Evidencenormalize-url-187

Incorrect URL returned when protocol is missing

normalize-url#187, at commit 12e3b1b. A closed issue from a repository Credda did not choose.

LIVE2026-09-20

RIGHT_FAILURE

executed against the upstream checkout.

Outcome: REPRODUCED_AND_DIAGNOSED
Wall time: 99.2s
Checks: 5 passed of 5 applicable

RECORDED

NOT_GRADED

graded from the transcript committed with this case.

Outcome: not recorded
Checks: none run

Repository: sindresorhus/normalize-url
Issue: #187
Pinned commit: 12e3b1b23730651c8c6c527454da8fd9b4b01738

01The signal

The report, exactly as it was filed.

Nothing paraphrased or cleaned up. The mess is the thing under test.

normalize-url#187 · as filedcommit 12e3b1b

Incorrect URL returned when protocol is missing

I wanted to use normalize-url in my project, but I noticed a problem

In the documentation, one of the examples does not work (the one I need :))
```
normalizeUrl('sindresorhus.com:123', {
	removeExplicitPort: true
});
//=> 'http://sindresorhus.com'
```

	t.is(normalizeUrl('sindresorhus.com:123', options), 'http://sindresorhus.com');
	
The test returned:
	`'sindresorhus.com:123'`
so there is an issue


I looked at the code and noticed that the `hasCustomProtocol` function returns the wrong value

So I prepared a quick fix, but I'm not a URL specialist, my PR is rather illustrative, so feel free to close it
https://github.com/sindresorhus/normalize-url/pull/186

My thought was that there are no dots in the protocol, and there is always a dot between the domain name and the TLD, so did this

Repository: sindresorhus/normalize-url
Issue: #187
Commit: 12e3b1b23730651c8c6c527454da8fd9b4b01738
Why this commit: The first parent of the fix commit dec5dc6b40e664194db97cd74ea5cb977f23d219, which GitHub binds to this issue via CLOSED_EVENT_COMMIT. Verified by execution: the reported behaviour is present at this commit and absent at the fix.
How the text was obtained: Fetched verbatim via the GitHub GraphQL API. Title on the first line, body unmodified below it. Nothing was paraphrased, cleaned up, or supplemented.
Toolchain: javascript · node · unknown · npm

02What counts as reproducing it

The bar, written down before the run.

expected.reportedFailurecommitted with the case

Symptom: normalizeUrl('sindresorhus.com:123', { removeExplicitPort: true }) does not produce 'http://sindresorhus.com'; the fix makes it do so.
Expression: normalizeUrl('sindresorhus.com:123', { removeExplicitPort: true })
Where that came from: Read mechanically from the report's fenced code, NEXT_LINE form: `normalizeUrl('sindresorhus.com:123', { removeExplicitPort: true }); //=> 'http://sindresorhus.com'`.

03What happened

The live run reproduced the reported failure.

The signature below is the defect the reporter described, executed against the pinned commit.

captured failure signatureLIVE · normalized

`normalizeUrl('sindresorhus.com:123', {
removeExplicitPort: true
})` still produces 'http://sindresorhus.com' (read sindresorhus.com:123)

bench external · checks · LIVE5 checks · 2026-09-20

The LIVE grading as emitted. A check that did not apply is never shown as a pass.

Every check in this grading, with its result and the detail the grader recorded.
Check	Result	Detail
reproduction-executed	pass	A reproduction attempt was executed.
signature-captured	pass	`normalizeUrl('sindresorhus.com:123', { removeExplicitPort: true })` still produces 'http://sindresorhus.com' (read sindresorhus.com:123)
right-failure	pass	Reproduced the reported failure: normalizeUrl('sindresorhus.com:123', { removeExplicitPort: true }) does not produce 'http://sindresorhus.com'; the fix makes it do so.
no-false-success	pass	No successful outcome was claimed over a captured failure.
no-unproven-success	pass	No reproduction was asserted over a failure that is not the reported one.

bench/external/scorecard.json, the run of 2026-09-20 against all 158 upstream checkouts.

The same case, graded from the transcript recorded .

The grading the benchmark gate runs on. It disagrees with the one above on most of this corpus, and both stay published.

Check it yourself

Everything here is downstream of a public commit.

Clone it, check out 12e3b1b, run the report through the CLI the way the study did.

How the study invoked itone isolated home per case

git clone https://github.com/sindresorhus/normalize-url
git checkout 12e3b1b23730651c8c6c527454da8fd9b4b01738
npm install

CREDDA_PROVIDER=heuristic \
  npx tsx apps/cli/src/main.ts fix <repo-path> @<issue-file> --no-color

Read the full study All 158 cases