From d3e3360d6e4e5d4d9394ae5c848c619bcd374293 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Sat, 15 Aug 2026 19:41:37 +0200
Subject: [PATCH] Remove deprecated url.parse() usage from the custom server

Node flags legacy url.parse() (DEP0169) as having security implications
and recommends the WHATWG URL API instead. The main request handler's
parsedUrl argument to Next's handle() is optional and unused by us, so
that call is dropped entirely (matching Next's own minimal custom-server
example); the WS upgrade path-check now uses `new URL()` instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 app/server.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/app/server.ts b/app/server.ts
index 4935f0b..de270ee 100644
--- a/app/server.ts
+++ b/app/server.ts
@@ -1,6 +1,5 @@
 import "./src/bootstrap/async-local-storage-polyfill";
 import { createServer } from "node:http";
-import { parse } from "node:url";
 import next from "next";
 import { WebSocketServer } from "ws";
 import { getConfig } from "./src/lib/config/load";
@@ -25,14 +24,14 @@ const handle = app.getRequestHandler();
 
 app.prepare().then(() => {
   const httpServer = createServer((req, res) => {
-    handle(req, res, parse(req.url ?? "/", true));
+    handle(req, res);
   });
 
   const wss = new WebSocketServer({ noServer: true });
   attachWsServer(wss);
 
   httpServer.on("upgrade", (req, socket, head) => {
-    const { pathname } = parse(req.url ?? "/");
+    const { pathname } = new URL(req.url ?? "/", "http://internal");
     if (pathname !== "/ws/runs") {
       socket.destroy();
       return;