feat: replace deprecated url.resolve() and url.parse() with WHATWG URL

[dianager]

Pre-Submission Checklist

• Opened an issue discussing these changes before opening the PR
• Ran the linter and tests via make prepush
• Included comprehensive and convincing tests for changes

Issues

Closes:

• Issue #
• Issue #
• Issue #

Summarize the issues that discussed these changes

Changes

Deprecated API Fixes

• url.parse() / url.resolve() — removed in Node.js 24.
• req.getUrl() now returns a WHATWG URL (semver-major)

Breaking changes

1. req.getUrl() shape changed — no longer a legacy url.parse() object. .query, .path, .auth, .slashes are gone (silently undefined, no error). Use .searchParams, .pathname + .search, .username/.password instead. Note .auth/.slashes were already unreliable on the old object for normal (origin-form) requests, so this mainly affects .query/.path consumers. Also: .port/.host no longer include an explicitly-sent default port (:80/:443) the way url.parse() did.
2. req.href()/getHref() is now absolute, not relative (e.g. http://host/foo?a=1 instead of /foo?a=1).
3. Breaks any code comparing it to a relative path. This also changes the base value used internally by res.redirect(), which was rewritten to build the Location header via URL/URLSearchParams instead of url.format/mergeQs — behavior is preserved (see new redirect tests) but the implementation is new.
4. req.path()/getPath() now normalizes the path — collapses ..//./ segments (converting \ to / was already the case pre-migration, not new). A literal /foo/../bar now returns /bar. This changes what lib/plugins/static.js sees, since it builds file paths via decodeURIComponent(req.path()) — normalization now runs before decoding, changing traversal-resistance characteristics for that plugin (likely a hardening, but currently untested; worth a dedicated test before relying on it).
5. Malformed Host header can now throw a TypeError during routing (previously it never mattered for relative URLs). A missing Host header does not throw — it falls back to localhost. Highest-severity item — recommend adding Host-header validation middleware before upgrading.
6. OPTIONS * requests: req.getUrl().pathname now returns /* instead of * (a bare * can't be represented as a URL). Anything checking req.getUrl().pathname === '*' should switch to req.url === '*'.

Also changed (adjacent cleanup)

• req.isSecure() now reads this.socket.encrypted instead of this.connection.encrypted (same swap in audit.js/throttle.js). Not URL-parsing related, but feeds into getUrl()'s protocol resolution — tests/code that stub req.connection instead of req.socket will silently misbehave.

Action for consumers: grep for .getUrl(, .href(, .getHref(, .path(, .getPath(, .query(, .getQuery( ; update stale url.Url type declarations to URL; add Host-header validation; re-run tests (this tends to surface as silently wrong values, not crashes).