node-fetch 2.7.0 emits DEP0169 from parseURL when bundled on Node.js 24 #1913

Summary

node-fetch@2.7.0 calls the legacy url.parse() from parseURL() even after normalizing absolute URLs with new URL(). When the dependency is bundled into application code, Node.js 24 emits DEP0169 during a successful request.

This is a deprecation/logging report, not a claim of an exploitable vulnerability. I understand the WHATWG migration was merged into v3 in #701. Is a v2-compatible backport planned, or should applications whose dependencies still require v2 treat this as an accepted limitation until they can migrate to v3?

Environment

• Node.js 24.18.0, Linux arm64
• node-fetch 2.7.0
• esbuild 0.25.0 for the minimal reproduction
• Also reproduced with Next.js 16.2.10 / Turbopack, through google-auth-library 9.15.1 → gaxios 6.7.1 → node-fetch 2.7.0

Reproduction

In a temporary directory:

npm init -y
npm install node-fetch@2.7.0 esbuild@0.25.0

Save as repro.cjs:

const http = require('node:http');
const fetch = require('node-fetch');

const server = http.createServer((req, res) => {
  res.end('ok');
});
server.listen(0, '127.0.0.1', async () => {
  try {
    const response = await fetch(`http://127.0.0.1:${server.address().port}/`);
    console.log(response.status, await response.text());
  } finally {
    server.close();
  }
});

npx esbuild repro.cjs --bundle --platform=node --target=node24 --outfile=bundle.cjs
node --trace-deprecation bundle.cjs

No Google credentials, external API, or --pending-deprecation flag is needed.

Actual result

The request succeeds (200 ok), with DEP0169 originating from:

urlParse (node:url:136:13)
parseURL (bundle.cjs:...)
new Request (bundle.cjs:...)
fetch (bundle.cjs:...)

The source is src/request.js / lib/index.js, where parseURL() ends with return parse_url(urlStr).

Bundling is relevant because DEP0169 is an application deprecation in Node 24: the call site is now outside node_modules. A direct unbundled import need not emit this warning by default. The standalone bundle also emits the separate DEP0040/punycode warning tracked in #1826/#1797; that is not the subject of this report.

Expected result

A supported way to avoid legacy URL parsing on modern Node.js while preserving the v2 API, or clarification that v3 migration is required and no v2 backport is planned.