v1.3.62

What's Changed

New Contributors

• @lucasmfraser made their first contribution in #887
• @maximoosemine made their first contribution in #890

[1.3.62] — 2026-06-11

Added

• Glue — Iceberg REST Catalog (Glue-backed) — read-path subset of the Apache Iceberg REST OpenAPI at /iceberg, mirroring AWS Glue's glue.<region>.amazonaws.com/iceberg endpoint (prefix shape catalogs/{catalog}), served on the glue credential scope — distinct from the S3 Tables Iceberg surface, exactly as on real AWS. GET /v1/config, ListNamespaces, GetNamespace, ListTables, LoadTable, HEAD TableExists; writes return 501. A Glue table participates when its Parameters["metadata_location"] points at an Iceberg metadata.json on MiniStack S3 (written by an external engine such as Trino/Spark; passed through verbatim). Lets DuckDB's iceberg extension ATTACH against MiniStack (requires USE_SSL=1). Contributed by @yonatoasis.
• Glue — ColumnStatistics API family (Table + Partition) — UpdateColumnStatisticsForTable / GetColumnStatisticsForTable / DeleteColumnStatisticsForTable and the *ForPartition equivalents, with AWS's {ColumnStatisticsList, Errors} / {Errors} response shapes and per-column EntityNotFoundException error entries. Stats are account-scoped, persisted, and cleared when the owning table/partition is deleted. Contributed by @yonatoasis.

Fixed

• CloudFormation — DescribeStackEvents returns the initial REVIEW_IN_PROGRESS event for change-set-created stacks — CreateChangeSet with --change-set-type CREATE left the placeholder stack in REVIEW_IN_PROGRESS but seeded an empty event list, so DescribeStackEvents returned [] and tools reading StackEvents[0] (notably sam deploy) crashed with IndexError. The placeholder stack now emits the REVIEW_IN_PROGRESS event for the AWS::CloudFormation::Stack resource on creation. Contributed by @maximoosemine.
• Step Functions — ecs:runTask / ecs:runTask.sync no longer drop ContainerOverrides — the Pascal→camelCase conversion at the SFN→ECS hand-off only covered top-level Parameters keys, so nested Overrides.ContainerOverrides (including resolved "Value.$" entries) and NetworkConfiguration stayed PascalCase and were silently ignored — the container ran with task-definition environment only while the .sync state still succeeded. The conversion is now recursive. Contributed by @lucasmfraser.
• Lambda — layers are reachable in the docker executor, and zip permissions are preserved — the docker RIE executor extracted each layer to /opt/layer_N, which is not on the runtime's search path, so import from a layer failed; layer contents now merge into /opt (so /opt/python, /opt/lib, /opt/bin resolve), exactly as on real AWS. Layer and function zip extraction now also restores unix mode bits, so /opt/bin tools and bundled binaries keep their +x. Reported by @omargr299.
• awslocal works in TLS mode without --no-verify-ssl — the wrapper now resolves MiniStack's TLS certificate (the auto-generated ${TMPDIR}/ministack-tls/server.crt, or a MINISTACK_SSL_CERT / MINISTACK_CA_BUNDLE override) and exports AWS_CA_BUNDLE only when it points at a real file, so the AWS CLI verifies the cert instead of failing — plain-HTTP usage is untouched. Reported by @ChronosMasterOfAllTime.
• Lambda — restored SQS event source mappings resume polling after a warm restart — the ESM poller is started from lambda_svc's import-time restore, but the module was imported lazily only on a Lambda request, so after a persisted restart a pure-SQS workload (just sending to a mapped queue) never started the poller and the restored mapping sat Enabled but unpolled while messages piled up. lambda_svc is now eager-imported at boot when persisted ESMs exist, so polling resumes exactly like a fresh CreateEventSourceMapping. Reported by @ChronosMasterOfAllTime.