Update encodeurl to v2

[wojtekmaj]

You may or may not be aware, but I just thought I'd let you know, that it appears this package is the only package in [email protected] dependency tree that pulls in encodeurl v1. Updating the dependency here would be very welcome as it would remove duplicated dependency from dependency tree.

[wesleytodd]

I think our goal was to fully deprecate that package, so yeah good catch. @blakeembrey that was the plan right? So many moving pieces here I am not sure I remember if our decision on this was finalized.

[blakeembrey]

It's not being deprecated, it should probably be updated. Version 2 changed the escape characters to ensure it aligned closer to the URL spec. I do reference it as a useful library for path-to-regexp.

However, if you trust URLs are already encoded correctly, you could remove the dependency.

[blakeembrey]

The dependency is used here:

finalhandler/index.js

Line 115 in 42a0a2a

msg = 'Cannot ' + req.method + ' ' + encodeUrl(getResourceName(req))

I don't actually think it's necessary and can be removed. The pathname would already be encoded if grabbing it from the request 🤷