unabandoned · package dashboard

Live status of every @unabandoned/* maintained fork — pending updates, open PRs and issues, latest release, CI, and what each package is used for.

Auto-generated from each fork's .unabandoned.yml and the GitHub API. Last built 2026-08-15 06:27 UTC. This page is never hand-edited — see build_dashboard.py.

27
packages tracked
14
open pull requests
29
open issues
0
with security work
2
CI failing

Dependency topology

open full view →
browser-packbrowser-resolvebrowser-unpackbrowserifybrowserify-zlibbuffercombine-source-mapcrypto-browserifydeps-sortdetectiveeventsinsert-module-globalsjsonstreamlabeled-stream-splicermodule-depspath-browserifyrandexpreadable-streamretstream-httpstream-splicerstring_decodersyntax-errorundeclared-identifiersurlutilxml-js
CI greenfailing / securityrelease-pending / seeking-replacementconsumer (external)edges = dependency (derived from package.json + used-by)

Transitive dependency audit

open full audit →
143
packages in the trees
63
time bombs
46
inert (suppressible)
34
alive
34
invisible to every dashboard

34 of 63 time bombs appear in no fork's package.json, so no dependency dashboard in the org shows them. 22 package(s) this org already maintains are still being pulled from the abandoned upstream by 11 fork(s) — repointing those at their siblings is the largest single win available.

Upstream packageStateLast releasePulled by
buffertime bomb2020-11-23@unabandoned/browserify, @unabandoned/deps-sort, @unabandoned/insert-module-globals, @unabandoned/labeled-stream-splicer, @unabandoned/readable-stream, @unabandoned/stream-http, @unabandoned/stream-splicer
eventsinert2021-02-27@unabandoned/browserify, @unabandoned/deps-sort, @unabandoned/insert-module-globals, @unabandoned/labeled-stream-splicer, @unabandoned/readable-stream, @unabandoned/stream-http, @unabandoned/stream-splicer
readable-streamtime bomb2025-01-07@unabandoned/browserify, @unabandoned/crypto-browserify, @unabandoned/deps-sort, @unabandoned/insert-module-globals, @unabandoned/labeled-stream-splicer, @unabandoned/stream-http, @unabandoned/stream-splicer
string_decodertime bomb2019-08-07@unabandoned/browserify, @unabandoned/crypto-browserify, @unabandoned/deps-sort, @unabandoned/insert-module-globals
combine-source-maptime bomb2017-03-20@unabandoned/browser-pack, @unabandoned/browserify, @unabandoned/insert-module-globals
browser-resolvetime bomb2020-08-03@unabandoned/browserify, @unabandoned/module-deps
alive released within a yearinert abandoned, zero deps — cannot rottime bomb abandoned with its own deps — nobody left to bump them

Packs a JSON stream of Node-style module records into a single self-contained browser bundle with a runtime require() shim.

Upstream: browserify/browser-pack — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A core browserify pipeline stage that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versionbrowser-pack-v6.1.4open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Emits the final packed browser bundle at the end of the pipeline.
browserifybundlepackcommonjs

Node-style module resolution that honours the "browser" field in package.json so browser builds pick browser-specific replacements.

Upstream: browserify/browser-resolve — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A core browserify resolution helper that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versionbrowser-resolve-v2.0.2open PRs1open issues1updatesdependency dashboard
Used by 2 consumers
  • @unabandoned/browserify — Resolves module paths with browser-field overrides during bundling.
  • @unabandoned/module-deps — Resolves each require() target while walking the dependency graph.
browserifyresolvebrowser-field

Parses a bundle produced by browser-pack back into the JSON array of module records it was built from — the inverse of browser-pack.

Upstream: browserify/browser-unpack — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A browserify companion tool that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versionbrowser-unpack-v1.4.7open PRs0open issues1updatesdependency dashboard
browserifyunpackbundledebug

Bundler that lets you require() Node-style modules in the browser by walking the dependency graph and packing it into a single browser bundle.

Upstream: browserify/browserify — unmaintained upstream — the bundler sits idle while its large dependency tree ages

Why forked: The hub of the browserify ecosystem went unmaintained while its deep dependency tree aged; forked so Renovate keeps the whole tree current for the consumers that still bundle with it.

browserbundlerrequirecommonjsbrowserify

Node's core `zlib` compression module reimplemented for the browser, built on the pako deflate/inflate library.

Upstream: devongovett/browserify-zlib — unmaintained upstream — released 0.2.0 and left idle while its dependency tree ages

Why forked: A browserify core-module shim that went unmaintained while its tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionbrowserify-zlib-v2.0.2open PRs1open issues1updatesdependency dashboard
browserzlibcompressionnode-core-polyfillbrowserify

@unabandoned/buffer unabandoned/buffer

CI passingrelease pending

Node.js's Buffer API implemented in pure JavaScript for the browser and other environments that lack Node's built-in Buffer.

Upstream: feross/buffer — unmaintained upstream — released and left idle while its dependency tree ages

Why forked: A transitive dependency of browserify-style bundling that went unmaintained while its tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionbuffer-v6.0.5open PRs1open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Buffer polyfill bundled into browser builds in place of Node's built-in.
browserbuffernode-core-polyfillbrowserify

Combines the source maps of multiple files — offsetting each — into a single source map for a concatenated bundle.

Upstream: thlorenz/combine-source-map — unmaintained upstream — left idle while its dependency tree ages

Why forked: A browserify source-map helper that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versioncombine-source-map-v1.0.1open PRs1open issues1updatesdependency dashboard
Used by 2 consumers
  • @unabandoned/browser-pack — Builds the combined source map for the packed bundle.
  • @unabandoned/insert-module-globals — Keeps source maps aligned after implicit globals are injected.
browserifysource-mapbundle

A browser implementation of Node's `crypto` module — it wires together the standalone hash, HMAC, cipher, sign, DH, ECDH, PBKDF2 and RNG packages behind the same API, so bundled code that calls `require('crypto')` keeps working.

Upstream: browserify/crypto-browserify — the aggregator package is unmaintained (last release 2024-10) while carrying outdated dependency pins over a large, security-sensitive crypto tree

Why forked: A direct dependency of @unabandoned/browserify and the umbrella over the whole browser-crypto tree. The aggregator itself went unmaintained (unlike several of its leaves, which are still shipping); forked so we own it and keep its dependency tree current with Renovate rather than letting an abandoned metapackage pin the crypto stack in the browserify graph.

versioncrypto-browserify-v3.13.0open PRs1open issues2updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Provides the browser polyfill for Node's crypto module in bundles.
browserifycryptopolyfillsecurity

Sorts a module-deps dependency stream into a stable order so browserify produces deterministic, reproducible bundles.

Upstream: browserify/deps-sort — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A core browserify pipeline stage that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versiondeps-sort-v2.0.3open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Orders module records so bundle output is deterministic.
browserifysortdeterminismdependency-graph

@unabandoned/detective unabandoned/detective

CI passingrelease pending

Finds all require() calls in a JavaScript source file by walking its AST, without executing the code.

Upstream: browserify/detective — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A core browserify analysis helper that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versiondetective-v5.2.3open PRs1open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/module-deps — Extracts require() targets from each module while building the graph.
browserifyastrequirestatic-analysis

@unabandoned/events unabandoned/events

CI passingrelease pending

Node.js's EventEmitter implemented for the browser and other environments that don't ship Node's built-in `events` module.

Upstream: browserify/events — unmaintained upstream — the package sits idle while its dev-dependency tree ages

Why forked: A transitive dependency of browserify-style bundling that went unmaintained while its dev tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionevents-v3.3.3open PRs1open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — EventEmitter polyfill bundled into browser builds in place of Node's built-in.
browsereventsshimnode-core-polyfill

Detects and injects implicit Node globals (process, Buffer, __dirname, etc.) into modules as they pass through a module-deps stream.

Upstream: browserify/insert-module-globals — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A core browserify pipeline stage that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

Used by 1 consumer
  • @unabandoned/browserify — Shims Node's implicit module globals into browser bundles.
browserifyglobalsprocessbuffer

Streaming JSON.parse and stringify — pipe a raw JSON byte stream through a path selector and emit the matching values as objects, or the reverse.

Upstream: dominictarr/JSONStream — unmaintained since 2018 while carrying an abandoned `through` runtime dependency

Why forked: A load-bearing leaf in the browserify pipeline that went unmaintained while shipping the abandoned `through` dependency; forked so we own the tree, drop the dead dependency, and keep the rest current for the consumers that pull it in transitively.

versionjsonstream-v1.4.0open PRs0open issues1updatesdependency dashboard
Used by 4 consumers
  • @unabandoned/module-deps — Streams the module dependency graph out as newline-delimited JSON records.
  • @unabandoned/deps-sort — Parses the incoming record stream and re-serializes it after sorting.
  • @unabandoned/insert-module-globals — Parses and re-emits the module record stream while injecting globals.
  • @unabandoned/browser-pack — Parses the JSON stream of module records it packs into the bundle.
browserifyjsonstreamparser

A stream splicer whose pipeline stages carry string labels, so stages can be addressed, fetched, spliced and replaced by name rather than index.

Upstream: browserify/labeled-stream-splicer — unmaintained since 2022 while pinned, through stream-splicer, to the abandoned readable-stream@2 line

Why forked: This is the pipeline abstraction browserify builds its bundle on: the labelled stages (record, deps, json, unbundle, pack, wrap) are what plugins hook into. It went unmaintained while inheriting readable-stream@2 through stream-splicer; forked so we own the tree and it rides on @unabandoned/stream-splicer (now on readable-stream 4), keeping readable-stream@2 out of the browserify graph.

Used by 1 consumer
  • @unabandoned/browserify — Builds the core bundle pipeline whose labelled stages plugins splice into.
browserifystreampipelinesplicerlabels

Walks the require() dependency graph of a set of entry files and emits a JSON stream of module records suitable for feeding into browser-pack.

Upstream: browserify/module-deps — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A core browserify pipeline stage that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versionmodule-deps-v6.2.9open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Builds the module dependency graph that the bundler packs.
browserifydependency-graphrequireast

Node's core `path` module reimplemented for the browser and other environments without Node's built-in path.

Upstream: browserify/path-browserify — unmaintained upstream — the package sits idle while its dev-dependency tree ages

Why forked: A transitive dependency of browserify-style bundling that went unmaintained while its tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionpath-browserify-v1.0.2open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Path polyfill bundled into browser builds in place of Node's built-in.
browserpathnode-core-polyfillbrowserify

@unabandoned/randexp unabandoned/randexp.js

CI passingrelease pending

Generates random strings that match a given regular expression.

Upstream: fent/randexp.js — unmaintained upstream — left idle while its dependency tree ages

Why forked: Abandoned upstream while carrying an outdated dependency (ret); forked alongside ret so Renovate keeps the pair current for consumers.

versionrandexp-v0.5.7open PRs1open issues1updatesdependency dashboard
regexrandomtesting

Node.js's streams implemented as a user-land package, so browsers and older Node versions get the current stream API.

Upstream: nodejs/readable-stream — upstream release cadence stalled at 4.7.0 while its dependency tree ages; this fork carries it forward

Why forked: Forked to keep its dependency tree current — re-scoped onto the @unabandoned buffer/events builds — and carried past the last upstream release so Renovate can track the tree for consumers.

versionreadable-stream-v4.8.1open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/stream-http — Provides the readable/writable stream implementation the HTTP shim builds on.
streamreadablenode-core-polyfillbrowserify

@unabandoned/ret unabandoned/ret.js

CI passingrelease pending

Tokenizes a string representing a regular expression into a structured token tree.

Upstream: fent/ret.js — unmaintained upstream — left idle while its dependency tree ages

Why forked: An abandoned regex-tokenizer dependency of randexp; forked so Renovate keeps its tree current for consumers.

versionret-v0.5.1open PRs1open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/randexp — Provides the regex token tree randexp walks to generate matches.
regexparsertokenizer

Streaming HTTP request implementation for the browser, backing Node's `http` API on top of XHR/fetch so bundled code can make requests.

Upstream: jhiesey/stream-http — unmaintained upstream — no new releases in years while its dependency tree ages

Why forked: A browserify HTTP shim that went unmaintained while its tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionstream-http-v3.3.2open PRs1open issues1updatesdependency dashboard
browserhttpstreamnode-core-polyfillbrowserify

A streaming pipeline with a mutable configuration — splice, push, pop, shift and unshift streams into a live Duplex while data flows through it.

Upstream: browserify/stream-splicer — unmaintained since 2022 while pinned to the abandoned readable-stream@2 line

Why forked: A load-bearing node in the browserify module pipeline (labeled-stream-splicer is built on it) that went unmaintained while still depending on readable-stream@2; forked so we own the tree, migrate it onto @unabandoned/readable-stream 4, and keep the readable-stream@2 copy out of the browserify dependency graph for good.

versionstream-splicer-v2.1.1open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/labeled-stream-splicer — Extends the splicer with string labels for each pipeline stage.
browserifystreampipelinesplicer

Node core's StringDecoder, which turns a series of buffers into strings without splitting multi-byte characters apart, packaged for userland and the browser.

Upstream: nodejs/string_decoder — frozen since 2019 at 1.3.0; the repo tracks a Node 8 era snapshot and its issues go unanswered

Why forked: Abandoned upstream while still shipping the abandoned safe-buffer runtime dependency, so nothing was keeping its tree current for the bundlers that pull it in. Forked so Renovate owns the tree; the safe-buffer shim has since been dropped, leaving the package with no runtime dependencies at all.

versionstring_decoder-v1.4.0open PRs0open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — The browser shim browserify injects for require('string_decoder').
stringdecodernode-core-polyfillbrowserify

Detects syntax errors in a source string and reports them with file, line and column context for readable build failures.

Upstream: browserify/syntax-error — unmaintained upstream in the browserify ecosystem — left idle while its dependency tree ages

Why forked: A browserify build helper that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

versionsyntax-error-v1.4.1open PRs1open issues1updatesdependency dashboard
Used by 1 consumer
  • @unabandoned/browserify — Produces readable syntax-error diagnostics during bundling.
browserifysyntaxparserdiagnostics

Finds undeclared identifiers and property accesses in a JavaScript file by walking its AST.

Upstream: goto-bus-stop/undeclared-identifiers — unmaintained upstream — left idle while its dependency tree ages

Why forked: A browserify analysis helper that went unmaintained while its dependency tree aged; forked so Renovate keeps that tree current for consumers.

Used by 1 consumer
  • @unabandoned/insert-module-globals — Locates the implicit globals that need to be shimmed in.
astidentifiersstatic-analysisbrowserify

@unabandoned/url unabandoned/node-url

CI passingrelease pending

Node's core `url` parsing module packaged standalone for use in the browser via bundlers like browserify.

Upstream: defunctzombie/node-url — unmaintained upstream — the package sits idle while its dependency tree ages

Why forked: A transitive dependency of browserify-style bundling that went unmaintained while its tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionurl-v0.11.5open PRs1open issues1updatesdependency dashboard
browserurlparsingnode-core-polyfillbrowserify

Node's core `util` module reimplemented for the browser and other environments without Node's built-in util.

Upstream: browserify/node-util — unmaintained upstream — the package sits idle while its dependency tree ages

Why forked: A transitive dependency of browserify-style bundling that went unmaintained while its tree aged; forked so Renovate keeps that tree current for the consumers that pull it in transitively.

versionutil-v0.12.7open PRs0open issues1updatesdependency dashboard
browserutilnode-core-polyfillbrowserify

@unabandoned/xml-js unabandoned/xml-js

CI passingrelease pending

Converts between XML text and JavaScript objects / JSON in both directions.

Upstream: nashwaan/xml-js — unmaintained upstream — left idle while its dependency and dev tree age

Why forked: Abandoned upstream while carrying an outdated dependency and dev tree; forked so Renovate keeps the tree current for consumers.

versionxml-js-v1.6.13open PRs1open issues1updatesdependency dashboard
xmljsonconverterparser