URL in bibliography won't hyphenate causing overfull warning

Question

I've provided a MWE below. I'm trying to hyphenate the URL in bibliography page however solutions given from multiple google searches lead me to nothing. So here I am asking for help. Thank you in advance. If it helps, I use latexmk with -pdflua which basically uses lualatex to make the my tex file and used biber for the bibliography database.

\documentclass{report}
\usepackage[backend=biber,style=apa]{biblatex}
\addbibresource{main.bib}
\usepackage{filecontents}
\usepackage[hyphens]{url}
\begin{filecontents}{main.bib}
@online{mcafee2021,
 title = {2021 Threat Predictions Report},
 url = {https://www.itweb.co.za/content/RgeVDqPYVddvKJN3},
 abstract = {The revelations around the {SUNBURST} campaigns exploiting the {SolarWinds} Orion platform have revealed a new attack vector – the supply chain.},
 titleaddon = {{ITWeb}},
 author = {{McAfee}},
 urldate = {2021-09-17},
 date = {2021-02-01},
 langid = {english},
}
\end{filecontents}
\begin{document}
Yet another test~\parencite{mcafee2021}
\printbibliography{}
\end{document}

Answer 1

It looks like the url package can't cut an url at every character by default (try to add / you will see). The xurl package improved that (it will internally load the url package), allowing cuts everywhere:

It can also be combined with hyperref: just load xurl first.

\documentclass{report}
\usepackage[backend=biber,style=apa]{biblatex}
\addbibresource{main.bib}
\usepackage{filecontents}
\usepackage{xurl}
\begin{filecontents}{main.bib}
@online{mcafee2021,
 title = {2021 Threat Predictions Report},
 url = {https://www.itweb.co.za/content/RgeVDqPYVddvKJN3},
 abstract = {The revelations around the {SUNBURST} campaigns exploiting the {SolarWinds} Orion platform have revealed a new attack vector – the supply chain.},
 titleaddon = {{ITWeb}},
 author = {{McAfee}},
 urldate = {2021-09-17},
 date = {2021-02-01},
 langid = {english},
}
\end{filecontents}
\begin{document}
Yet another test~\parencite{mcafee2021}
\printbibliography{}
\end{document}

You may avoid using xurl by redefining UrlBreaks appropriately, see e.g. this answer.

Answer 2

Since it can be especially hard to linebreak URLs in bibliographies BibLaTeX has some extra features for that, where you can permit linebreaks in some odd places if needed, and tell it how bad it is to break the line at that point. I have used these settings:

% Permit linebreaks in urls at odd places if needed
\setcounter{biburllcpenalty}{9000}
\setcounter{biburlucpenalty}{9000}
\setcounter{biburlnumpenalty}{5000}

If you remove the line \usepackage[hyphen]{url} in your example and add this instead the result will look like this: