Saturday, September 12, 2026
2 changes · master
Security fixes and vulnerability patches
This change prevents full authentication tokens from being written to logs in the Peppol accounting integration. It reduces the risk of sensitive credential exposure while preserving useful logging for troubleshooting.
Original PR description
don't log full token Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#287738 Forward-Port-Of: odoo/odoo#287262
Discuss now creates a separate secure key for each call channel instead of relying on a shared secret alone. This reduces the risk of one channel's call access affecting another and helps keep real-time conversations better isolated.
Original PR description
derive channel-specific key from db secret and the channel id. Forward-Port-Of: odoo/odoo#287778 Forward-Port-Of: odoo/odoo#286304