ministackorg/ministack v1.4.1

on GitHub

What's Changed

New Contributors

• @scottschreckengaust made their first contribution in #1056

[1.4.1] — 2026-07-09

Added

• EKS — clusters pull images from local ECR — every k3s cluster now boots with an auto-generated /etc/rancher/k3s/registries.yaml that mirrors the cluster's ECR registry hostname (<account>.dkr.ecr.<region>.amazonaws.com) to the MiniStack gateway, so kubectl run --image <account>.dkr.ecr.<region>.amazonaws.com/repo:tag pulls an image you pushed to local ECR — no manual registry wiring. The mirror endpoint is MiniStack's own address on the shared Docker network when one is detected, and host.docker.internal (added to the k3s container via host-gateway) when MiniStack runs on the host. Verified end-to-end: image pushed to local ECR, pod pulled and reached Running. Reported by @L3337.
• RDS — Aurora MySQL version-to-image mapping and MySQL 8.4 support — Aurora MySQL containers now boot the MySQL image matching the requested engine version track (5.7 / 8.0 / 8.4) instead of the floating mysql:8 tag, which had started silently booting MySQL 8.4 for Aurora MySQL 8.0 test cases. DescribeDBEngineVersions returns the full creatable Aurora MySQL catalog with correct per-family parameter groups — including the new 8.4.mysql_aurora.8.4.7 / aurora-mysql8.4 (GA 2026-05-21) — an explicit EngineVersion not in the catalog is rejected with the AWS error shape, and aurora-mysql8.4 parameter-group defaults omit skip-character-set-client-handshake (removed in MySQL 8.4) while older families keep it. The default Aurora MySQL version moves from the no-longer-creatable 8.0.mysql_aurora.3.03.0 to 8.0.mysql_aurora.3.10.3. Contributed by @Areson.

Changed

• EventBridge Pipes — region-isolated state — pipe records and stream positions move to account+region scope (continuing the 1.4.0 multi-region work), so same-name pipes in different regions no longer collide, and the background poller processes each pipe under its own account and region. Legacy persisted state migrates by recovering each pipe's region from its ARN. Contributed by @Areson.
• Docker images — Python 3.13 base — both images (Dockerfile Alpine and Dockerfile.full Debian) move from python:3.12 to python:3.13, clearing the CPython 3.12 interpreter CVEs flagged by image scanners; CI now runs the test suite on 3.13 to match the shipped interpreter. Dockerfile.full also runs apt-get upgrade so Debian base packages pick up security patches on every rebuild, as its comment always claimed and as the Alpine image already did. Contributed by @scottschreckengaust.

Fixed

• Lambda — concurrent provided.* invocations no longer fail with ETXTBSY ("Text file busy") — each invocation extracted the function zip into its own temp directory and exec'd the bootstrap binary from it; while one thread still held the extraction's write descriptor, another thread's process spawn let the child inherit it, and executing the binary failed with ETXTBSY (a classic CPython fork/exec race). Extraction is now content-addressed — one shared read-only directory per code sha256, matching real Lambda's read-only /var/task — and spawns are serialized against extraction so the race cannot occur. Reported by @crestonbunch.
• Lambda — provided.* runtime env restores AWS_LAMBDA_FUNCTION_MEMORY_SIZE, AWS_LAMBDA_FUNCTION_VERSION, and AWS_LAMBDA_LOG_STREAM_NAME — 1.4.0's reserved-name filtering stripped these from the user environment, and the provided-runtime executor (unlike the container, local, and warm-worker paths) never re-injected them from the function config, so the Rust lambda_runtime crate — which requires AWS_LAMBDA_FUNCTION_MEMORY_SIZE — crashed on startup. All three are now set from the function configuration, matching the other executors and real AWS. Reported by @crestonbunch.
• Lambda — SQS event source mappings deliver messageAttributes in camelCase — records forwarded to functions carried the PascalCase inner keys SQS uses on the wire (StringValue/DataType/BinaryValue), but real Lambda re-serializes them to camelCase (stringValue/dataType/…) before invoking. Typed handler bindings — e.g. Java's SQSEvent.MessageAttribute, which Jackson populates case-strictly — saw all-null attributes and failed on messages whose attributes were set correctly. The ESM now performs the same camelCase transformation as AWS at the delivery boundary; the SQS API surface itself is unchanged. Reported by @w-zx.
• S3 — versionId survives payload persistence to a volume — with S3_PERSIST=1, the on-disk .meta.json sidecar never recorded the object's version_id, and all four write paths (PutObject, POST upload, CopyObject, CompleteMultipartUpload) persisted the sidecar before the version id was assigned — so after a restart, GET/HEAD returned no x-amz-version-id for objects on the volume. The sidecar now stores the version id and is written after version assignment, so the current version id of every object survives restarts. (Historical version data is still memory-only; full version-history persistence is tracked separately.) Reported by @adzcodemi.
• Cognito — ListUsers parses quoted attribute names in Filter — the filter parser only matched unquoted attribute names, but AWS's documented syntax also accepts the quoted form ("email" = "value" — used in AWS's own API-reference sample request), and on any parse failure MiniStack silently returned all users. Both forms now parse (including the docs' no-space "email"^="value" shape), and an unparseable filter logs a warning. Contributed by @kjdev.