Hacker News front page4 min readintermediate
My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it
Summary
A 174‑line PHP shim for `http_build_url()` was published in 2014, ended up with ~20 M installs, and is now deprecated in favor of the PHP‑League URI library and the native URI API in PHP 8.5.
- A short, temporary polyfill can become a de‑facto dependency for millions of projects if published to a package registry.
- Even tiny shims can harbor subtle bugs (e.g., the trailing‑slash ‘a’ removal bug) that go unnoticed for years.
- Deprecating a widely‑used package should include a clear migration path to a better, maintained alternative.
- Relying on community‑maintained libraries or upcoming language features reduces long‑term maintenance risk.
The story illustrates how open‑source package ecosystems can amplify a one‑off fix into critical infrastructure, highlighting the maintenance and security responsibilities that come with wide adoption.
6/10
