v0.0.53

Pain001 Release v0.0.53

Release Date: 2026-06-20
Tag: v0.0.53
Python: 3.10+
Status: Stable

Executive Summary

A security + observability + scheme-validation release. Closes
every open issue and every open code-scanning alert at the time of
the release. The public API surface is unchanged, so v0.0.52 callers
upgrade transparently.

This release also moves the project to a 100% enforced coverage
floor (line + branch + docstrings); regressions can no longer slip
past CI on a coverage drop.

What's in v0.0.53 at a glance

• SEPA B2B Direct Debit scheme profile (--scheme sepa-b2b) -
  enforces FRST/RCUR-only sequence types and a mandatory
  creditor identifier (issue #173).
• Redis-backed durable job store (PAIN001_JOB_STORE_URL) -
  async-job state survives restarts and is shared between replicas
  (issue #171).
• Redis-backed distributed rate limiter
  (PAIN001_RATE_LIMIT_BACKEND=redis) - per-client cap is now
  enforced across replicas behind a load balancer (issue #172).
• Official multi-arch Docker image at
  ghcr.io/sebastienrousseau/pain001 (issue #169) - Python
  3.12-slim, non-root user, multi-arch linux/amd64 + linux/arm64,
  provenance attestations.
• Typed OpenAPI client SDK pipeline with drift-guard CI (issue
  #170) - new sdk.yml workflow runs openapi-generator-cli and
  fails CI when scripts/export_openapi.py drifts from the live spec.
• Hosted interactive Scalar API reference (issue #174) - bundled
  into the Sphinx site at
  https://sebastienrousseau.github.io/pain001/api-reference.html.
• pip-audit replaces safety for the security gate (issue
  #175). safety scan v3 required an interactive auth prompt that
  hung CI; pip-audit covers the same OSV/PyPI advisory feed with
  no auth.
• CodeQL alert #176 (py/path-injection, high severity) fixed.

Quality gates (all enforced on every commit)

Gate	v0.0.52	v0.0.53
Tests	1,181	1,265
Line + branch coverage	99.85 % (98 % floor)	100 % (100 % floor)
Docstring coverage	100 %	100 %
Runnable examples	13	14
Open CodeQL alerts	1 (high)	0
Open security advisories on lockfile	(varies)	0

Use the new features

SEPA B2B Direct Debit

pain001 -t pain.001.001.03 -d payments.csv --scheme sepa-b2b --dry-run

from pain001 import validate_scheme
result = validate_scheme(rows, profile="sepa-b2b")
for v in result.violations:
    print(v.rule, v.field, v.message, v.remediation)

Redis-backed job store

pip install "pain001[redis]"
export PAIN001_JOB_STORE_URL=redis://my-redis:6379/0
pain001 serve --port 8000

Redis-backed distributed rate limiter

export PAIN001_RATE_LIMIT=100/minute
export PAIN001_RATE_LIMIT_BACKEND=redis
export PAIN001_RATE_LIMIT_REDIS_URL=redis://my-redis:6379/0

The per-client cap is now enforced across all replicas behind your
load balancer (in-process limiters only protect one worker).

Official multi-arch Docker image

docker pull ghcr.io/sebastienrousseau/pain001:0.0.53

docker run --rm -v "$PWD:/data" -w /data \
  ghcr.io/sebastienrousseau/pain001:0.0.53 \
  generate -t pain.001.001.03 -d payments.csv -o out.xml

docker run --rm -p 8000:8000 \
  ghcr.io/sebastienrousseau/pain001:0.0.53 \
  serve --host 0.0.0.0 --port 8000

Migration notes

There are no breaking changes. v0.0.52 callers upgrade transparently.
New optional features are opt-in via extras:

pip install --upgrade pain001
pip install "pain001[redis]"

Companion releases

pain001-mcp and pain001-lsp matching releases publish next, with
the new tools / features they gained alongside this release:

• pain001-mcp 0.0.53 - 3 new MCP tools (migrate_records,
  validate_xml_against_schema, sanitize_to_iso20022_charset).
  Total: 16 tools.
• pain001-lsp 0.0.53 - textDocument/formatting +
  textDocument/documentSymbol editor features. Total: 6 features.

Issues closed

#169, #170, #171, #172, #173, #174, #175 plus CodeQL alert #176.

Verify the release

pip install pain001==0.0.53
python -c "import pain001; print(pain001.__version__)"
# 0.0.53

docker pull ghcr.io/sebastienrousseau/pain001:0.0.53
docker run --rm ghcr.io/sebastienrousseau/pain001:0.0.53 --version

---

Full changelog: CHANGELOG.md