fix: address CI findings — psycopg2.sql composition in migrations, regenerate spp_gis README

Semgrep flagged f-string SQL in the tag migration scripts; identifiers were
constants but composed SQL via psycopg2.sql removes the pattern entirely.
README.rst regenerated from the updated HISTORY fragment (in-scope module
only).

Author: gonzalesedwin1123

spp_gis/README.rst

@@ -131,6 +131,20 @@ External Python libraries: ``shapely``, ``pyproj``, ``geojson``
 Changelog
 =========
 
+19.0.2.1.0
+~~~~~~~~~~
+
+- feat: spatial operators support MultiPolygon and GeometryCollection,
+  including distance buffering (re-land from #76).
+- feat: OSM style fallback in map renderer/edit widgets when no MapTiler
+  API key is configured; placeholder key treated as unconfigured
+  (re-land from #76).
+- feat: geofence GeoJSON output includes the record uuid as feature id;
+  new ``spp.gis.geofence.tag`` model replaces vocabulary-based geofence
+  tags (re-land from #76).
+- feat: migration remaps existing vocabulary-based geofence tag links
+  onto ``spp.gis.geofence.tag`` records when upgrading from 19.0.2.0.x.
+
 19.0.2.0.0
 ~~~~~~~~~~
 

spp_gis/migrations/19.0.2.1.0/post-migration.py

@@ -8,6 +8,8 @@
 
 import logging
 
+from psycopg2 import sql
+
 from odoo import SUPERUSER_ID, api
 
 _logger = logging.getLogger("odoo.addons.spp_gis.migrations.geofence_tags")
@@ -26,8 +28,9 @@ def migrate(cr, version):
 
     env = api.Environment(cr, SUPERUSER_ID, {})
     Tag = env["spp.gis.geofence.tag"]
+    aux = sql.Identifier(AUX_TABLE)
 
-    cr.execute(f"SELECT DISTINCT vocab_name FROM {AUX_TABLE}")
+    cr.execute(sql.SQL("SELECT DISTINCT vocab_name FROM {aux}").format(aux=aux))
     tag_ids_by_name = {}
     for (name,) in cr.fetchall():
         tag = Tag.search([("name", "=", name)], limit=1)
@@ -36,7 +39,7 @@ def migrate(cr, version):
         tag_ids_by_name[name] = tag.id
 
     restored = 0
-    cr.execute(f"SELECT geofence_id, vocab_name FROM {AUX_TABLE}")
+    cr.execute(sql.SQL("SELECT geofence_id, vocab_name FROM {aux}").format(aux=aux))
     for geofence_id, name in cr.fetchall():
         cr.execute(
             """
@@ -48,7 +51,7 @@ def migrate(cr, version):
         )
         restored += cr.rowcount
 
-    cr.execute(f"DROP TABLE {AUX_TABLE}")
+    cr.execute(sql.SQL("DROP TABLE {aux}").format(aux=aux))
     _logger.info(
         "spp_gis geofence tag migration: created %s tags, restored %s links",
         len(tag_ids_by_name),

spp_gis/migrations/19.0.2.1.0/pre-migration.py

@@ -14,6 +14,8 @@
 
 import logging
 
+from psycopg2 import sql
+
 _logger = logging.getLogger("odoo.addons.spp_gis.migrations.geofence_tags")
 
 AUX_TABLE = "spp_gis_geofence_tag_legacy_migration"
@@ -32,37 +34,43 @@ def migrate(cr, version):
     # table (only possible when this migration reruns or in tests); it is
     # legacy if it references a vocabulary instead. Checking the new table
     # first resolves numeric id collisions in favor of valid links.
-    new_table_exists = _table_exists(cr, "spp_gis_geofence_tag")
-    valid_clause = (
-        "AND rel.tag_id NOT IN (SELECT id FROM spp_gis_geofence_tag)" if new_table_exists else ""
-    )
+    if _table_exists(cr, "spp_gis_geofence_tag"):
+        valid_clause = sql.SQL("AND rel.tag_id NOT IN (SELECT id FROM spp_gis_geofence_tag)")
+    else:
+        valid_clause = sql.SQL("")
 
+    aux = sql.Identifier(AUX_TABLE)
     cr.execute(
-        f"""
-        CREATE TABLE IF NOT EXISTS {AUX_TABLE} (
-            geofence_id integer NOT NULL,
-            vocab_name varchar NOT NULL
-        )
-        """
+        sql.SQL(
+            """
+            CREATE TABLE IF NOT EXISTS {aux} (
+                geofence_id integer NOT NULL,
+                vocab_name varchar NOT NULL
+            )
+            """
+        ).format(aux=aux)
     )
     cr.execute(
-        f"""
-        INSERT INTO {AUX_TABLE} (geofence_id, vocab_name)
-        SELECT rel.geofence_id,
-               -- name is a translated (jsonb) field: prefer en_US, else any value
-               COALESCE(v.name->>'en_US', (SELECT t.value FROM jsonb_each_text(v.name) t LIMIT 1))
-        FROM spp_gis_geofence_tag_rel rel
-        JOIN spp_vocabulary v ON v.id = rel.tag_id
-        WHERE true {valid_clause}
-        """
+        sql.SQL(
+            """
+            INSERT INTO {aux} (geofence_id, vocab_name)
+            SELECT rel.geofence_id,
+                   COALESCE(v.name->>'en_US', (SELECT t.value FROM jsonb_each_text(v.name) t LIMIT 1))
+            FROM spp_gis_geofence_tag_rel rel
+            JOIN spp_vocabulary v ON v.id = rel.tag_id
+            WHERE true {valid_clause}
+            """
+        ).format(aux=aux, valid_clause=valid_clause)
     )
     parked = cr.rowcount
     cr.execute(
-        f"""
-        DELETE FROM spp_gis_geofence_tag_rel rel
-        USING spp_vocabulary v
-        WHERE v.id = rel.tag_id {valid_clause}
-        """
+        sql.SQL(
+            """
+            DELETE FROM spp_gis_geofence_tag_rel rel
+            USING spp_vocabulary v
+            WHERE v.id = rel.tag_id {valid_clause}
+            """
+        ).format(valid_clause=valid_clause)
     )
     _logger.info(
         "spp_gis geofence tag migration: parked %s legacy vocabulary tag links (%s rows removed)",

spp_gis/static/description/index.html

@@ -507,6 +507,21 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
 </div>
 </div>
 <div class="section" id="section-1">
+<h1>19.0.2.1.0</h1>
+<ul class="simple">
+<li>feat: spatial operators support MultiPolygon and GeometryCollection,
+including distance buffering (re-land from #76).</li>
+<li>feat: OSM style fallback in map renderer/edit widgets when no MapTiler
+API key is configured; placeholder key treated as unconfigured
+(re-land from #76).</li>
+<li>feat: geofence GeoJSON output includes the record uuid as feature id;
+new <tt class="docutils literal">spp.gis.geofence.tag</tt> model replaces vocabulary-based geofence
+tags (re-land from #76).</li>
+<li>feat: migration remaps existing vocabulary-based geofence tag links
+onto <tt class="docutils literal">spp.gis.geofence.tag</tt> records when upgrading from 19.0.2.0.x.</li>
+</ul>
+</div>
+<div class="section" id="section-2">
 <h1>19.0.2.0.0</h1>
 <ul class="simple">
 <li>Initial migration to OpenSPP2</li>