Roadmap: stabilise on Node 18, then upgrade to Node 22+

[VirtueMe]

Overview

This issue tracks the planned improvements for the project now that active maintainership has resumed. The strategy is two-phased around Node.js compatibility:

Phase A — Stabilise on Node 18: fix all outstanding bugs, improve test coverage, modernise tooling. Every change lands as a patch or minor release. No breaking changes.

Phase B — Upgrade to Node 22+: once Phase A is stable, drop Node 18 support (EOL March 2026) and target Node 22 as the minimum. This triggers a major version bump via `feat!:`.

---

Phase A — Stabilise (Node 18, non-breaking)

✅ A1 — SNS→SQS CloudFormation routing fix

• PR fix: pass queueName through CloudFormation resource subscriptions to enable SNS→SQS routing #222 — extract `QueueName` from `AWS::SQS::Queue` resources and route correctly

✅ A2 — PR standards and release infrastructure

• PR ci: establish PR standards — semantic commits, PR template, commitlint, semantic-release, all-contributors #230 — PR template, CONTRIBUTING.md, commitlint, semantic-release, all-contributors bot
• Releases are now fully automated via semantic-release on merge to main

✅ A3 — Fix pre-existing failing tests (#190)

• Root cause: `stop()` not awaiting server close, causing race conditions between tests
• All 27 tests now pass on Node 18 and Node 22

✅ A4 — Migrate tslint → eslint (#196)

• Replaced broken tslint (crashes on TypeScript 5) with ESLint 10 + typescript-eslint 8
• Using flat config format (`eslint.config.js`)

✅ A5 — TypeScript strictness

• Enable `strict: true` in `tsconfig.json`
• Replace implicit `any` with proper types
• Define proper interfaces for the Serverless instance shape

✅ A9 — Clean up README (#232)

• Remove stale "Looking for a maintainer" line
• Fix broken build status badge (references non-existent `build.yml`)
• Remove dead Serverless badge (`public.serverless.com` is down)

🔲 A6 — Refactor Lambda invocation to use InvokeCommand (#210)

• Replace the current JS-tied Lambda invocation with `@aws-sdk/client-lambda` `InvokeCommand`
• Prerequisite for feat: support lambda SNS subscription protocol #233

🔲 A7 — Support `lambda` SNS subscription protocol (#233)

• Allow SNS topics to invoke Lambdas directly without going through SQS
• Depends on Use @aws-sdk/client-lambda InvokeCommand to trigger handler. #210 (A6)

🔲 A8 — Clear open PRs and community backlog

• Review and merge Update index.ts #213 (LordAndreasOtten)
• Merge pending Dependabot PRs (Bump form-data from 4.0.0 to 4.0.4 #216, Bump lodash from 4.17.21 to 4.17.23 #219, Bump axios from 1.7.7 to 1.13.5 #220, Bump ajv from 8.12.0 to 8.18.0 #221)
• PublishBatch support (Support PublishBatch / PublishBatchCommand #215, Batch publish is not supported #205)

🔲 A10 — Serverless v4 explicit support (#214)

• Update peer dependency to support Serverless v4
• Validate hook lifecycle compatibility
• Serverless v4 requires Node >= 18.20.3, so compatible with Phase A

---

Phase B — Node 22+ upgrade (breaking, new major)

Once Phase A is complete and stable:

• Drop Node 18 (EOL) and Node 20 (Lambda EOL June 2026)
• Set Node 22 as minimum engine requirement
• Update CI matrix to Node 22 and 24
• Release as a major version: `feat!: drop Node 18/20, require Node 22+`

---

Release strategy

• All Phase A work lands as `fix:`, `feat:`, `docs:`, `ci:` commits → patch/minor releases
• Phase B transition is a single `feat!:` commit → major release
• semantic-release handles versioning automatically based on commit types

[VirtueMe]

Phase A — Complete ✅

All Phase A stabilisation work has been merged and released.

Completed since last update:

• ✅ A6 — Lambda InvokeCommand refactor (PR ci: add semantic-release for automated versioning and publishing #228)
• ✅ A7 — Lambda SNS subscription protocol (feat: support lambda SNS subscription protocol #233, PR refactor: Phase A stabilisation — tests, eslint, strict TypeScript #235)
• ✅ A8 — Community PRs cleared: Update index.ts #213 rejected, Fix #134 0.76.0: SNS -> publish to subscribed SQS queue, "Records" assumption leads to lost message, empty array. #134 #173/fix for #134, SNS->SQS structure fix #135 closed (fixed by us), Bump lodash from 4.17.21 to 4.17.23 #219 merged; Bump form-data from 4.0.0 to 4.0.4 #216/Bump axios from 1.7.7 to 1.13.5 #220/Bump ajv from 8.12.0 to 8.18.0 #221 held for Phase B
• ✅ A11 — SNS→SQS non-raw message loss (0.76.0: SNS -> publish to subscribed SQS queue, "Records" assumption leads to lost message, empty array. #134)
• ✅ A12 — HTTP delivery retry (Add basic SNS Delivery Policy implementation #87)
• ✅ A13 — FilterPolicyScope MessageBody (Support for subsciption filter policy from SNS->SQS #170)
• ✅ A14 — CloudFormation Protocol:sqs wrong endpoint ([Bug]: SNS -> SQS Subscription wrong ARN when working with localstack- Invalid parameter: SQS endpoint ARN #179)
• ✅ A15 — PublishBatch support (Support PublishBatch / PublishBatchCommand #215)

All shipped in PR #249.

Moved to Phase B:

• A10 — Serverless v4 explicit support (Add full support for Serverless Framework v4 (and native build.esbuild) #214) — requires Node 22+
• Dependabot bumps Bump form-data from 4.0.0 to 4.0.4 #216, Bump axios from 1.7.7 to 1.13.5 #220, Bump ajv from 8.12.0 to 8.18.0 #221 — parent packages require Node 22 to upgrade

Phase B will begin with feat!: drop Node 18/20, require Node 22+.