[GHSA-pv4c-p2j5-38j4] Open Redirect in url-parse

[ljharb]

Updates

• Affected products

Comments
Following up on #6697, turns out none of the v0 versions are affected.

• v0.0.x: Uses Node.js built-in url.parse which handles trailing colons correctly
• v0.1.x - v0.2.x: Uses a monolithic regex where the port pattern (?::([0-9]+))? makes the entire :port group optional, so when there's no port number, the colon is not consumed into the hostname

The vulnerability only affects v1.0.0 and later, where the rules array approach processes the port separately after setting the host, and the /:(\d+)$/ pattern requires at least one digit, leaving the trailing colon in the hostname when no digits follow.

[Copilot]

Pull request overview

This PR updates the security advisory GHSA-pv4c-p2j5-38j4 for the url-parse npm package to correct the version range affected by an Open Redirect vulnerability. Based on deeper analysis following PR #6697, the vulnerability was determined to only affect versions starting from 1.0.0, not 0.1.0 as previously recorded. Versions 0.0.x through 0.2.x use different parsing mechanisms that handle URLs correctly.

Changes:

• Updated the "introduced" version from "0.1.0" to "1.0.0" to accurately reflect that only versions 1.0.0 through 1.4.2 are vulnerable
• Updated the "modified" timestamp to reflect the current modification time

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The reference URL at line 61 comparing versions 0.0.4...0.1.0 is now misleading after changing the introduced version to 1.0.0. According to the PR description, versions 0.1.x through 0.2.x were not vulnerable. This reference should be removed or updated to reflect the actual version where the vulnerability was introduced (1.0.0), or provide context explaining why this comparison is still relevant despite the version change.

[advisory-database]

Hi @ljharb! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!