jakeasmith/http_build_url
Pure-PHP drop-in for the PECL HTTP extension's http_build_url(). Parse URLs into components and reassemble them reliably, handling schemes, hosts, paths, query strings, and fragments. Ideal for merging parameters or rebuilding relative URLs without needing the extension installed.
http_build_url()) — assembling and reassembling URLs from parts, the inverse of parse_url(). That's too small to justify an internal library and too fiddly to hand-roll correctly (port/userinfo/fragment edge cases, RFC 3986 relative resolution). This package settles that decision for a few lines of Composer config.og:url, and share-preview URLs need deterministic normalization (scheme/host casing, default-port stripping, sorted query params). This is the primitive those pipelines sit on.HTTP_URL_REPLACE use case.Uri\Rfc3986\Uri — makes it a useful forcing function for a decision most teams defer: what is our policy on archived transitive dependencies, and when do we schedule their removal?Adopt when all of these hold:
| Criterion | Why it matters here |
|---|---|
| You are on PHP < 8.5 | The native replacement doesn't exist yet; something has to fill the gap. |
pecl_http is unavailable |
That's the package's entire reason for existing — it's a pure-PHP polyfill. |
| URL composition appears in a bounded number of call sites | Low call-site count means the eventual swap is a mechanical, low-risk change. |
| You don't need a full URI abstraction | No PSR-7/PSR-17 interop, no IDN, no validation pipeline — just composition. |
| You can verify it runs on your PHP version | Last release was 2017; the code is trivial string manipulation, but "archived" means nobody has certified 8.2/8.3/8.4. Gate adoption on your test suite, not the badge. |
| Security review accepts an archived dependency | The blast radius is genuinely small: one pure function, no I/O, no deserialization, no network calls. Document that reasoning — it's the defensible exception to a "no archived deps" rule. |
Look elsewhere when any of these hold:
Uri\Rfc3986\Uri directly. Adopting this package on 8.5 is pure technical debt with zero offsetting benefit.league/uri — actively maintained, RFC-compliant, handles IDN and reference resolution. Don't stretch a one-function shim into a URI layer.For executives (30 seconds): We need reliable URL construction for [OAuth callbacks / webhook delivery / canonical links]. The options are: hand-roll it (cheap to write, expensive to debug), adopt a full URI library (more capability than we need, more surface to maintain), or install a tiny MIT-licensed utility that does exactly one thing. I recommend the third: it's a one-line dependency with no transitive packages, no runtime services, and no data handling — so the security exposure is effectively nil. The caveat you should hear plainly: it is archived and has had no release since 2017, and PHP 8.5 ships this functionality natively. That makes it a deliberate, time-boxed bridge, not a permanent foundation. I'm asking for a small migration ticket now, so it's a planned cleanup rather than an audit finding later.
For engineering: One function, MIT, zero dependencies, wrap it behind our own UrlBuilder interface on day one so call sites never touch the package symbol directly. Verify against our PHP matrix before merge. Swapping to Uri\Rfc3986\Uri at 8.5 becomes a single-file change, and the wrapper is where we'd put normalization rules anyway. Do not extend it into a URI abstraction — if requirements grow past composition, we switch to league/uri rather than build on this.
The honest headline: this is a low-cost unblocker with a known expiry date. Approve it with the migration scheduled, not the migration deferred.
How can I help you explore Laravel packages today?