Cognito HTTP Basic Auth, Step Functions Lambda, and SNS async delivery fixes

June 25, 2026 · v1.3.68

v1.3.68 is a fixes release: Cognito OAuth2 HTTP Basic client authentication, two Step Functions lambda:invoke AWS-parity fixes, and asynchronous SNS to Lambda delivery — driven by reported issues and contributed PRs.

Cognito

• OAuth2 token endpoint URL-decodes HTTP Basic client credentials. A client_secret containing / or + arrives in the Authorization: Basic header as %2F/%2B (RFC 6749 §2.3.1 form-urlencodes the client id and secret before base64). MiniStack did not decode them, so client_secret_basic failed with invalid_client for any secret with special characters. The credentials are now decoded, matching the client_secret_post path. Reported by @pny-nc.

Step Functions

• lambda:invoke.waitForTaskToken delivers the unwrapped Payload. The callback path forwarded the whole service-integration envelope ({"FunctionName": ..., "Payload": {...}}) to the Lambda instead of just the Payload, unlike the synchronous lambda:invoke path. A handler reading its task token / input from the top level saw them nested under Payload, never resumed the task, and the execution hung until timeout. Contributed by @ryan-bennett.
• A failed lambda:invoke task sets Cause to a JSON-encoded error payload. Cause was the bare errorMessage string instead of AWS's JSON object ({"errorType": ..., "errorMessage": ..., "trace": [...]}), so Catch handlers and downstream tasks that json.loads(Cause) to read errorType/errorMessage failed to parse it. Cause now matches the AWS wire form. Contributed by @ryan-bennett.

SNS

• lambda subscribers are delivered to asynchronously. Fanout invoked a lambda-protocol subscriber synchronously inside Publish, so a slow or hung subscriber Lambda blocked the Publish call and its upstream caller (e.g. a Step Functions task publishing a notification). Delivery now runs on a background thread, matching AWS's asynchronous SNS→Lambda delivery, so Publish returns immediately. Contributed by @ryan-bennett.

Upgrade

docker pull ministackorg/ministack:1.3.68
docker run -d -p 4566:4566 ministackorg/ministack:1.3.68

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.3.68
    ports:
      - "4566:4566"