2014's 174-line PHP shim hits 20M installs, now deprecated
Original: My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it
Why This Matters
The case illustrates how temporary OSS workarounds quietly become critical infrastructure, and the supply-chain risks that follow.
Jake A. Smith wrote a 174-line PHP polyfill for AOL's CMS in 2014 as a stopgap for a dropped PECL extension. The package accumulated nearly 20 million Packagist installs and over 400,000 monthly downloads before Smith marked it deprecated in September 2026, citing PHP 8.5's native URI API as the proper replacement.
In 2014, Smith needed to replace http_build_url() — a function from the pecl_http v1 extension — while upgrading AOL's CMS from PHP 5.2 to 5.3. His workaround: a single PHP file, 174 lines, uploaded to Packagist with minimal expectations. 'I figured it would earn its keep for a year or two,' he wrote.
It lasted twelve. The package spread far beyond Composer installs. WPML, the dominant WordPress multilingual plugin with over 1.5 million active sites, bundles it directly. The idna-convert library depends on it, which pulled the shim into SPIP (a French CMS) and ultimately into Debian and Ubuntu packaging.
Returning to the codebase after years away, Smith found an open bug: appending a path to a URL with a trailing slash silently strips every letter 'a' from the path. The culprit was a comment-flagged workaround that tacked on a dummy 'a' character and removed it via find-and-replace — taking every other 'a' in the string with it.
Smith considered three options: resume active maintenance, hand the project to one of the three volunteers who had offered in 2021, or retire it. He chose retirement. PHP 8.5 now ships a standards-compliant URI API natively, and The PHP League's URI library has long offered a robust alternative. His stated concern about a handoff: a widely-installed package with an unvetted new maintainer is a known attack vector — he points explicitly to the xz Utils supply-chain incident as a cautionary model.