A temporary PHP fix from 2014 logged 20M installs. Now it is deprecated

In 2014 Jake A. Smith wrote 174 lines of PHP as a stopgap for AOL's content management system. He published the code on Packagist in case anyone else needed the same patch. Twelve years later it has been installed nearly 20 million times, and on 15 September he marked it deprecated.

A temporary shim

The project was an upgrade of AOL's CMS from PHP 5.2 to 5.3, and part of it was dropping version 1 of the pecl_http extension, which provided a function called http_build_url(). A content management system deals with a lot of URLs, and this one called that function in dozens of places Smith did not want to touch. He reproduced it instead, defining his own http_build_url() only if the real one did not already exist, so the old code never noticed anything had changed. Composer was just taking off at the time, which made sharing the patch easy, and he expected it to earn its keep for a year or two.

That is a lot of installs

It was not temporary. Packagist statistics attached to the post show 19,864,271 total installs and 401,308 in the previous 30 days, with daily installs climbing from near zero in 2014 to roughly 13,000 a day in 2026. Composer is only part of the story: WPML, the market-leading multilingual plugin for WordPress, bundles the polyfill in its own codebase and is installed on more than 1.5 million sites, while the domain-name library idna-convert depends on it, which is how the code reached the source of the French CMS SPIP and ended up packaged in Debian and Ubuntu.

Coming back to the package after years away, Smith also found a bug: joining a path onto a URL with a trailing slash strips every letter a out of the path. Under a comment about a workaround for trailing slashes, the code tacks an extra a onto the path so there is always a last segment to cut off, then cuts it with a find-and-replace. When the path ends in a slash, that replace removes every other a as well. In 2021 he had asked for a new maintainer and three people offered, but a family loss intervened, he never followed up, and the package sat untouched.

Deprecate rather than hand over

Smith decided against both reviving the package himself and passing it to someone else. The PHP League's URI library has been the community's answer for years, and PHP 8.5 now ships a standards-compliant URI API in the language itself; both are better than a 174-line shim from 2014, and maintaining the package would only delay the migration. Handing a widely installed package to a maintainer nobody downstream has vetted, he argues, is exactly what attackers look for. The package will keep installing but will not get new fixes, including for the missing-a bug, since even a one-line change could have unintended consequences with nobody left to support it; the README documents how to switch. The postscript: AOL never migrated its CMS off the temporary polyfill, which ran there until the platform was shut down around 2020.