My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it
A software developer is deprecating a widely used PHP polyfill library they created in 2014 as a temporary fix for a CMS upgrade. Despite its 'temporary' nature, the code has been installed nearly 20 million times and remains embedded in major platforms like WordPress.
Why it matters
This illustrates the fragility of the modern software supply chain, where small, unmaintained snippets of code can become critical infrastructure for millions of users.
Twelve years ago, I wrote 174 lines of PHP as a stopgap for AOL’s content management system. I put it on Packagist in case anyone else needed the same patch, and somehow it’s been installed nearly 20 million times since. Today I marked it deprecated.
In 2014, we were in the middle of upgrading AOL’s CMS from PHP 5.2 to 5.3. Part of that upgrade was dropping version 1 of the pecl_http extension, which gave us a function called http_build_url() . A CMS deals with a lot of URLs, and ours called that function in dozens of places. I wasn’t touching those. The function seemed straightforward enough to reproduce, so I wrote my own http_build_url() , defined only if the real one didn’t already exist. The old code never knew anything had changed.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in