isURL() does not respect require_tld: true when validating http://localhost

[hbakhtiyor]

version: 7.1.0

i also set require_tld to true, neither work

> const isURL = require('validator').isURL;
undefined
> isURL('http://localhost', { protocols: ['http', 'https'], require_protocol: true });
true
> isURL('http://localhost', { protocols: ['http', 'https'], require_protocol: true, require_tld: true });
true

[hbakhtiyor]

any updates?

[chriso]

localhost is currently whitelisted as a valid hostname: https://github.com/chriso/validator.js/blob/c5037eff17a5a8884959eeac6689264333450af0/src/lib/isURL.js#L103. The whitelisting predates the require_tld option.

[hbakhtiyor]

how to add it to blacklist?

[chriso]

This is fixed in an upcoming release.