unabandoned · 00o-sh · Aug 15, 2026 · Aug 15, 2026 · Aug 15, 2026
diff --git a/.githooks/commit-msg b/.githooks/commit-msg
@@ -0,0 +1 @@
+npx --no-install commitlint --edit "$1"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,13 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  ci:
+    permissions:
+      contents: read
+    uses: unabandoned/.github/.github/workflows/reusable-ci.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
+    with:
+      node-versions: '[22, 24]'
+      has-build: false
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,14 @@
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 6 * * 1'
+jobs:
+  codeql:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: unabandoned/.github/.github/workflows/reusable-codeql.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
@@ -0,0 +1,8 @@
+name: commitlint
+on:
+  pull_request:
+jobs:
+  commitlint:
+    permissions:
+      contents: read
+    uses: unabandoned/.github/.github/workflows/reusable-commitlint.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -0,0 +1,16 @@
+name: publish
+on:
+  release:
+    types: [published]
+permissions:
+  contents: read
+  id-token: write   # required for OIDC on the calling job
+jobs:
+  publish:
+    permissions:
+      contents: read
+      id-token: write
+    uses: unabandoned/.github/.github/workflows/reusable-publish.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
+    with:
+      install-for-publish: false
+    secrets: inherit
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
@@ -0,0 +1,12 @@
+name: release-cut
+on:
+  schedule:
+    - cron: '0 6 1 * *'
+  workflow_dispatch:
+jobs:
+  cut:
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: unabandoned/.github/.github/workflows/reusable-release-cut.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
+    secrets: inherit
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -0,0 +1,11 @@
+name: release-please
+on:
+  push:
+    branches: [main]
+jobs:
+  release-please:
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: unabandoned/.github/.github/workflows/reusable-release-please.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
+    secrets: inherit
diff --git a/.github/workflows/release-security.yml b/.github/workflows/release-security.yml
@@ -0,0 +1,11 @@
+name: release-security
+on:
+  pull_request:
+    types: [closed]
+jobs:
+  security-release:
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: unabandoned/.github/.github/workflows/reusable-release-security.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
+    secrets: inherit
diff --git a/.github/workflows/renovate-config.yml b/.github/workflows/renovate-config.yml
@@ -0,0 +1,15 @@
+name: Renovate Config
+
+# Validate this fork's renovate.json against Renovate's schema so a
+# malformed config can't silently halt Renovate on a bot- or
+# Claude-authored PR. Delegates to the shared reusable workflow.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  renovate-config:
+    permissions:
+      contents: read
+    uses: unabandoned/.github/.github/workflows/reusable-renovate-config.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -0,0 +1,14 @@
+name: Scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '0 6 * * 1'
+  push:
+    branches: [main]
+jobs:
+  scorecard:
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+    uses: unabandoned/.github/.github/workflows/reusable-scorecard.yml@d493a18373453d0e55c5e9952d472f59763f3da2 # v1.0.0
diff --git a/.gitignore b/.gitignore
@@ -1 +1,3 @@
-node_modules
+coverage/
+node_modules/
+package-lock.json
diff --git a/.npmignore b/.npmignore
diff --git a/.npmrc b/.npmrc
@@ -0,0 +1 @@
+package-lock=false
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -0,0 +1 @@
+{".":"1.3.0"}
diff --git a/.travis.yml b/.travis.yml
diff --git a/.unabandoned.yml b/.unabandoned.yml
@@ -0,0 +1,26 @@
+schema: 1
+
+package: "@unabandoned/string_decoder"
+
+upstream:
+  repo: nodejs/string_decoder
+  reason: "frozen since 2019 at 1.3.0; the repo tracks a Node 8 era snapshot and its issues go unanswered"
+
+summary: >-
+  Node core's StringDecoder, which turns a series of buffers into strings
+  without splitting multi-byte characters apart, packaged for userland and the
+  browser.
+
+why-forked: >-
+  Abandoned upstream while still shipping the abandoned safe-buffer runtime
+  dependency, so nothing was keeping its tree current for the bundlers that pull
+  it in. Forked so Renovate owns the tree; the safe-buffer shim has since been
+  dropped, leaving the package with no runtime dependencies at all.
+
+status: active
+
+used-by:
+  - consumer: "@unabandoned/browserify"
+    purpose: "The browser shim browserify injects for require('string_decoder')."
+
+tags: [string, decoder, node-core-polyfill, browserify]
diff --git a/README.md b/README.md
@@ -1,47 +1,70 @@
-# string_decoder
+# @unabandoned/string_decoder
 
-***Node-core v8.9.4 string_decoder for userland***
+***Node-core `string_decoder` for userland — a maintained fork***
 
+```bash
+npm install --save @unabandoned/string_decoder
+```
 
-[![NPM](https://nodei.co/npm/string_decoder.png?downloads=true&downloadRank=true)](https://nodei.co/npm/string_decoder/)
-[![NPM](https://nodei.co/npm-dl/string_decoder.png?&months=6&height=3)](https://nodei.co/npm/string_decoder/)
+This package is a mirror of the `string_decoder` implementation in Node core. It
+turns a series of buffers into a series of strings without breaking apart
+multi-byte characters, which is what stream consumers need when a character's
+bytes straddle two chunks.
 
+Full documentation may be found on the
+[Node.js website](https://nodejs.org/api/string_decoder.html).
 
-```bash
-npm install --save string_decoder
-```
+## Why this fork exists
+
+Upstream [`nodejs/string_decoder`](https://github.com/nodejs/string_decoder) has
+been frozen at 1.3.0 since 2019, and it still shipped the abandoned
+[`safe-buffer`](https://github.com/feross/safe-buffer) runtime dependency. That
+left nothing keeping the tree current for the bundlers that pull it in
+transitively — most visibly [browserify](https://github.com/unabandoned/browserify),
+which injects this package as the browser shim for `require('string_decoder')`.
 
-***Node-core string_decoder for userland***
+This fork is maintained under the [`unabandoned`](https://github.com/unabandoned)
+program, where Renovate keeps the dependency tree current and releases are cut
+on a regular cadence. See the
+[package dashboard](https://unabandoned.github.io/.github/) for live status.
 
-This package is a mirror of the string_decoder implementation in Node-core.
+## No runtime dependencies
 
-Full documentation may be found on the [Node.js website](https://nodejs.org/dist/v8.9.4/docs/api/).
+Node core reads `Buffer` straight off the `buffer` module. Upstream's build
+script rewrote that line to pull `Buffer` from the `safe-buffer` shim instead, so
+the package could run on Node < 4.5, where `Buffer.from` and
+`Buffer.allocUnsafe` did not exist yet.
 
-As of version 1.0.0 **string_decoder** uses semantic versioning.
+This fork requires Node >= 22.12, so that shim was dead weight — the line is
+restored to the core original and `safe-buffer` is gone. The package now has
+**no runtime dependencies**. Bundlers map `buffer` to their browser `Buffer`
+implementation, which supplies the same `allocUnsafe` and `isEncoding`, so
+browser builds are unaffected.
 
-## Previous versions
+## Usage
 
-Previous version numbers match the versions found in Node core, e.g. 0.10.24 matches Node 0.10.24, likewise 0.11.10 matches Node 0.11.10.
+```js
+const { StringDecoder } = require('@unabandoned/string_decoder');
 
-## Update
+const decoder = new StringDecoder('utf8');
+decoder.write(Buffer.from([0xe2, 0x82])); // '' — incomplete character held back
+decoder.write(Buffer.from([0xac])); // '€' — completed
+decoder.end(); // ''
+```
+
+## Requirements
+
+- Node.js >= 22.12
 
-The *build/* directory contains a build script that will scrape the source from the [nodejs/node](https://github.com/nodejs/node) repo given a specific Node version.
+## Testing
 
-## Streams Working Group
+The suite runs on Node's built-in test runner, with no third-party test
+dependencies:
 
-`string_decoder` is maintained by the Streams Working Group, which
-oversees the development and maintenance of the Streams API within
-Node.js. The responsibilities of the Streams Working Group include:
+```bash
+npm test
+```
 
-* Addressing stream issues on the Node.js issue tracker.
-* Authoring and editing stream documentation within the Node.js project.
-* Reviewing changes to stream subclasses within the Node.js project.
-* Redirecting changes to streams from the Node.js project to this
-  project.
-* Assisting in the implementation of stream providers within Node.js.
-* Recommending versions of `readable-stream` to be included in Node.js.
-* Messaging about the future of streams to give the community advance
-  notice of changes.
+## License
 
-See [readable-stream](https://github.com/nodejs/readable-stream) for
-more details.
+MIT. See [LICENSE](LICENSE).
diff --git a/build/.gitignore b/build/.gitignore