Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

10.11.0

Which area(s) of pnpm are affected? (leave empty if unsure)

CLI

Link to the code that reproduces this issue or a replay of the bug

https://github.com/jeremybanka/pnpm-url-parse-repro

Reproduction steps

# Clone the reproduction repo
git clone https://github.com/jeremybanka/pnpm-url-parse-repro
cd pnpm-url-parse-repro

# Ensure you have the (as of this writing) current versions of node and pnpm
node -v # 24.0.1
pnpm -v # 10.11.0

# Run the script to reproduce the problem
pnpm will-show-warning

This will show a warning that url.parse() is deprecated and is called in the method fixHomepageField().

Describe the Bug

pnpm ships a bundle containing multiple instances of the deprecated url.parse, leading to frequent warnings when using pnpm install.

Searching the file .../pnpm/10.11.0/dist/pnpm.cjs for the phrase url.parse turns up five results.

To ensure that this warning does not occur when running pnpm install, all uses of url.parse should be removed.

• normalize-package-data@5.0.0/.../fixer.js
  • uses url.parse in fixBugsField() (twice)
  • uses url.parse in fixHomepageField()
  • dependency of pnpm owned by npm
  • though version 7.0.0 is available, it still uses url.parse. Issue here: [CHORE] Node 24 warns of urlParse use in fixHomepageField npm/normalize-package-data#242
    • reading the issue, it seems this package may soon be deprecated anyway...
• @pnpm+npm-package-arg@1.0.0/.../npa.js
  • owned by pnpm
  • uses url.parse in fromURL()
• @pnpm+nopt@0.2.1/.../nopt.js
  • owned by pnpm
  • uses url.parse in validateUrl()

Expected Behavior

No warnings when running pnpm install.

Which Node.js version are you using?

24.0.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response