tl;dr: A developer's 174-line PHP polyfill for `http_build_url()`, written in 2014 as a temporary shim during an AOL CMS upgrade, has been installed nearly 20 million times via Packagist and bundled into widely-used projects like WPML and Debian packages. After rediscovering the package (which contains an amusing bug that strips the letter "a" from paths with trailing slashes), the author is deprecating it rather than handing it off, citing supply-chain risks à la the xz backdoor and pointing users to PHP League's URI library or PHP 8.5's native URI API.