This JavaScript library is EVERYWHERE. Its maintainer is broke
Denis Pushkarev may make core-js closed source...
The primary maintainer of an open source project, core-js that is on hundreds of millions of websites and over 50% of the world’s most visited websites (from Paypal to Pornhub) says he may walk away from the project after maintaining it for years with minimal reward – or even change it to a closed source licence in future.
In a deeply frustrated, 11,000-word screed on GitHub, Denis Pushkarev said his already meagre donations had been largely cut off owing to western financial firms not dealing with payments to Russia, but even before that the “community” had been little support., saying that “when I started raising funds to support the core-js development (mainly it was posted READMEs on GitHub and NPM). The result was... $57 / month.”
When he added a Patreon link in the core-js installation code in a bid to drum up more support, he said he started to receive a “continuous stream of hate…. Hundreds of messages, posts, and comments per day.”
Now the core-js maintainer says for the next release he is considering changing it to closed source.
A quick recap: What is core-js?
core-js a modular standard library for JavaScript that provides a host of useful operations including "polyfills", or ways of implementing modern browser features. Over 13 million developers are listed as using it on GitHub and it gets downloaded more than 43 million times every week via the npm registry. (It has had over nine billion downloads in total over the years since it was published as open source by Denis Pushkarev in 2014.)
The project is described in somewhat more detail on npm as a "modular standard library for JavaScript. Includes polyfills for ECMAScript up to 2023: promises, symbols, collections, iterators, typed arrays, many other features, ECMAScript proposals, some cross-platform WHATWG / W3C features and proposals like URL."
As Pushkarev notes: “It is one of the main reasons why developers can use modern ECMAScript features in their development process each day for many years, but most developers just don't know that they have this possibility because of core-js since they use core-js indirectly as it's provided by their transpilers / frameworks / intermediate packages like babel-polyfill / etc. It is not a framework or a library, which usage require the developer to know their API, periodically look at the documentation, or at least remember that he or she is using it. Even if developers use core-js directly — it’s just some lines of import or some lines in the configuration (in most cases with mistakes, since almost no one read the documentation), after that, they forget about core-js."
Core-js maintainer: “All extra functionality will be paid for”
The core-js maintainer was imprisoned for 10 months in 2020 after hitting and killing a teenager on his motorbike (something he does not write about hugely sympathetically in his GitHub missive -- "two deadly drunk 18-years-old girls in dark clothes decided somehow to crawl across a poorly lit highway" -- and released early; witnesses said one of the girls dragged the other under his wheels, he writes) and the project survived with the rest of its small maintainer contributing, but the status quo is unsustainable, he wrote today (February 14, 2023).
He is considering various options for the future "depending on your feedback" he said.
These options include "appropriate financial backing"; being hired by a company that pays him to work on open source and web standards; making it closed source and commercial; or a "slow death".
“The free version will be significantly limited”, if he takes the license changing approach.
“All extra functionality will be paid for. core-js will continue to evolve appropriately and, in the scope of this project, will be created many new tools for ensuring web compatibility. Sure, it will significantly reduce the spread of core-js and will cause problems for many developers, however, even some paying customers could be enough and my family will have money for paying bills.”
"We'll fork it, f*ck off" -- but will the community maintain it?
Responding to the anticipated comment "It's open-source, we will fork it, fuck off" he said: “I see such comments regularly, someone even tries to scare me with a fork. I've said already too many times that if someone will fork and properly maintain core-js, I'd be happy – [but] it makes no sense just to fork it without maintenance. Now I don't see even anyone who tries to add to core-js something significant or at least contribute regularly. It should react on each new JavaScript engine release to update compatibility data, fix or at least take into account each new (no matter how significant) bug from each engine, take a look and implement each new JavaScript feature that possible, do it maximally properly, test and take into account the specifics of each version of each modern or legacy engine - it's a hard work - are you ready and have the required knowledge and time for that?"
Follow The Stack on LinkedIn
The primary core-js maintainer added: "[It] is not a several lines library that you can write and forget about it. Unlike the vast majority of libraries, it's bound to the state of the Web. It should react to any change of JavaScript standards or proposals, to any new JS engine release, to any detection of a bug in JS engines, etc. After ECMAScript 6 2015 followed new proposals, new versions of ECMAScript, new non-ECMAScript web standards, new engines and tools, etc. The evolution, the improvement of the project, and the adaptation to the current state of the Web have never stopped - and almost all of this work remains not visible to the average user."
The core-js maintainer's position met some sympathetic responses: Colin Eberhard, CTO, Scott Logic for example posting that "core-js is another example of critical open source infrastructure that is entirely hidden from view. It is a vital building block that very few are aware of. And like so many of these projects, it is almost entirely written and maintained by a single individual, who receives very little reward..."
A discussion on Reddit meanwhile saw one commentator note that "Been following his story since years ago, I remember when I first saw core-js in my vue template and decided to do some research on him. He probably is the sole reason why the modern web even exists. I don't think we would have seen all this breakout of libraries and frameworks if his contributions to backwards compatibility wouldn't exist."
Whether this flurry of sympathy will turn into a flurry of donations remains an open question.
To those who want to back his significant efforts, Open Collective, Patreon, or Bitcoin ( bc1qlea7544qtsmj2rayg0lthvza9fau63ux0fstcz) are the ways to do so.
Denis Pushkarev's own post with some more upbeat details about the core-js roadmap is here.
