Closes #3118.

url.parse() is deprecated (DEP0169) and emits warnings on every cold start in serverless runtimes. This swaps the two call sites in BaseRequestConfigImpl.buildUrl() for the WHATWG URL constructor, matching the pattern @lahirumaramba used for validator.isURL() in #3061.

Changes

• BaseRequestConfigImpl.buildUrl() returns URL instead of url.UrlWithStringQuery. The method is protected and only used by two subclasses inside the same file, so this is not a public surface change.
• Both branches of buildUrl() now reuse a single new URL(fullUrl) instance instead of allocating one and re-parsing it via url.parse().
• parsed.path is replaced with ${parsed.pathname}${parsed.search} so the request path on the wire stays byte-for-byte identical.
• parsed.port is now string (always) rather than string | null. The existing if (!port) falsy check still picks up the empty case.

Behavior

For valid inputs the request URL is byte-for-byte identical. For malformed inputs the WHATWG parser is stricter than url.parse(): depending on the input shape it may either canonicalize the input differently (urlWithProtocol() always prepends https://, so e.g. //evil.com becomes https://evil.com/) or throw a TypeError. SDK-internal callers normalize their URLs before invoking, so well-formed usage is unaffected.

Out of scope

The transitive callers listed in #3118 (http-proxy-agent, teeny-request/agent-base, faye-websocket, @firebase/database-compat) live in separate repositories and need to be addressed there.

Verification

• npx tsc --noEmit -p . — clean
• npx eslint src/utils/api-request.ts — 0 warnings
• npx mocha test/unit/utils/api-request.spec.ts --require ts-node/register — 199 passing
• npx mocha test/unit/index.spec.ts --require ts-node/register — 6231 passing

No spec changes: existing api-request tests already cover explicit non-default ports (mockHost:8080), POST with entity body, GET path matching, and nock interceptor URL parsing — all of which exercise the changed code paths.