Odoo Changelog — 2026-06-03

Wednesday, June 3, 2026

2 changes

Security(1)

Security fixes and vulnerability patches

[FIX] point_of_sale: secure customer display URL

Coresaas-19.1point_of_saleHIGH

This update strengthens the security of customer display links within the Point of Sale module. Previously, a critical authorization issue meant links were constructed manually, potentially exposing customer data. Now, the access token is consistently included, ensuring proper authorization and protecting customer information.

Original PR description

The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token.

This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere.

#security#authorization#customer data

Bug Fixes(1)

Resolved issues and error corrections

[PERF] l10n_se_sie: prevent OOM crashes on SIE 4 report

PR #118849

Enterprisesaas-19.1l10n_se_sie4HIGH

This update resolves a critical issue where the Swedish SIE 4 report export would crash due to excessive memory usage. The fix dramatically improves performance by optimizing the data retrieval process, allowing for handling of large datasets in a fraction of the time. This ensures reliable and efficient report generation for our users.

Original PR description

### Description of the issue/feature this PR addresses: Prevent Out of Memory (OOM) crashes and drastically improve execution speed when generating the Swedish SIE4 verification export for massive…

### Description of the issue/feature this PR addresses:
Prevent Out of Memory (OOM) crashes and drastically improve execution speed when generating the Swedish SIE4 verification export for massive datasets.

### Current behavior before PR:
When exporting a large volume of journal entries (e.g., 190,000+ account moves), the `_export_l10n_se_sie4_verification` method relies on iterating through heavy ORM recordsets and accessing relational child fields (move.line_ids) inside a loop. This triggers a severe N+1 query problem, maxing out server RAM and causing an OOM crash.

### Desired behavior after PR is merged:
The method now utilizes a hybrid data extraction approach:
- The ORM is used strictly to safely evaluate domains (multi-company rules, dates, states) and fetch a lightweight list of valid move_ids.
- A single SQL query with JOIN statements fetches all parent moves, child lines, and account codes in exactly one database query.
- itertools.groupby chunks the flat, lightweight dictionary results back into their respective journal entries.
The export now handles massive datasets in seconds with minimal memory overhead, while remaining perfectly secure.

### Benchmark:

For Memory:
| # Input Data | Before PR | After PR |
| -------- | -------- | -------- |
| ~190,000 moves | MemoryError | 407MB|
| ~200,000 moves | 1.8GB | 174.8 MB|

For Speed:
| # Input Data | Before PR | After PR |
| -------- | -------- | -------- |
| ~190,000 moves | MemoryError | 5.10s |
| ~200,000 moves | 1m29s| 5.3s|

### Reference:
opw-6067999

Forward-Port-Of: odoo/enterprise#118449
Forward-Port-Of: odoo/enterprise#113227

#performance#SIE4#reporting

The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token. This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere.

### Description of the issue/feature this PR addresses: Prevent Out of Memory (OOM) crashes and drastically improve execution speed when generating the Swedish SIE4 verification export for massive datasets. ### Current behavior before PR: When exporting a large volume of journal entries (e.g., 190,000+ account moves), the `_export_l10n_se_sie4_verification` method relies on iterating through heavy ORM recordsets and accessing relational child fields (move.line_ids) inside a loop. This triggers a severe N+1 query problem, maxing out server RAM and causing an OOM crash. ### Desired behavior after PR is merged: The method now utilizes a hybrid data extraction approach: - The ORM is used strictly to safely evaluate domains (multi-company rules, dates, states) and fetch a lightweight list of valid move_ids. - A single SQL query with JOIN statements fetches all parent moves, child lines, and account codes in exactly one database query. - itertools.groupby chunks the flat, lightweight dictionary results back into their respective journal entries. The export now handles massive datasets in seconds with minimal memory overhead, while remaining perfectly secure. ### Benchmark: For Memory: | # Input Data | Before PR | After PR | | -------- | -------- | -------- | | ~190,000 moves | MemoryError | 407MB| | ~200,000 moves | 1.8GB | 174.8 MB| For Speed: | # Input Data | Before PR | After PR | | -------- | -------- | -------- | | ~190,000 moves | MemoryError | 5.10s | | ~200,000 moves | 1m29s| 5.3s| ### Reference: opw-6067999 Forward-Port-Of: odoo/enterprise#118449 Forward-Port-Of: odoo/enterprise#113227