A 2014 PHP Polyfill With 20 Million Installs Retires

PHP developer Jake A. Smith deprecated his http_build_url package on Sept. 15, closing out a piece of code he wrote in 2014 to patch a single AOL content-management system and never meant to publish widely.

Smith wrote on his blog that the function started as a workaround during an upgrade of AOL's CMS from PHP 5.2 to 5.3, when the pecl_http extension that had shipped a native http_build_url() function was dropped. He wrote his own version, guarded so it would only load if the real function was not already present, and pushed it to Packagist as jakeasmith/http_build_url the same year.

The package has been installed nearly 19.9 million times, according to its Packagist page, and was still adding roughly 401,000 installs a month as of this month. Packagist lists 107 packages that depend on it directly. Smith's post says the code also travels indirectly: the WPML WordPress translation plugin bundles it on more than 1.5 million sites, the idna-convert domain-name library ships it, and the French CMS SPIP carries it into Debian and Ubuntu's own package archives.

Why a 12-year-old fix is being pulled now

Smith wrote that the package "was always meant to be temporary," and that he tried to hand it to a new maintainer as far back as 2021 without success. His reason for deprecating it now, rather than continuing to leave it alone, is the risk of an unmaintained dependency sitting quietly in millions of installs: he cited the xz Utils backdoor as the kind of incident an abandoned package invites. He also flagged a path-joining bug in his own code, where a flawed find-and-replace on trailing slashes could strip a stray letter "a" from a URL path.

The Packagist listing now marks the package abandoned and points users to two replacements: the PHP League's Uri library, and PHP 8.5's own Uri\Rfc3986\Uri class, which Smith and the package page both note removes the need for a third-party dependency going forward.

What deprecation does and does not change

Marking a Composer package abandoned does not remove it from Packagist or break the sites already running it. The 107 packages that depend on it, and the sites bundling it through WPML, idna-convert and SPIP, will keep working exactly as before unless their own maintainers act. What changes is that Smith will no longer patch it, so any future PHP release that breaks the 2014-era workaround, or any vulnerability found in it, will have no one upstream to fix it.

Smith's post does not name which of the 107 dependent packages, if any, have already switched to the League or native replacement, so it is not yet clear how much of the 401,000-a-month install rate will keep flowing to an abandoned function. Two other stories this month sit on the same fault line: Alibaba open-sourced an automated code-review tool on Sept. 16 built partly to catch this kind of risk before merge, and a leaked GitHub token gave outside researchers admin access to Baseten's repositories through a three-year-old credential nobody had rotated.

Metric	Figure
Package created	2014
Total Packagist installs	19,894,218
Installs per month	401,308
Direct dependents on Packagist	107
Sites bundling it via WPML	1.5 million+