diff --git a/Cargo.lock b/Cargo.lock
index a6e359fd2cb..d135c23970f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9185,9 +9185,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.3"
+version = "2.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d157f1b96d14500ffdc1f10ba712e780825526c03d9a49b4d0324b0d9113ada"
+checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
 dependencies = [
  "form_urlencoded",
  "idna",
diff --git a/deny.toml b/deny.toml
index 6e6693bf050..e746aa40155 100644
--- a/deny.toml
+++ b/deny.toml
@@ -12,10 +12,6 @@ feature-depth = 1
 # https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
 [advisories]
 ignore = [
-    # This has been yanked, but upgrading to the next version breaks some WPT tests.
-    # It needs investigation.
-    "url@2.5.3",
-
     # The crate `paste` is no longer maintained.
     "RUSTSEC-2024-0436",
 ]
diff --git a/tests/wpt/meta/url/url-setters-a-area.window.js.ini b/tests/wpt/meta/url/url-setters-a-area.window.js.ini
index 84feec52fd3..ce9ea6bc095 100644
--- a/tests/wpt/meta/url/url-setters-a-area.window.js.ini
+++ b/tests/wpt/meta/url/url-setters-a-area.window.js.ini
@@ -1,5 +1,3 @@
-[url-setters-a-area.window.html?include=javascript]
-
 [url-setters-a-area.window.html?include=mailto]
   [<area>: Setting <mailto:me@example.net>.pathname = '/foo' Cannot-be-a-base don’t have a path]
     expected: FAIL
@@ -26,18 +24,6 @@
 
 
 [url-setters-a-area.window.html?exclude=(file|javascript|mailto)]
-  [<a>: Setting <http://example.net/path>.hostname = 'example.com:8080' : delimiter invalidates entire value]
-    expected: FAIL
-
-  [<area>: Setting <http://example.net/path>.hostname = 'example.com:8080' : delimiter invalidates entire value]
-    expected: FAIL
-
-  [<a>: Setting <http://example.net:8080/path>.hostname = 'example.com:' : delimiter invalidates entire value]
-    expected: FAIL
-
-  [<area>: Setting <http://example.net:8080/path>.hostname = 'example.com:' : delimiter invalidates entire value]
-    expected: FAIL
-
   [<a>: Setting <foo:///some/path>.pathname = '' Non-special URLs with an empty host can have their paths erased]
     expected: FAIL
 
@@ -103,3 +89,21 @@
 
   [<area>: Setting <https://domain.com:3000>.port = '\n\n\t\t']
     expected: FAIL
+
+  [<a>: Setting <non-spec:/>.pathname = '/.//p' Serialize /. in path]
+    expected: FAIL
+
+  [<area>: Setting <non-spec:/>.pathname = '/.//p' Serialize /. in path]
+    expected: FAIL
+
+  [<a>: Setting <non-spec:/>.pathname = '/..//p']
+    expected: FAIL
+
+  [<area>: Setting <non-spec:/>.pathname = '/..//p']
+    expected: FAIL
+
+  [<a>: Setting <non-spec:/>.pathname = '//p']
+    expected: FAIL
+
+  [<area>: Setting <non-spec:/>.pathname = '//p']
+    expected: FAIL
diff --git a/tests/wpt/meta/url/url-setters.any.js.ini b/tests/wpt/meta/url/url-setters.any.js.ini
index 2b3c25ad879..346ca0c0147 100644
--- a/tests/wpt/meta/url/url-setters.any.js.ini
+++ b/tests/wpt/meta/url/url-setters.any.js.ini
@@ -5,12 +5,6 @@
   expected: CRASH
 
 [url-setters.any.html?exclude=(file|javascript|mailto)]
-  [URL: Setting <http://example.net/path>.hostname = 'example.com:8080' : delimiter invalidates entire value]
-    expected: FAIL
-
-  [URL: Setting <http://example.net:8080/path>.hostname = 'example.com:' : delimiter invalidates entire value]
-    expected: FAIL
-
   [URL: Setting <foo:///some/path>.pathname = '' Non-special URLs with an empty host can have their paths erased]
     expected: FAIL
 
@@ -50,8 +44,18 @@
   [URL: Setting <https://domain.com:3000>.port = '\n\n\t\t']
     expected: FAIL
 
+  [URL: Setting <non-spec:/>.pathname = '/.//p' Serialize /. in path]
+    expected: FAIL
+
+  [URL: Setting <non-spec:/>.pathname = '/..//p']
+    expected: FAIL
+
+  [URL: Setting <non-spec:/>.pathname = '//p']
+    expected: FAIL
+
+  [URL: Setting <non-spec:/.//>.pathname = 'p' Drop /. from path]
+    expected: FAIL
 
-[url-setters.any.worker.html?include=javascript]
 
 [url-setters.any.worker.html?include=file]
   [URL: Setting <file://monkey/>.pathname = '\\\\' File URLs and (back)slashes]
@@ -64,17 +68,7 @@
     expected: FAIL
 
 
-[url-setters.any.html?include=javascript]
-
-[url-setters.any.html?include=mailto]
-
 [url-setters.any.worker.html?exclude=(file|javascript|mailto)]
-  [URL: Setting <http://example.net/path>.hostname = 'example.com:8080' : delimiter invalidates entire value]
-    expected: FAIL
-
-  [URL: Setting <http://example.net:8080/path>.hostname = 'example.com:' : delimiter invalidates entire value]
-    expected: FAIL
-
   [URL: Setting <foo:///some/path>.pathname = '' Non-special URLs with an empty host can have their paths erased]
     expected: FAIL
 
@@ -123,8 +117,18 @@
   [URL: Setting <https://domain.com:3000>.port = '\n\n\t\t']
     expected: FAIL
 
+  [URL: Setting <non-spec:/>.pathname = '/.//p' Serialize /. in path]
+    expected: FAIL
+
+  [URL: Setting <non-spec:/>.pathname = '/..//p']
+    expected: FAIL
+
+  [URL: Setting <non-spec:/>.pathname = '//p']
+    expected: FAIL
+
+  [URL: Setting <non-spec:/.//>.pathname = 'p' Drop /. from path]
+    expected: FAIL
 
-[url-setters.any.worker.html?include=mailto]
 
 [url-setters.any.html?include=file]
   [URL: Setting <file://monkey/>.pathname = '\\\\' File URLs and (back)slashes]