Dev deprecates a 2014 'temporary' PHP polyfill still pulling 400K installs a month

In 2014, Jake Smith wrote 174 lines of PHP to reimplement http_build_url() while AOL’s CMS migrated from PHP 5.2 to 5.3 and dropped the pecl_http extension that provided it. The shim was only defined when the native function was absent, so legacy code kept working untouched. He published it on Packagist as a courtesy and expected it to be obsolete within a year or two. Instead it accumulated nearly 20 million installs and still draws over 400,000 a month, spreading far beyond Composer: it’s bundled directly in WPML (a WordPress plugin on 1.5M+ sites), pulled in transitively via the idna-convert library, and packaged into SPIP, Debian, and Ubuntu.

Revisiting the project surfaced a memorable defect. A trailing-slash workaround appends an ‘a’ to the path so there’s always a final segment to trim, then removes it with a find-and-replace — which, when the path ends in a slash, quietly strips every other ‘a’ from the path. The bug survived unnoticed for years. Rather than return to PHP after nearly a decade away or hand the package to a volunteer, Smith chose to retire it, pointing users to the PHP League’s URI library and the standards-compliant URI API now built into PHP 8.5.

The reasoning is squarely about supply-chain risk. Smith argues that transferring a heavily-installed package to a maintainer nobody downstream has vetted is exactly the setup attackers exploit, citing the xz Utils backdoor as the cautionary example. The code will keep installing but receive no further fixes — not even for the ‘a’-stripping bug — on the logic that a single unsupported change to something this widely deployed could cause more harm than the frozen status quo. A fitting footnote: AOL’s CMS never migrated off the ‘temporary’ polyfill and ran it until the platform shut down around 2020.