Chore/lint config migration

.github/workflows/ci.yml

@@ -123,6 +123,7 @@ jobs:
     needs: [detect-changes, build]
     if: needs.detect-changes.outputs.has_modules == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -203,7 +204,6 @@ jobs:
                 --db_user=odoo \
                 --db_password=odoo \
                 --stop-after-init \
-                --no-http \
                 --data-dir /tmp/odoo-data \
                 -i ${{ matrix.module }} \
                 --test-tags=/${{ matrix.module }} \

.pre-commit-config.yaml

@@ -147,7 +147,8 @@ repos:
       # Phase 1: Simple pattern-based checks (pygrep)
       - id: openspp-no-assertraises-tuple
         name: "OpenSPP: No tuple in assertRaises"
-        description: "Odoo's assertRaises doesn't support tuple of exceptions like stdlib unittest"
+        description:
+          "Odoo's assertRaises doesn't support tuple of exceptions like stdlib unittest"
         entry: 'self\.assertRaises\s*\(\s*\('
         language: pygrep
         types: [python]
@@ -202,7 +203,8 @@ repos:
       # Phase 2: Compliance check (security spec validation)
       - id: openspp-compliance-check
         name: "OpenSPP: Security compliance check"
-        description: "Validate modules with compliance.yaml against actual security config"
+        description:
+          "Validate modules with compliance.yaml against actual security config"
         entry: python -m scripts.compliance.checker --all
         language: python
         additional_dependencies:
@@ -236,7 +238,9 @@ repos:
       # Phase 3: UI patterns check (warning only)
       - id: openspp-check-ui
         name: "OpenSPP: UI patterns"
-        description: "Check list limits, sample data, XPath syntax, statusbar location, extension points"
+        description:
+          "Check list limits, sample data, XPath syntax, statusbar location, extension
+          points"
         entry: python scripts/lint/check_ui_patterns.py
         language: python
         additional_dependencies:
@@ -272,7 +276,8 @@ repos:
       # API authentication enforcement
       - id: openspp-check-api-auth
         name: "OpenSPP: API endpoint authentication"
-        description: "Verify all API endpoints require authentication (allowlist for public)"
+        description:
+          "Verify all API endpoints require authentication (allowlist for public)"
         entry: python scripts/audit-api-auth.py --strict
         language: python
         pass_filenames: false
@@ -293,6 +298,7 @@ repos:
     hooks:
       - id: semgrep
         args: ["--config", ".semgrep/", "--error", "--quiet"]
+        additional_dependencies: ["setuptools<82"]
         # Only scan OpenSPP spp_* modules (not scripts, endpoint handlers, etc.)
         files: ^spp_
         # Exclude test files, migrations, and demo-only modules

.semgrep/odoo-security.yml

@@ -227,7 +227,8 @@ rules:
           - pattern: _logger.$METHOD(..., $RECORD.national_id, ...)
           - pattern: _logger.$METHOD(..., $RECORD.tax_id, ...)
           - pattern: _logger.$METHOD(..., $RECORD.vat, ...)
-    message: "Potential PII (national/tax ID) in log message - CRITICAL privacy violation."
+    message:
+      "Potential PII (national/tax ID) in log message - CRITICAL privacy violation."
     severity: ERROR
     languages: [python]
     metadata:

.trivyignore.yaml

@@ -12,59 +12,64 @@ vulnerabilities:
 
   - id: CVE-2023-2953
     statement:
-      "libldap-2.5-0 2.5.13: OpenLDAP null pointer dereference in ber_memalloc_x. No fix available in Debian 12. OpenSPP
-      uses PostgreSQL, not LDAP directly."
+      "libldap-2.5-0 2.5.13: OpenLDAP null pointer dereference in ber_memalloc_x. No fix
+      available in Debian 12. OpenSPP uses PostgreSQL, not LDAP directly."
     expiry_date: 2026-04-29
 
   - id: CVE-2023-45853
     statement:
-      "zlib1g 1.2.13: integer overflow in zipOpenNewFileInZip4_6 causing heap buffer overflow. No fix available in
-      Debian 12. Zip creation not exposed to untrusted input."
+      "zlib1g 1.2.13: integer overflow in zipOpenNewFileInZip4_6 causing heap buffer
+      overflow. No fix available in Debian 12. Zip creation not exposed to untrusted
+      input."
     expiry_date: 2026-04-29
 
   - id: CVE-2023-52355
     statement:
-      "libtiff6 4.5.0: TIFFRasterScanlineSize64 can produce oversized allocation causing OOM. No fix available. OpenSPP
-      does not process TIFF images from untrusted sources."
+      "libtiff6 4.5.0: TIFFRasterScanlineSize64 can produce oversized allocation causing
+      OOM. No fix available. OpenSPP does not process TIFF images from untrusted
+      sources."
     expiry_date: 2026-04-29
 
   # CVE-2025-15467 and CVE-2025-69419 (OpenSSL RCE): REMOVED.
   # Fix applied in docker/Dockerfile (apt-get upgrade libssl3 openssl).
 
   - id: CVE-2025-7458
     statement:
-      "libsqlite3-0 3.40.1: integer overflow in SQLite. No fix available in Debian 12. SQLite is not the primary
-      database (PostgreSQL is used)."
+      "libsqlite3-0 3.40.1: integer overflow in SQLite. No fix available in Debian 12.
+      SQLite is not the primary database (PostgreSQL is used)."
     expiry_date: 2026-04-29
 
   - id: CVE-2025-7425
     statement:
-      "libxslt1.1 1.1.35: heap use-after-free via atype corruption in xmlAttrPtr. No fix available in Debian 12. XSLT
-      processing limited to trusted report templates."
+      "libxslt1.1 1.1.35: heap use-after-free via atype corruption in xmlAttrPtr. No fix
+      available in Debian 12. XSLT processing limited to trusted report templates."
     expiry_date: 2026-04-29
 
   - id: CVE-2026-0861
     statement:
-      "libc-bin 2.36-9: glibc integer overflow in memalign leads to heap corruption. No fix available in Debian 12.
-      Affects all binaries but requires specific allocation patterns."
+      "libc-bin 2.36-9: glibc integer overflow in memalign leads to heap corruption. No
+      fix available in Debian 12. Affects all binaries but requires specific allocation
+      patterns."
     expiry_date: 2026-04-29
 
   - id: CVE-2026-22695
     statement:
-      "libpng16-16 1.6.39: heap buffer over-read in png_image_finish_read causing DoS/info disclosure. No fix available
-      in Debian 12. PNG processing limited to trusted assets."
+      "libpng16-16 1.6.39: heap buffer over-read in png_image_finish_read causing
+      DoS/info disclosure. No fix available in Debian 12. PNG processing limited to
+      trusted assets."
     expiry_date: 2026-04-29
 
   - id: CVE-2026-22801
     statement:
-      "libpng16-16 1.6.39: integer truncation in simplified write API causing info disclosure/DoS. No fix available in
-      Debian 12. PNG writing not exposed to untrusted input."
+      "libpng16-16 1.6.39: integer truncation in simplified write API causing info
+      disclosure/DoS. No fix available in Debian 12. PNG writing not exposed to
+      untrusted input."
     expiry_date: 2026-04-29
 
   - id: CVE-2026-24882
     statement:
-      "dirmngr/gnupg 2.2.40: stack-based buffer overflow in tpm2daemon allows arbitrary code execution. No fix available
-      in Debian 12. TPM2 daemon not used in OpenSPP."
+      "dirmngr/gnupg 2.2.40: stack-based buffer overflow in tpm2daemon allows arbitrary
+      code execution. No fix available in Debian 12. TPM2 daemon not used in OpenSPP."
     expiry_date: 2026-04-29
 
   # --- Go stdlib v1.20.5 (geoipupdate binary bundled in Odoo image) ---
@@ -73,49 +78,52 @@ vulnerabilities:
 
   - id: CVE-2023-39325
     statement:
-      "Go 1.20.5 net/http: HTTP/2 rapid stream resets cause excessive CPU (CVE-2023-44487). geoipupdate is a client
-      binary, not a server. Fixed in Go 1.20.10."
+      "Go 1.20.5 net/http: HTTP/2 rapid stream resets cause excessive CPU
+      (CVE-2023-44487). geoipupdate is a client binary, not a server. Fixed in Go
+      1.20.10."
     expiry_date: 2026-04-29
 
   - id: CVE-2023-45283
     statement:
-      "Go 1.20.5 filepath: path traversal on Windows via \\??\\. Not applicable — container runs Linux. Fixed in Go
-      1.20.11."
+      "Go 1.20.5 filepath: path traversal on Windows via \\??\\. Not applicable —
+      container runs Linux. Fixed in Go 1.20.11."
     expiry_date: 2026-04-29
 
   - id: CVE-2023-45288
     statement:
-      "Go 1.20.5 net/http: unlimited CONTINUATION frames cause DoS. geoipupdate is a client binary, not a server. Fixed
-      in Go 1.21.9."
+      "Go 1.20.5 net/http: unlimited CONTINUATION frames cause DoS. geoipupdate is a
+      client binary, not a server. Fixed in Go 1.21.9."
     expiry_date: 2026-04-29
 
   - id: CVE-2024-24790
     statement:
-      "Go 1.20.5 net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses. geoipupdate only
-      connects to MaxMind servers. Fixed in Go 1.21.11."
+      "Go 1.20.5 net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6
+      addresses. geoipupdate only connects to MaxMind servers. Fixed in Go 1.21.11."
     expiry_date: 2026-04-29
 
   - id: CVE-2024-34156
     statement:
-      "Go 1.20.5 encoding/gob: stack exhaustion via deeply nested structures. geoipupdate does not decode gob data.
-      Fixed in Go 1.22.7."
+      "Go 1.20.5 encoding/gob: stack exhaustion via deeply nested structures.
+      geoipupdate does not decode gob data. Fixed in Go 1.22.7."
     expiry_date: 2026-04-29
 
   - id: CVE-2025-47907
     statement:
-      "Go 1.20.5 database/sql: Postgres Scan race condition. geoipupdate does not use database/sql. Fixed in Go 1.23.12."
+      "Go 1.20.5 database/sql: Postgres Scan race condition. geoipupdate does not use
+      database/sql. Fixed in Go 1.23.12."
     expiry_date: 2026-04-29
 
   - id: CVE-2025-58183
     statement:
-      "Go 1.20.5 archive/tar: unbounded allocation when parsing GNU sparse map. geoipupdate does not process tar
-      archives from untrusted sources. Fixed in Go 1.24.8."
+      "Go 1.20.5 archive/tar: unbounded allocation when parsing GNU sparse map.
+      geoipupdate does not process tar archives from untrusted sources. Fixed in Go
+      1.24.8."
     expiry_date: 2026-04-29
 
   - id: CVE-2025-61729
     statement:
-      "Go 1.20.5 crypto/x509: DoS via crafted certificate. geoipupdate only connects to MaxMind TLS endpoints. Fixed in
-      Go 1.24.11."
+      "Go 1.20.5 crypto/x509: DoS via crafted certificate. geoipupdate only connects to
+      MaxMind TLS endpoints. Fixed in Go 1.24.11."
     expiry_date: 2026-04-29
 
   # --- Python packages (installed in Odoo Docker image venv) ---
@@ -125,38 +133,38 @@ vulnerabilities:
 
   - id: CVE-2024-23342
     statement:
-      "ecdsa 0.19.1: vulnerable to Minerva timing attack on ECDSA signatures. Vendored in Odoo image venv. No fix
-      version available. Used by python-jose for JWT."
+      "ecdsa 0.19.1: vulnerable to Minerva timing attack on ECDSA signatures. Vendored
+      in Odoo image venv. No fix version available. Used by python-jose for JWT."
     expiry_date: 2026-04-29
 
   - id: CVE-2024-34069
     statement:
-      "Werkzeug 3.0.1: code execution on developer machine via debugger. Odoo does not run Werkzeug debugger in
-      production. Fix available: 3.0.3."
+      "Werkzeug 3.0.1: code execution on developer machine via debugger. Odoo does not
+      run Werkzeug debugger in production. Fix available: 3.0.3."
     expiry_date: 2026-02-28
 
   - id: CVE-2024-47874
     statement:
-      "starlette 0.38.6: DoS via multipart/form-data. Vendored in Odoo image but Odoo uses Werkzeug, not Starlette, for
-      request handling. Fix available: 0.40.0."
+      "starlette 0.38.6: DoS via multipart/form-data. Vendored in Odoo image but Odoo
+      uses Werkzeug, not Starlette, for request handling. Fix available: 0.40.0."
     expiry_date: 2026-02-28
 
   - id: CVE-2025-66418
     statement:
-      "urllib3 2.0.7: unbounded decompression chain leads to resource exhaustion. Vendored in Odoo image venv. Fix
-      available: 2.6.0."
+      "urllib3 2.0.7: unbounded decompression chain leads to resource exhaustion.
+      Vendored in Odoo image venv. Fix available: 2.6.0."
     expiry_date: 2026-02-28
 
   - id: CVE-2025-66471
     statement:
-      "urllib3 2.0.7: streaming API improperly handles highly compressed data. Vendored in Odoo image venv. Fix
-      available: 2.6.0."
+      "urllib3 2.0.7: streaming API improperly handles highly compressed data. Vendored
+      in Odoo image venv. Fix available: 2.6.0."
     expiry_date: 2026-02-28
 
   - id: CVE-2026-21441
     statement:
-      "urllib3 2.0.7: decompression-bomb safeguard bypass when following HTTP redirects in streaming API. Vendored in
-      Odoo image venv. Fix available: 2.6.3."
+      "urllib3 2.0.7: decompression-bomb safeguard bypass when following HTTP redirects
+      in streaming API. Vendored in Odoo image venv. Fix available: 2.6.3."
     expiry_date: 2026-02-28
 
 misconfigurations:
@@ -166,6 +174,6 @@ misconfigurations:
     paths:
       - "e2e/Dockerfile"
     statement:
-      "E2E test container runs as root intentionally. It needs elevated privileges for Playwright browser automation and
-      system-level test setup."
+      "E2E test container runs as root intentionally. It needs elevated privileges for
+      Playwright browser automation and system-level test setup."
     expiry_date: 2026-04-29

CONTRIBUTORS.md

@@ -1,31 +1,42 @@
 # Contributors
 
-OpenSPP and [OpenG2P](https://github.com/OpenG2P) share common origins and have collaborated over the years. Some code
-in this repository originated from early OpenG2P work, and OpenSPP contributions were later adopted into OpenG2P's
-current version. We thank all contributors to both projects.
+OpenSPP and [OpenG2P](https://github.com/OpenG2P) share common origins and have
+collaborated over the years. Some code in this repository originated from early OpenG2P
+work, and OpenSPP contributions were later adopted into OpenG2P's current version. We
+thank all contributors to both projects.
 
 ## OpenSPP Contributors
 
 [@atelal](https://github.com/atelal), [@dasunhegoda](https://github.com/dasunhegoda),
 [@emjay0921](https://github.com/emjay0921), [@FawazNARI](https://github.com/FawazNARI),
-[@gonzalesedwin1123](https://github.com/gonzalesedwin1123), [@jeremi](https://github.com/jeremi),
-[@kneckinator](https://github.com/kneckinator), [@mkumar-02](https://github.com/mkumar-02),
-[@mohammedalateya](https://github.com/mohammedalateya), [@nhatnm0612](https://github.com/nhatnm0612),
-[@reichie020212](https://github.com/reichie020212), [@RohmerJay](https://github.com/RohmerJay),
-[@sajjadjameel68](https://github.com/sajjadjameel68), [@shashikala1998](https://github.com/shashikala1998)
+[@gonzalesedwin1123](https://github.com/gonzalesedwin1123),
+[@jeremi](https://github.com/jeremi), [@kneckinator](https://github.com/kneckinator),
+[@mkumar-02](https://github.com/mkumar-02),
+[@mohammedalateya](https://github.com/mohammedalateya),
+[@nhatnm0612](https://github.com/nhatnm0612),
+[@reichie020212](https://github.com/reichie020212),
+[@RohmerJay](https://github.com/RohmerJay),
+[@sajjadjameel68](https://github.com/sajjadjameel68),
+[@shashikala1998](https://github.com/shashikala1998)
 
 ## OpenG2P Contributors
 
-[@Abhishek-Wagh](https://github.com/Abhishek-Wagh), [@amen50](https://github.com/amen50),
-[@Aymen-Mohammednur](https://github.com/Aymen-Mohammednur), [@DagmawitGT](https://github.com/DagmawitGT),
-[@edcable](https://github.com/edcable), [@EyuaelB](https://github.com/EyuaelB),
-[@gaganamadival](https://github.com/gaganamadival), [@lalithkota](https://github.com/lalithkota),
-[@ludaze](https://github.com/ludaze), [@Mithun89mith](https://github.com/Mithun89mith),
+[@Abhishek-Wagh](https://github.com/Abhishek-Wagh),
+[@amen50](https://github.com/amen50),
+[@Aymen-Mohammednur](https://github.com/Aymen-Mohammednur),
+[@DagmawitGT](https://github.com/DagmawitGT), [@edcable](https://github.com/edcable),
+[@EyuaelB](https://github.com/EyuaelB),
+[@gaganamadival](https://github.com/gaganamadival),
+[@lalithkota](https://github.com/lalithkota), [@ludaze](https://github.com/ludaze),
+[@Mithun89mith](https://github.com/Mithun89mith),
 [@pjoshi751](https://github.com/pjoshi751), [@PSNAppz](https://github.com/PSNAppz),
-[@Q-Niranjan](https://github.com/Q-Niranjan), [@RamakrishnaVellala](https://github.com/RamakrishnaVellala),
-[@shibu-narayanan](https://github.com/shibu-narayanan), [@shivamg9](https://github.com/shivamg9),
-[@tahzeer](https://github.com/tahzeer), [@vin0dkhichar](https://github.com/vin0dkhichar),
-[@vineela-afk](https://github.com/vineela-afk), [@vineela-ampili](https://github.com/vineela-ampili)
+[@Q-Niranjan](https://github.com/Q-Niranjan),
+[@RamakrishnaVellala](https://github.com/RamakrishnaVellala),
+[@shibu-narayanan](https://github.com/shibu-narayanan),
+[@shivamg9](https://github.com/shivamg9), [@tahzeer](https://github.com/tahzeer),
+[@vin0dkhichar](https://github.com/vin0dkhichar),
+[@vineela-afk](https://github.com/vineela-afk),
+[@vineela-ampili](https://github.com/vineela-ampili)
 
 ## Code Origins
 

EXTERNAL_DEPENDENCIES.md

@@ -1,7 +1,8 @@
 # External Dependencies
 
-OpenSPP requires the following external Odoo module repositories. The Docker setup fetches these automatically. For
-manual installation, clone each repo and add it to your Odoo addons path.
+OpenSPP requires the following external Odoo module repositories. The Docker setup
+fetches these automatically. For manual installation, clone each repo and add it to your
+Odoo addons path.
 
 | Repository                                                    | Branch | Modules                            |
 | ------------------------------------------------------------- | ------ | ---------------------------------- |