Maintainer Needed: Querystring

[bnb]

In July last year, I found a module that had 6m weekly downloads and seen a new version published in 6-7 years.

Fast forward to last night, I got a DM from someone at WIRED who was writing about open-source and sustainability, mentioning that tweet. I had to go back to it to see if I could find the module since I couldn't recall what it was.

Turns out, it's querystring which now has 12m weekly downloads and is used by basically every community within the JavaScript ecosystem somewhere. The most notable users that I saw (I'm not going to go through all the pages) are aws-sdk, unsplash-js, now-client, react-metrics, and @serverless/platform-sdk.

Querystring seems to be a modularized version of Node.js's querystring core module that was originally maintained by Joyent. The GitHub README currently has Status: Maintainer Needed at the top.

I wanted to bring this up in the hopes that Node.js will potentially consider either becoming the official maintainer and bringing it up to date/just permanently holding it so bad actors cannot take it over or finding maintainers who we trust that can do that.

[ljharb]

I already maintain qs, and I'm not sure I want to volunteer to take over a second query string library (but it's not out of the question). Would it be reasonable to deprecate it in favor of qs? That would accomplish the same goals of ensuring it's not misused, in the same way request was deprecated.

[boneskull]

agree w/ @ljharb. we don't always need an active maintainer for projects like this; deprecation and directing users to well-maintained alternatives is arguably a better solution.

[bnb]

I'm fine with deprecation, though I'd point to this specific module's assertion that it's a 1:1 of Node.js's querystring module which is in stable. If we were to deprecate it, it'd probably be worth suggesting using Node.js's querystring module directly?

[ghinks]

I have reached out to the maintainer Gozala/querystring#44
And I believe that he needs to establish trust and wants to understand how he knows we are good actors.

[ljharb]

In that case, it’s probably a useful package to continue to use as a shim for the core module in bundlers, and it probably shouldn’t be deprecated at all.

[medikoo]

Please check Gozala/querystring#44 (comment)

[thescientist13]

Looks like the team has been able to get the maintenance support it needs? 💯
Gozala/querystring#44 (comment)

I've updated the main README and removed "Maintainer needed" call, to reflect @Gozala stance (which I fully understand and respect).

I've also added a note on how incoming contributors can help with eventual project evolution

@medikoo Do things rest well with you and querystring at this time then?

---

Additionally, you may find it helpful, there are some resources from the Package Maintenance team you can refer to.