Skip to content

Release v0.0.28

Choose a tag to compare

View all tags
@sebastienrousseau sebastienrousseau released this 09 Jan 12:52
v0.0.28
0878124

Release Notes - v0.0.28 - 2026-01-09

Pain001: Automate ISO 20022-Compliant Payment File Creation

Pain001 banner

Overview

Pain001 is an open-source Python Library that you can use to create
ISO 20022-Compliant Payment Files directly from your CSV or SQLite
Data Files.

🔒 Critical Security Updates

This release addresses multiple high-severity security vulnerabilities in dependencies. All users are strongly encouraged to upgrade immediately.

CVE-2026-21441 - urllib3 Decompression Bomb Bypass (CVSS 8.9 High)

Impact: Fixed a critical security vulnerability where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed.

Action Taken: Updated urllib3 from 2.6.0 to 2.6.3

Details:

  • Affected versions: urllib3 < 2.6.3
  • Attack vector: Remote attackers could cause denial of service through crafted HTTP responses with redirects
  • Detection: GitHub Security Advisory GHSA-38jv-5279-wg99

Jinja2 Sandbox Escape Vulnerabilities

Impact: Fixed multiple sandbox escape vulnerabilities in Jinja2 template engine that could allow attackers to bypass security restrictions.

Action Taken: Updated jinja2 from 3.1.4 to 3.1.6

Vulnerabilities Fixed:

  1. GHSA-cpwx-vrp4-4pq7 - The |attr filter no longer bypasses the environment's attribute lookup, allowing the sandbox to properly apply its security checks
  2. GHSA-q2x7-8rv6-6q7h - Sandboxed environment now handles indirect calls to str.format, preventing exploitation through stored references
  3. GHSA-gmj6-6f8f-6699 - Template names are properly escaped before formatting into error messages, preventing f-string injection attacks

Additional Jinja2 Improvements:

  • Sandbox no longer allows clear and pop on known mutable sequence types
  • Fixed async generator handling to avoid unclosed warnings
  • Improved error messages from FileSystemLoader and PackageLoader

Setuptools Security Updates

Action Taken: Updated setuptools from 70.0.0 to 78.1.1

Security Improvements:

  • More secure filename sanitization in PackageIndex._download
  • Enhanced path resolution to prevent directory traversal attacks
  • Multiple stability and compatibility improvements

🔧 Infrastructure Updates

GitHub Actions Security

Updated: pypa/gh-action-pypi-publish from 1.3.1 to 1.13.0

Security Fix: GHSA-vxmw-7h4f-hqxh - Multiple security improvements in PyPI publishing workflow

  • Enhanced diagnostic output for troubleshooting
  • Warnings for unsupported reusable workflow configurations
  • SHA-pinning support for enhanced security policies
  • Python 3.13 runtime support

CI/CD Improvements

Automated Publishing Disabled:

  • Removed automatic PyPI publishing from CI pipeline
  • Removed automatic GitHub release creation from CI pipeline
  • Reason: Prevents conflicts with manual release processes and provides better control over release timing and content

Benefits:

  • No more tag/version conflicts when manually releasing
  • Better control over release notes and changelog
  • Cleaner separation between CI testing and release management

📁 Project Organization

Release Notes Structure

New: Created releases/ folder for better organization

  • Moved release notes from root to releases/ directory
  • Simplified naming: RELEASE_NOTES_v0.0.26.md → v0.0.26.md
  • Easier to browse historical releases

Structure:

releases/
├── v0.0.26.md
├── v0.0.27.md
└── v0.0.28.md

📦 Updated Dependencies

Package Previous Current Notes
urllib3 2.6.0 2.6.3 Critical security fix
jinja2 3.1.4 3.1.6 Multiple security fixes
setuptools 70.0.0 78.1.1 Security + stability

🧪 Testing

All 71 existing tests continue to pass with 100% success rate:

  • ✅ Unit tests: 71/71 passed
  • ✅ Code coverage: Maintained
  • ✅ Security scans: 0 high/medium severity issues
  • ✅ Import tests: All modules importable

📚 Migration Guide

Upgrading from v0.0.27

# Using pip
pip install --upgrade pain001

# Using poetry
poetry update pain001

# Verify installation
python -c "import pain001; print(pain001.__version__)"
# Should output: 0.0.28

Breaking Changes

None. This is a security and maintenance release with no breaking changes to the API or functionality.

Compatibility

  • Python 3.9+ (unchanged)
  • All existing code continues to work without modifications
  • No changes to public API

🔍 Security Scan Results

Bandit:

  • Medium/High severity issues: 0
  • Low severity (informational): 12

Safety:

  • Known vulnerabilities: 0
  • All dependencies up to date

🤝 Contributing

For security issues, please see our Security Policy.

For bug reports and feature requests, please use GitHub Issues.

📄 License

This project is licensed under the Apache Software License 2.0 - see the LICENSE-APACHE and LICENSE-MIT files for details.

🙏 Acknowledgments

  • GitHub Security Lab for vulnerability reports
  • Dependabot for automated security updates
  • The urllib3, Jinja2, and setuptools teams for prompt security patches

Full Changelog: v0.0.27...v0.0.28

Assets 2
Loading