My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it
A developer's temporary 2014 PHP polyfill, intended for a quick AOL CMS upgrade, unexpectedly accumulated nearly 20 million installs on Packagist. Surprised by its widespread adoption and the emergence of modern alternatives, the author has now deprecated it, citing maintenance complexities and potential security risks. This saga offers a fascinating look into the unforeseen longevity of open-source contributions and the responsibility that comes with them.
The Lowdown
In 2014, Jake A. Smith penned a modest 174-line PHP function as a stopgap measure for an AOL CMS migration, never imagining its reach. Intended as a temporary replacement for a pecl_http function, he shared it on Packagist assuming it would soon be obsolete. Fast forward twelve years, and this 'temporary' fix has become a cornerstone for millions of websites, prompting its creator to confront its unexpected legacy.
- Humble Beginnings, Global Impact: The small PHP polyfill,
http_build_url(), was designed to smooth a PHP 5.2 to 5.3 upgrade for AOL's CMS. Shared via Composer, it quickly gained traction, reaching nearly 20 million installs on Packagist and averaging over 400,000 monthly downloads. - Embedded Everywhere: Its influence extends beyond direct installs, as it's bundled within major projects like WPML (used on over 1.5 million WordPress sites) and
idna-convert, leading to its inclusion in Debian, Ubuntu, and the SPIP CMS. - Unforeseen Flaws: Upon revisiting the project after years, Smith discovered a critical bug where trailing slashes in URLs could inadvertently strip all 'a' characters from the path, a testament to the code's long-term unmonitored existence.
- The Deprecation Decision: Faced with the options of diving back into PHP development, handing over maintenance, or letting it linger, Smith chose deprecation. He argues that modern, standards-compliant alternatives like PHP League's URI library and PHP 8.5's native URI API are superior and that continuing to maintain the shim would only delay necessary transitions.
- Security Concerns and Responsibility: Citing the
xz Utilsbackdoor incident, Smith highlighted the significant security risks associated with handing over a widely installed package to a new, unvetted maintainer. He concluded that deprecation was the most responsible path, even for a piece of code that had become 'too big to fail'.
The story serves as a compelling reminder of the disproportionate impact a small, well-placed piece of open-source code can have, the often-unseen burden of its maintenance, and the difficult choices developers face when temporary solutions achieve unexpected permanence.