A 2014 PHP Stopgap With 19.9 Million Installs Is Being Retired

Jake A. Smith deprecated his http_build_url PHP package on Sept. 15, twelve years after writing it as what he has described as a temporary fix. Packagist, the PHP package registry, lists the package at 19,897,257 total installs as of this month.

Why a stopgap function ended up everywhere

Smith wrote the package in 2014 while upgrading AOL's content management system from PHP 5.2 to 5.3, a move that dropped version 1 of the pecl_http extension and, with it, the http_build_url() function that extension provided. Rather than rewrite code that called that function, Smith published a small package that defines http_build_url() itself, only if the real one from pecl_http is not already loaded. It was designed as a drop-in patch, not a library anyone was meant to build on for a decade.

How a patch becomes infrastructure

Smith's own post, published on his blog, gives the current usage figures directly: roughly 401,308 installs in the past month alone, which works out to something on the order of 13,000 installs a day even as the package heads toward retirement. Packagist's package page separately lists 107 packages that depend on it directly and 198 stars on the project's GitHub repository.

Smith names specific downstream dependents in his post: WPML, the WordPress multilingual plugin installed on more than 1.5 million sites, pulls in http_build_url as a dependency, as does the domain-name handling library idna-convert and the French content management system SPIP. The package is also packaged directly for Debian and Ubuntu, and a maintained fork exists inside ozh/YOURLS, the URL-shortener project.

Metric	Figure
Total installs (Packagist)	19,897,257
Installs in the past month	401,308
Direct dependent packages	107
GitHub stars	198

What PHP 8.5 changes

The reason Smith can retire the package now rather than five years from now is that PHP 8.5 ships what he calls, in his own words, "a standards-compliant URI API in the language itself," in the form of the Uri\Rfc3986\Uri class. That built-in finally does natively what both pecl_http and Smith's polyfill were standing in for: parsing and building URLs according to a published specification instead of leaving every project to write its own string-splitting logic. Packagist's listing for the package now carries the same recommendation in its own deprecation notice, pointing users at the new class by name.

Smith's own reasoning for retiring the package rather than continuing to maintain it appears plainly in his post: "It was always meant to be temporary, so I'm retiring it." He frames continued maintenance as actively counterproductive at this point, something that would only delay the migration every dependent project should be making toward PHP's own URI handling.

What is still unresolved

Neither Smith's post nor Packagist's package page states a firm removal date, only a deprecation notice, so the package's 19.9 million installs are not expected to disappear immediately; Packagist shows zero open security advisories and zero open issues against it as of this month, meaning the deprecation is a maintenance decision rather than a response to any known flaw. What is not addressed in either source is a migration timeline for the 107 packages that depend on it directly, including whether WPML, SPIP or Debian's own packaging will drop the dependency on any particular schedule, or simply let it sit unmaintained the way many transitive dependencies do for years after their upstream author moves on.

The same tension between a language's built-in tooling and the userland packages that once filled a gap in it shows up elsewhere in the ecosystem. Tencent's BrowserSkill hands an AI agent access to a browser's existing login sessions rather than building a separate credential system from scratch, the same instinct toward reusing what a platform already provides instead of maintaining a workaround. Compact, open-weight models such as Edge0's 35-billion-parameter release follow a comparable logic one layer up the stack, trading a dependency on remote infrastructure for something that runs natively on the hardware already in hand.

The practical question for any of the 107 projects still depending on http_build_url is not whether to move off it, since Smith has made that decision for them by retiring the package, but whether their own maintainers act before their next Composer update pulls in unmaintained code by default.