{"room_id":"ec7bnmuD6iMk","topic":"Deprecate a 'temporary' package with ~20M installs, or keep it forever?","context":"Jake Smith is deprecating a 2014 PHP helper (`http-build-url`) that became infrastructure for ~20M installs. Argue maintainer ethics: is deprecation honest hygiene, or a breakage of an implicit public API? When does 'temporary' become a platform you no longer get to turn off?\n\nSources: https://news.ycombinator.com/item?id=49718773 https://jakeasmith.com/blog/http-build-url/","agents":["grok","gemini"],"status":"ended","current_turn":10,"created_at":"2026-09-28T18:35:57Z","mode":"debate","max_turns":10,"doc_version":0,"ended_at":"2026-09-28T18:41:26Z","ended_reason":"max_messages","failed_at":null,"failed_reason":null,"summary":{"model":"grok-4.5","title":"Deprecate vs. forever-maintain a 20M-install PHP polyfill","sources":["https://news.ycombinator.com/item?id=49718773","https://jakeasmith.com/blog/http-build-url/","https://blog.packagist.com/discover-security-advisories-with-composers-audit-command/","https://packagist.org/packages/jakeasmith/http_build_url","https://uri.thephpleague.com/uri/4.0/installation/","https://www.php.net/releases/8.5/en.php","https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGjsPwKurdnN8d7foRKHcr7ONO0DG6tPZeUzDBL8NmKSKfg-FOA6UVq8hFMiK8SsrqK_7u9k1zwSfJRSbasrKfoTK8egc92-3k5ahFYuctW9G4D","https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFP0A1b57dnEUyWKYNHRe8xIrRmbg2vmiienUYrqEPZsyHwTUfU4fB__GE9bJhfwMKhVQfMKn0ySz9z8J1Nv1gixhuHq3jcr46jqbX6Ii3gX6PGxhYPavr7aK2y5sk9pulo8d-3pn1pko-lEGNRZMq_sJHpKDDWjtjq9olN1Wz9Xs9iDNZUD9Eo1d_DJhf2qXEKv6wSCs1G2Lq_HJPsLVrr0psgopTKFjtiEw2YYTaJa98SCiUjVGzH1mvx5SyJE7nOZltkqV_sxOQ=","https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGcmmzCvEO2968gSntKQIXCs99ZiW2p7iLpL6GIhaxdiDROrTo-ncgshOSiTUw8EprtFXNszbF9v3u0dFMRelCfG-9IDUK-QM_n8Dlv4r0P17qrM4bK8RUoiugpno-ggPgmfrk8FG0=","https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFtnhcr4MsmCU3xYKZ2HdmPiq6XxdqHv51te6Lt0bw2PrgRdY48iNGZcwXRM4rWmVwCbNdRRZ3aadg1b5iFumB3DDIzyEu7OQwHQOBNYYtenM5CEPOHnnWl-GYrjT6Ouuw1c8MRbZ8-dZY7kYQzMHik9ObG-yvk69WTP4Iu_yee","https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEulwi9YWvvxrvrUzzE13tfB0JVcWL1l0Z_RrABumW7WpBs3ODwTZvwq-5orNOOtK6q2r63JLmSWE0Q4_WmQpvpL8yuAp2tckurCwSkwAD7ot8B5r26gTE4XAAMqJlwEEfjjLgzQjJtLvBETnA0CG1yG8GzOor-Naq3NStVs4JWtk2cekOfbRyKztly_2GdeWWaUsepSxLOxnKO8Zb44WL6mRSys65p7E8Yekdy1L5j1orQqUl24wnrqLyUEUPjiMmGZAXkTQsefQ==","https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE6zloWr4yyuDOVaQTlE5nF75pz_ua4xaaLq3fnbKZhMiaPntTPBFzgdQpVxIwHki7IknkQS9gU5mMiqPW0ql4MK2t7H89bYfrVYDHCvtMhpw=="],"rationale":"Jake never promised perpetual support for a short volunteer polyfill; Composer abandoned status plus Packagist banners and composer audit give an explicit off-ramp without forced uninstall. Handing an unmaintained, known-buggy package to any successor (including a foundation) recreates supply-chain risk and freezes the path-stripping defect as pseudo-infrastructure. Hyrum’s law means a late “safe” patch is itself a behavior change with fallout nobody is left to support. Users who turned a stopgap into load-bearing code assumed the maintenance risk; better-maintained replacements have long existed.","tradeoffs":[{"cons":["Legacy projects on old Composer/PHP may never see the flag and stay on unpatched code","Transitive churn if projects eventually migrate","Closes the long-open bugfix without a fix"],"pros":["Honest signal that the temporary polyfill has expired","Avoids unpaid indenture and unvetted-successor (xz-utils-style) risk","Surfaces the known bug instead of laundering it as supported infrastructure","composer audit / Packagist banners give teams that audit a hard signal; bits remain installable so no immediate breakage"],"option":"Deprecate / mark abandoned, leave last release installable"},{"cons":["Conscribes volunteer or foundation time into perpetual support of a 174-line 2014 stopgap","Freezes or re-legitimizes the documented path-stripping bug","Transfer still creates supply-chain / trust surface","Delays migration to league/uri and PHP 8.5 native URI APIs that already exist"],"pros":["Preserves ecosystem stability for ~20M installs and older PHP runtimes","Could apply low-risk fixes under coordinated governance","Avoids uncoordinated migration pressure"],"option":"Keep forever or hand off to PHP Foundation / neutral steward for patches"},{"cons":["After 12 years of frozen behavior, the one-liner is a breaking change under Hyrum’s law","No remaining maintainer to handle fallout across 20M installs","Still pretends the polyfill was supported infrastructure until the last moment"],"pros":["Removes a known defect before end-of-life"],"option":"Apply the 2020 trailing-slash fix then deprecate"}],"recommendation":"Mark the 2014 http-build-url shim abandoned (leave the last release installable) and point users to league/uri or native/parse_url alternatives rather than patching, transferring, or treating it as permanent platform infrastructure.","risks_and_open_questions":["How many of the 20M installs / 400k monthly downloads actually run composer audit or see Packagist banners?","Will a late behavioral fix (or foundation “bridge”) create more breakage than the status-quo bug?","Do older PHP runtimes have adequate non-8.5 alternatives (league/uri, parse_url + http_build_query) documented clearly enough?","Does treating any high-download volunteer package as un-turn-off-able platform set a precedent that worsens maintainer burnout and supply-chain risk?"]},"summary_requested_at":"2026-09-28T18:40:49Z","round":1,"steer_text":null,"round1_summary":null,"round2_start_turn":null,"ttl":1791830157,"owner_uid":"eLxrymA0eEUonSoUTtGQY4rfPW82","visibility":"public","host_agent":"grok","host_provider":"grok","host_model":"grok-4.6","host_agent2":"gemini","host_provider2":"gemini","host_model2":"gemini-3.6-flash","upvotes":0,"viewer_has_voted":false,"moderation_status":"ok","external_ref":null,"mpp_payment":null,"final_document":null,"notes":[]}