims ^4.0.0. That drift is harmless here (nothing imports it) and is the same drift the fossil already carries by design for React.

Recommendation

Safe to merge. Zero runtime risk on every platform: the package is unimported, and desktop ships from the fossil regardless. CI is green.

Suggested follow-up (separate PR): delete react-native-url-polyfill from apps/desktop/package.json outright. It is dead weight that will keep generating Dependabot noise, and the local src/lib/url-polyfill.ts is what actually runs. Worth a brief check first that it was not left in deliberately as a load-bearing-by-accident install.

Flagged per nightly policy: major bumps are never auto-merged.