In 2014 a 174-line PHP shim was written to reproduce pecl_http’s http_build_url() so AOL’s CMS could upgrade from PHP 5.2 to 5.3 without changing dozens of call sites. Published on Packagist as a temporary convenience, it unexpectedly spread: nearly 20 million total installs and about 401,000 in the last 30 days, with daily downloads climbing to roughly 13,000 by 2026. The shim is bundled inside major projects - WPML includes it and reaches over 1.5 million sites, idna-convert and SPIP ship it, and it appears in Debian and Ubuntu packages - so it likely runs on many public websites despite its humble origin.
Upon revisiting the package, a longstanding bug was discovered: a hack that tacks an “a” onto paths to preserve trailing-segment logic ends up stripping every “a” from some paths. After failed attempts years earlier to hand the package off and personal interruptions, the decision was to deprecate rather than maintain or transfer it. The author points users to mature alternatives - PHP League’s URI library and PHP 8.5’s built-in URI API - and cites security risks in transferring stewardship of a widely installed package. The package will remain installable but will receive no further fixes; the README documents migration steps.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.