FDC3 Maintainers meeting - April 8th, 2026

[kriswest]

Date

Wednesday 8th April 2026 - 9am (US eastern timezone EDT) / 2pm (London, BST)

Agenda (Reconstructed from Transcript)

• Updates on outstanding issues from previous meetings
• Status and blockers for 2.2.2 release preparations
  • Review of recent PRs and bug fixes:
    • Originating metadata handling
    • ESLint and linting configuration
    • Module type and build system issues
  • Discussion of context replay and conformance test gaps
  • Dependency updates and audit fixes
• OpenSSF scorecard and CI workflow improvements
• Node version support and matrix update plans
• Coverage reporting migration to CodeCov, removal of legacy tools
• Additional issues and next steps for release

Minutes

• Outstanding Issues / 2.2.2 Release Prep

  • @kriswest noted that an agenda hadn’t been prepared; posthoc agenda and minutes would be built from the transcript.
  • Main focus: preparing for the 2.2.2 release and addressing blockers and PRs.
  • Outstanding: “Originating App Metadata” handling and related bug fixes were reviewed and confirmed as ready to merge.
  • Next steps: merge bug fix PRs and resolve any conflicts with the larger metadata PR.

• Linting and Build System

  • @kriswest standardised ESLint configs across packages and resolved version disparities.
  • Addressed ESM vs. CommonJS build issues for FDC3 context; added missing type: module flag.
  • Workbench produces substantial lint errors; quick fixes applied, but some manual work remains.
  • Build system for FDC3 conformance package still uses Webpack; suggestion to migrate to Vite in future.

• Context Replay & Conformance Testing

  • Discovered a missing behaviour: context listeners do not always replay the current context as expected.
  • Identified likely missing or broken conformance tests for this feature.
  • Implementation gaps in the reference implementation and agents were discussed; needs a new conformance test.

• Dependency Management

  • Batch of PRs for dependency bumps mostly replaced with a single npm audit fix where possible.
  • Specific PR (1822, lodash update for website) was blocked due to version errors; to be retried using dependabot.

• OpenSSF Scorecard and CI Improvements

  • Scorecard results are slipping due to unpinned dependencies and outdated workflows.
  • Action items to pin GH Actions, update workflows, and improve branch protection.
  • Token permissions and coverage reporting flagged for improvement.

• Node Version Support

  • Node 20 EOL imminent. Plan to update testing matrix to Node 22, 24, and possibly 25.

• Coverage Reporting

  • Migration from NYC/Istanbul to CodeCov for coverage reporting.
  • Legacy scripts retained temporarily for fallback; will be removed once CodeCov is verified.
  • Coverage badge to be added to README.
  • Some packages (e.g. context/schema) lack real tests - but are confirming that generated code compiles and that examples validate - its hard to have meaningful coverage metrics for these tests - no need to calculate coverage for generated code/schema examples.

• Other Topics

  • Discussion of reviving the FDC3 “bridge” and multi-desktop workflows.
  • Several product strategy and open source adoption points raised for future consideration.

Action Items

• Merge the originating metadata and linting/configuration PRs once final fixes are made. (@kriswest)
• Fix remaining lint errors in Workbench, or adjust target to unblock PRs. (@kriswest)
• Raise and address missing/broken conformance test for context replay on listener add. (@kriswest)
• Migrate FDC3 conformance package build from Webpack to Vite (future, not blocking release). (@kriswest)
• Review and merge dependency bump PRs, resolve lodash/website build issue with dependabot. (@bingenito, @kriswest)
• Pin GitHub Actions dependencies in workflows for OpenSSF scorecard improvement. (@bingenito)
• Update Node test matrix to include Node 22, 24, and 25; deprecate Node 20. (@kriswest, @bingenito)
• Finalise and verify CodeCov transition; remove legacy coverage tools/scripts when stable. (@bingenito)
• Add CodeCov coverage badge to README.md. (@kriswest, @bingenito)
• Investigate and apply CodeQL integration for OpenSSF scorecard. (@bingenito)
• Raise issues for all of the above in GitHub for visibility and tracking. (@kriswest)
• Monitor for further issues during 2.2.2 release candidate preparation and testing. (all maintainers)

[pranitaurlam]

Hi @kriswest and
I've opened this PR to address the remaining action items from the April 8th maintainers meeting (#1836). Specifically, this PR covers:
Updated the Node.js test matrix to include Node 22, 24, and 25 (deprecating Node 20)
Pinned GitHub Actions dependencies to commit SHAs for improved OpenSSF scorecard
Added a CodeQL workflow for OpenSSF scorecard compliance
Added the CodeCov coverage badge to
README.md
The EasyCLA check has now passed. Could you please approve the 4 pending workflows so the CI tests can run? Happy to make any adjustments based on your feedback.