DEP0169: vendored @mapbox/node-pre-gyp calls url.resolve() / url.parse() — deprecated in Node 24

[m-ilchuk]

Issue

muhammara bundles its own copy of @mapbox/node-pre-gyp@2.0.x which calls the deprecated
url.resolve() API at module load time (lib/util/versioning.js). In Node 24, this emits
a DEP0169 deprecation warning on every process startup:

(node:7) [DEP0169] DeprecationWarning: url.parse() behavior is not standardized
and prone to errors with potential security implications. Use the WHATWG URL API instead.

Stack trace:
at urlParse (node:url:136:13)
at Object.urlResolve [as resolve] (node:url:725:10)
at Object.module.exports.evaluate
(.../muhammara/node_modules/@mapbox/node-pre-gyp/lib/util/versioning.js:338)
at Object.exports.find
(.../muhammara/node_modules/@mapbox/node-pre-gyp/lib/pre-binding.js:32)
at Object. (.../muhammara/lib/muhammara.js:3)

Root Cause

versioning.js uses url.resolve() to build the binary download URL:

opts.hosted_path = url.resolve(opts.host, opts.remote_path);                                 
opts.hosted_tarball = url.resolve(opts.hosted_path, opts.package_name);                      

url.resolve() calls url.parse() internally, deprecated in Node 24 (DEP0169).
No published version of @mapbox/node-pre-gyp has fixed this yet.

Suggested Fix

Replace url.resolve(from, to) with the WHATWG equivalent:

opts.hosted_path = new URL(opts.remote_path, opts.host).href;                                
opts.hosted_tarball = new URL(opts.package_name, opts.hosted_path).href;                     

Same for the url.parse() call at versioning.js:224:

// before                                                                                    
const protocol = url.parse(o.host).protocol;                                                 
// after                                                                                     
const protocol = new URL(o.host).protocol;                                                   

Environment

• Node.js: v24.x
• muhammara: 6.0.4
• @mapbox/node-pre-gyp (vendored): 2.0.3

[m-ilchuk]

Upstream PR that fixes this issue in @mapbox/node-pre-gyp mapbox/node-pre-gyp#945

[julianhille]

oh there is a new versoin of pre gyp? thanks for bringing this to attention. will take care with v7