feat: adopt string_decoder as @unabandoned/string_decoder - #1

What & why

Brings the browserify string_decoder shim into the unabandoned program.

Upstream nodejs/string_decoder has been frozen at 1.3.0 since 2019 while still shipping the abandoned safe-buffer runtime dependency — abandoned + outdated dep, so the prime directive says fork and own it. It is a direct dependency of @unabandoned/browserify (string_decoder: ^1.1.1), the browser shim browserify injects for require('string_decoder'), so the tree runs through us either way.

Standard onboarding

• Scoped to @unabandoned/string_decoder; repository/bugs/homepage repointed at this fork.
• engines.node set to >=22.12.
• Thin reusable-workflow callers for ci / codeql / commitlint / publish / release-cut / release-please / release-security / renovate-config / scorecard, all pinned to unabandoned/.github@d493a18 (v1.0.0) — byte-identical to the readable-stream callers apart from the Node matrix ([22, 24]).
• renovate.json extending github>unabandoned/renovate-config with forkProcessing: enabled.
• release-please manifest (1.3.0) + config; commitlint config + commit-msg githook.
• .unabandoned.yml added (used-by: @unabandoned/browserify), validated against scripts/validate_metadata.py.
• Removed .travis.yml (a Node 0.8–9 matrix) and the build/ node-core sync script, which is obsolete now that this fork has deliberately diverged from the upstream snapshot.

The safe-buffer decision: dropped, not kept

[email protected] depended only on safe-buffer, which is itself frozen with zero runtime deps of its own — so it was leave-alone-eligible as a clean leaf. I dropped it anyway, because in this case the dependency turned out to be pure legacy shimming rather than a real leaf.

build/files.js in the upstream repo spells it out: the sync script's job was rewriting node core's require('buffer').Buffer into require('safe-buffer').Buffer, so the package could run on Node < 4.5 where Buffer.from/Buffer.allocUnsafe did not yet exist. At engines.node >=22.12 that shim is dead weight, and removing it is just restoring the node-core original:

var Buffer = require('buffer').Buffer;

The lib uses exactly two things off Buffer — allocUnsafe and isEncoding — both native since Node 4.5 and both present on the browser buffer package (verified against @unabandoned/buffer, which browserify maps buffer to). So this is behaviour-preserving in Node and in the browser.

The result is a package with no runtime dependencies at all, which is a strictly cleaner tree than keeping a frozen unowned leaf. safe-buffer itself is not forked — there is nothing under it to rot.

I verified the swap rather than assuming it: the pre-existing upstream suite was run against the original safe-buffer lib (green), then against the require('buffer') lib (green), before any test conversion happened.

Test suite

Converted to node:test/node:assert. This drops tap@~0.4.8 and the vendored 30 kB node-core test/common harness, which pulled in babel-polyfill, core-util-is and inherits. All upstream assertions are preserved, including the exhaustive writeSequences() split-every-possible-way coverage; expected strings are kept as \u escapes since most of them are replacement characters, combining marks and lone surrogates.

test/verify-dependencies.js (asserted no ^ ranges) is removed — there are no runtime dependencies left to check, and Renovate owns ranges now.

The dev tree is now just commitlint.

Type of change

• fix / feat / perf — consumer-facing
• deps — dependency update (add the security label if it fixes a CVE)
• chore / ci / build / docs / test / refactor — maintenance

Titled feat: so release-please cuts 1.4.0 — staying inside 1.x deliberately, so @unabandoned/browserify can repoint at ^1. This matches how readable-stream (4.7.0 → 4.8.0) and browserify (17.0.x → 17.1.0) were onboarded: keep the upstream major, express the engines change as a minor.

Checklist

• Commits follow Conventional Commits (commitlint passes)
• npm test passes on Node 20 / 22 / 24 — see note below
• No new runtime dependency (or its addition is justified below)
• Dev tree kept lean (prefer built-in node:test over new runners)

On the Node matrix: this fork declares engines.node >=22.12 and its CI matrix is [22, 24], matching readable-stream. Node 20 is deliberately not covered. Verified locally as 17/17 passing on Node 22.22.2 and Node 24.19.0.

Verified against the packed artifact, not just the working tree

npm pack produces 4 files (LICENSE, README.md, lib/string_decoder.js, package.json). Installing that tarball into an empty project gives:

[email protected]
`-- @unabandoned/[email protected]

— one package, no transitive deps, safe-buffer gone. A smoke test driving a split multi-byte character and a split UTF-16 surrogate pair through the installed artifact passes on both Node 22 and Node 24.

I also sanity-checked that the converted suite actually bites: mutating utf8CheckIncomplete in the lib turns 5 of the 17 tests red.

Follow-up

@unabandoned/browserify needs its string_decoder dependency repointed at this fork. That PR is open at unabandoned/browserify#59 and cannot go green until this one is merged and published — @unabandoned/string_decoder currently 404s on the registry, so browserify's npm install can't resolve it. Merge and publish order is this PR first.

Generated by Claude Code