Odoo Changelog — 2026-09-11

Friday, September 11, 2026

2 changes · saas-19.3

Security(2)

Security fixes and vulnerability patches

[FIX] account_peppol: fix logger

Coresaas-19.3account_peppolSecurity

This change prevents full authentication tokens from being written to logs in the Peppol accounting integration. It helps reduce the risk of sensitive access information being exposed through internal log files while keeping troubleshooting possible.

Original PR description

don't log full token

Description of the issue/feature this PR addresses:

Current behavior before PR:

Desired behavior after PR is merged:




---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#287262

#peppol#logging#token#privacy

[FIX] discuss: use derived key for sfu

PR #287646

Coresaas-19.3mailSecurity

Discuss now uses a separate protected key for each call channel instead of sharing one general secret. This helps keep real-time communication access better isolated and reduces the risk of one channel affecting another.

Original PR description

derive channel-specific key from db secret and the channel id.

Forward-Port-Of: odoo/odoo#287561
Forward-Port-Of: odoo/odoo#286304

#discuss#calls#security