In 2014 Jake A. Smith needed a http_build_url() replacement while AOL’s CMS moved off PHP 5.2’s pecl_http extension. Rather than touch dozens of call sites, he wrote 174 lines that defined the function only if the real one was missing. He put it on Packagist in case anyone else needed the same patch and figured it would earn its keep for a year or two.

Twelve years later it has been installed from Packagist nearly 20 million times and still picks up 400,000 a month. Where it actually ended up:

  • Bundled directly in WPML, the WordPress multilingual plugin installed on 1.5M+ sites
  • A dependency of the idna-convert domain library, which is how it ships inside the source of SPIP
  • Packaged in Debian and Ubuntu as php-jakeasmith-http-build-url
  • Still running in AOL’s own CMS until the platform shut down around 2020 — the “temporary” migration never happened

Then there was the bug. Joining a path onto a URL with a trailing slash strips every letter “a” out of the path. The cause is his own workaround, commented // Workaround for trailing slashes: append an “a” so there is always a last segment to cut off, then cut it off with a find-and-replace. When the path ends in a slash, that last segment is the “a” — and the replace takes every other “a” in the path with it.

He had offered the package up for adoption back in 2021 and three people volunteered; an unexpected death in the family swallowed the follow-up, and then years passed. So the options were: return to PHP after a decade away, hand it to one of those volunteers, or let it keep sitting there. He chose none of the above and marked it deprecated.

  • The PHP League’s URI library and the standards-compliant URI API now in PHP 8.5 are both better than a 174-line shim from 2014
  • Maintaining it would only delay the move everyone should be making
  • Handing a widely installed package to a new maintainer nobody downstream has vetted is exactly what attackers look for — he points at the xz Utils backdoor

The package will keep installing, but it will not get new fixes, including for the missing-“a” bug. After this long without a change, even a one-line fix could have unintended consequences for someone, with no one around to support it.

What makes the essay worth reading is that the interesting decision is not the deprecation — it is the refusal to hand off. Most maintainers in this position transfer the package and feel generous. Smith argues that a popular, unmaintained dependency with a fresh, unvetted owner is a supply-chain risk, and that stepping away is the safer direction for everyone downstream.

The other lesson is quieter and harder to avoid: the code was never the permanent part. The distribution channel was.