Changelog • punycoder

punycoder (development version)

host_normalize() gains three UTS #46 processing flags — check_hyphens, use_std3, and verify_dns_length — each defaulting to TRUE (the strict uts46-nontransitional-std3-v1 profile) and each independently relaxable. These are standard UTS #46 parameters, not a browser mode: CheckBidi and CheckJoiners always apply, and full WHATWG host policy lives upstack. Pass the same flag values to normalization_profile_info() for the matching profile identity.

url_encode(), url_decode(), and parse_url() are deprecated and now emit a .Deprecated() warning on use. They remain exported and fully functional for this release and are scheduled for removal in the next one. These were always best-effort host extraction/rewriting, not RFC 3986 / WHATWG URL parsing; use the rurl package for URL parsing and canonicalization, or pass the host alone to host_normalize() / puny_encode() / puny_decode() for host-only needs.

host_normalize() no longer takes a strict argument. It was inert (always applied the full profile) and reserved for exactly this relaxed variant, which the three explicit flags above now provide.

host_normalize() is now verified against the official Unicode UTS #46 conformance corpus (IdnaTestV2.txt, Unicode 16.0.0). The suite confirms full non-transitional ToASCII conformance, with one documented profile divergence: the trailing FQDN root dot is permitted (strict VerifyDnsLength would reject the empty root label).

CRAN release: 2026-06-16

host_normalize() converts hostnames to their canonical comparison form under a pinned UTS-46 profile (non-transitional, UseSTD3ASCIIRules, CheckHyphens, CheckBidi, CheckJoiners, NFC, DNS length verification), returning lowercase ASCII A-labels or NA for invalid input. The mapping/NFC/validation pipeline is implemented in-tree over vendored Unicode 16.0.0 data, so behavior is independent of whether libidn2 is present.
normalization_profile_info() exposes the machine-readable profile identity (profile, unicode_version, and the profile parameters) for downstream reproducibility keys.

CRAN release: 2026-06-11

First CRAN release.

puny_decode() (and the URL/domain decoders) now bound label length in both strict and non-strict mode. A crafted oversized xn-- label previously drove the fallback decoder into quadratic time with unbounded allocation; oversized labels are now rejected promptly (error in strict mode, NA in non-strict).

Strict decoding now enforces RFC 5891 canonical A-label form: a decoded label must re-encode to itself. Non-canonical encodings (e.g. uppercase payloads) are rejected in strict mode while non-strict decoding stays lenient.
Initial release of punycoder package
Core punycode encoding and decoding functions (puny_encode(), puny_decode())
URL-aware processing functions (url_encode(), url_decode(), parse_url())
Domain validation and utility functions (is_punycode(), is_idn(), validate_domain())
Comprehensive test suite with RFC 3492 compliance testing
High-performance C++ backend with Rcpp
Vectorized operations for bulk processing
Robust error handling and validation
Complete documentation with vignettes