PHP author deprecates 2014 http_build_url shim installed nearly 20 million times

A 174-line PHP function written in 2014 as a stopgap has been downloaded nearly 20 million times, and its author has now deprecated it. Jake A. Smith announced the retirement of his http_build_url polyfill in a blog post that reached the Hacker News front page, explaining that modern alternatives have made the shim obsolete and that handing it to a new maintainer would create the kind of supply-chain risk the PHP ecosystem should avoid.

How a stopgap spread

Smith wrote the code while helping upgrade AOL's content management system from PHP 5.2 to 5.3. The upgrade meant dropping version 1 of the pecl_http extension, which provided http_build_url(), a URL-building function the CMS called in dozens of places. Instead of rewriting those call sites, Smith reimplemented the function so it was defined only when the real extension was absent, and published the package on Packagist, figuring it would serve for a year or two until the community settled on something better.

It was not temporary. According to Smith, the package has been installed nearly 20 million times and still accumulates more than 400,000 installs each month. Distribution goes well beyond Composer: WPML, a multilingual WordPress plugin, bundles the polyfill directly and says it runs on over 1.5 million sites, while the idna-convert library depends on it, carrying the code into the SPIP content management system and into Debian and Ubuntu packages. Smith adds that AOL never migrated off the shim, which ran inside the CMS until the platform was shut down around 2020.

A stalled handover and a lurking bug

Smith drifted away from PHP years ago. In 2021, surprised by the download numbers, he asked for a new maintainer and three people volunteered, but a sudden bereavement in his family derailed the process and he never followed up. He only revisited the package recently and found, alongside the install statistics, a set of GitHub issues, including one where joining a path onto a URL that ends in a slash strips every letter "a" from the path.

The cause, he explains, was a workaround that appends an "a" to the path to guarantee a final segment, then removes it with a find-and-replace. When the path ends in a slash, that appended "a" is the final segment, and the replacement deletes every other "a" in the path along with it. Smith says he is surprised the defect went unnoticed for so long.

Why deprecation instead of a handover

Faced with returning to PHP after almost a decade away, transferring ownership, or leaving the package dormant, Smith chose to retire it. He points to The PHP League's URI library as the community's established solution for URL handling, and notes that PHP 8.5 now ships a standards-compliant URI API in the language itself. Both, in his view, are better options than a short shim written over a decade ago.

Handing the package over, he argues, would add risk rather than reduce it: a widely installed dependency whose new owner no downstream user has vetted is the kind of high-value, low-scrutiny target attackers seek out, a dynamic he compares to the xz Utils backdoor, citing a Veritasium video as the clearest account of that incident. He notes that ozh maintains a fork for YOURLS, and that a community member pointed him at the new PHP 8.5 API.

Deprecation does not break installs: the package will keep downloading from Packagist. But it will receive no further fixes, including for the missing-"a" bug, because after years without changes even a one-line patch could have unintended consequences with no one left to support the result. The README documents how to migrate.

Why it matters

The episode is a compact illustration of how "temporary" compatibility shims become invisible infrastructure. A private migration patch grew into a dependency embedded in WordPress plugins, Linux distributions and, by Smith's own account, websites almost anyone has probably visited. For PHP developers the practical action is to check whether their projects pull in the http_build_url polyfill and plan a move to The PHP League's URI library or PHP 8.5's native API. More broadly, the decision to deprecate rather than transfer a high-install package is a deliberate supply-chain judgement: an unvetted new owner of a dependency with tens of millions of installs can be a bigger danger than an honest end of life.