Skip to content

@bugsnag/node fires DeprecationWarning #2713

@weewoo64

Description

@weewoo64

I got the following error (not warning)
@bugsnag/node@8.8.0 uses the deprecated url.parse() API from Node's url module, triggering DEP0169 deprecation warnings at runtime.

When I search for const { parse } = require('url') there are still some usages in the library.

See below for the error report (which is made by AI after debugging for 30 minutes).


The offending code is in @bugsnag/node/dist/bugsnag.js (lines 1634-1647):

var ___require_36 = require("url"),
parse = ___require_36.parse;

// ...

var parsedUrl = parse(url);

This should be replaced with the WHATWG URL API (new URL(url)).

In AWS Lambda environments, Node.js writes deprecation warnings to stderr which gets logged as ERROR level in CloudWatch — creating noise and false alerts in
production monitoring.

Steps to reproduce

  1. Install @bugsnag/js@8.8.1 in a Node.js project
  2. Run the application on Node.js v20+ or v22+
  3. Trigger any Bugsnag notification (e.g. an error report)
  4. Observe DEP0169 deprecation warning in stderr/logs

Environment

  • Bugsnag version: @bugsnag/js@8.8.1 / @bugsnag/node@8.8.0
  • Browser framework version (if any): N/A (server-side)
  • Server framework version (if any): AWS Lambda (SvelteKit SSR)
  • Browser version: N/A
  • Device: N/A
  • Node.js: v22.x (also reproducible on v20.x)

Example code snippet

// Any Node.js application using @bugsnag/js
const Bugsnag = require('@bugsnag/js')

Bugsnag.start({ apiKey: 'YOUR_API_KEY' })

// On any error report, the following warning is emitted:
// [DEP0169] DeprecationWarning: url.parse() behavior is not standardized
// and prone to errors that have security implications.
// Use the WHATWG URL API instead.

{
"timestamp": "2026-03-31T14:50:33.434Z",
"level": "ERROR",
"requestId": "2b86a15c-f553-45d9-b929-62bd9b811215",
"message": "(node:2) [DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications. Use the
WHATWG URL API instead. CVEs are not issued for url.parse() vulnerabilities.\n(Use node --trace-deprecation ... to show where the warning was created)"
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions