[hakarrr]

Edit: removed Fixes: https://github.com/nodejs/node/issues/67345

Web IDL converts an assigned value to the attribute's type before the setter steps run. The URL component setters passed this.#context.href as the first argument to bindingUrl.update(), so it was evaluated before the assigned value's string conversion. A toString() that mutates the URL during conversion therefore had its effects overwritten by the stale href captured beforehand:

const url = new URL('https://before.example/old');
url.pathname = {
  toString() {
    url.href = 'https://after.example/base';
    return '/new';
  },
};
// before: https://before.example/new
// after:  https://after.example/new

The change hoists the conversion above the href read in the protocol, username, password, host, hostname, port, pathname, search and hash setters, matching the existing href setter, which already converts first.

Adds test/parallel/test-whatwg-url-setters-coercion-order.js covering all nine setters (WPT's setters_tests.json has no mutation-during-conversion cases).

Local verification: the new test fails on the unpatched code (all nine setters) and passes with the fix; I additionally ran a differential check of 25 ordinary URL operations (assignments, port edge cases, URLSearchParams sync, percent-encoding) with identical outputs before and after the change. Note my sandbox can't build Node, so I verified the patched lib/internal/url.js by loading it through --expose-internals on v22.23.4 against the real ada binding - CI should confirm on a full build.

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes - sandbox here can't build Node; new test verified via the --expose-internals route described above, CI run appreciated
• tests and/or benchmarks are included
• documentation is changed or added (not user-facing-documented behavior beyond WHATWG spec compliance)
• commit message follows commit guidelines

[nodejs-github-bot]

Review requested:

• @nodejs/url

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

[MikeMcC399]

See Commit message guidelines according to the Pull requests documentation.

Your commit must contain the Signed-off-by line with your name and email address as an acknowledgement that you agree to the Developer Certificate of Origin.

This is repeated also in AGENTS.md where it says:

• All commits must be signed off by the human user using Signed-off-by: Your Name <your@email.example>
  as an attestation to the Developer Certificate of Origin.
• AI-assistance must be acknowledged using the Assisted-by: <agent name> annotation.
• AI-authored code contributions must be compatible with the project's licensing and
  contribution guidelines.

[MikeMcC399]

Note my sandbox can't build Node, so I verified the patched lib/internal/url.js by loading it through --expose-internals on v22.23.4 against the real ada binding - CI should confirm on a full build.

PRs are required to be fully tested before submission:

See Pull requests > Step 6: Test

Before submitting your changes in a pull request, always run the full Node.js test suite.