refactor(presets): extract compat overrides into dedicated module

[trisdoan]

Context

When running odoo-venv across Odoo 12–19 with OCA repos, several Odoo requirement pins fail to build or cause runtime conflicts on modern systems (OpenSSL 3.x, Python 3.10+, modern compilers).

Problem packages

1. pyldap==2.4.28 (Odoo 12) / python-ldap==3.4.0 (Odoo 13–17)

pyldap is unmaintained and fails to build on OpenLDAP 2.5+ (libldap_r removed). python-ldap 3.4.0 also hardcodes -lldap_r, so bump to 3.4.2.

• https://github.com/odoo/odoo/issues/40069
• https://github.com/odoo/odoo/pull/109217
• Override: ignore pyldap, ignore python-ldap==3.4.0, add python-ldap==3.4.2

2. reportlab==3.3.0 (Odoo 12)

C extensions fail to build on modern systems — deprecated Py_UNICODE C APIs.

• Override: → 3.5.13 on python_version < '3.8'

3. psycopg2==2.7.3.1 (Odoo 12)

Uses Python 2's basestring, causes NameError on any Python 3 import.

• https://github.com/odoo/odoo/issues/41313
• https://github.com/odoo/odoo/issues/42660
• Override: → 2.8.3 on python_version < '3.8'

4. pandas==0.13.1 (Odoo 12, transitive via altair==4.0.1)

Invalid PEP 440 metadata that modern setuptools>=66 strictly rejects.

• https://github.com/OCA/reporting-engine/issues/598
• Override: → >=1.0.0 on python_version < '3.8'

5. pyopenssl / cryptography / urllib3 (Odoo 12–17)

Old pyopenssl+cryptography+urllib3 versions break on OpenSSL 3.x (Ubuntu 24.04+). They are a tightly-coupled trio and must be replaced together.

• https://github.com/odoo/odoo/issues/79697
• https://github.com/odoo/odoo/issues/99809
• https://github.com/odoo/odoo/pull/99829
• Odoo 12–14: → pyopenssl==22.1.0 + cryptography==38.0.4 (constrained by OCA's pyOpenSSL<23)
• Odoo 15–17: → pyopenssl>=24.0.0 + cryptography>=41.0.5
• Odoo 15: → urllib3==1.26.14 (uses removed cryptography internal API)

Moved from extra_requirement to extra_commands with odoo_version guards because python_version markers alone can't distinguish Odoo 14 vs 15 (both use Python 3.8).

6. Pillow==5.4.1 (Odoo 13)

Too old for matplotlib>=3.4.1 required by OCA modules (needs Pillow ≥ 6.2.0).

• https://github.com/odoo/odoo/issues/26175
• Override: → pillow>=6.2.0 on python_version < '3.8'

7. urllib3==1.26.5 (Odoo 15–18)

Too old for sentry-sdk and google-books-api-wrapper from OCA repos, and uses a cryptography internal API removed in 42+.

• https://github.com/odoo/odoo/issues/87444
• https://github.com/OCA/server-tools/issues/2927
• Odoo 14 pins requests==2.21.0 which caps urllib3<1.25 — must be scoped to Odoo 15+ to avoid breaking Odoo 14.

---

Other changes

presets.toml: OCA extra packages in [local], [demo], and [ci]

Each package comes from a specific OCA module:

Package	OCA module	Version rationale
bokeh==2.3.1 / 2.4.2 / 3.1.1 / 3.4.1 / 3.6.3	OCA/web → web_widget_bokeh_chart	Each Odoo release tests against a specific bokeh; mismatches break the widget's JS/Python API surface
factur-x<=3.2 / <=3.1 / (latest)	OCA/account-invoicing → account_invoice_facturx	factur-x 4.x dropped Python 2 compatibility code used by older Odoo
schwifty==2024.4.0	OCA/bank-statement-import → base_bank_from_iban (15.0+)	Module pins this exact version
fsspec>=2025.3.0	OCA/storage → fs_attachment (17.0+)	Module requires fsspec for abstract filesystem access
easypost==7.15.0	OCA/delivery-carrier → delivery_easypost_oca (17.0+)	Module pins this exact version

main.py: track Odoo's requirements separately from addon dirs' requirements

Before: all_req_files was a flat list mixing Odoo's own requirements.txt with addon dirs' requirements.txt files. This meant OCA addon mentions of packages (e.g., bare cryptography) could pollute base_pinned and cause unintended auto-ignore interactions.

After: split into odoo_req_files and addons_req_files, combined only for installation. base_pinned now only contains Odoo's own pins, so auto-ignore only triggers for packages Odoo actually pins.