diff --git a/.copier-answers.yml b/.copier-answers.yml
index f320e61..1a72014 100644
--- a/.copier-answers.yml
+++ b/.copier-answers.yml
@@ -1,5 +1,5 @@
 # Do NOT update manually; changes here will be overwritten by Copier
-_commit: v7.3.0
+_commit: v8.0.2
 _src_path: git@github.com:Noviat-CI/addons-repo-template.git
 ci_disable_autoinstall_modules: ''
 odoo_test_flavor: Both
diff --git a/.github/workflows/check-version-bump.yml b/.github/workflows/check-version-bump.yml
new file mode 100644
index 0000000..fae5ddd
--- /dev/null
+++ b/.github/workflows/check-version-bump.yml
@@ -0,0 +1,29 @@
+name: Check module version bump
+
+on:
+  pull_request:
+    branches:
+      - "19.0*"
+
+jobs:
+  check-version-bump:
+    runs-on: ubuntu-latest
+    name: Check module version bump
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # HEAD is the PR merge commit, HEAD^1 the tip of the base branch
+          fetch-depth: 2
+          persist-credentials: false
+      - name: Configure git authentication
+        # Header instead of URL credentials, see test.yml
+        env:
+          TOKEN: ${{ secrets.PRIVATE_TOKEN }}
+        run: |
+          git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
+      - name: Add Noviat CI Tools to PATH
+        run: |
+          git clone https://github.com/Noviat-CI/noviat-ci-tools.git /opt/noviat-ci-tools
+          echo "/opt/noviat-ci-tools" >> $GITHUB_PATH
+      - name: Check module version bump
+        run: check_module_version_bump
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 5036672..30ed702 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -8,19 +8,23 @@ on:
     branches:
       - "19.0"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: 'pip'
           cache-dependency-path: '.pre-commit-config.yaml'
       - name: Get python version
         run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 97c39c9..b0dee37 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,12 +8,16 @@ on:
     branches:
       - "19.0"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   unreleased-deps:
     runs-on: ubuntu-latest
     name: Detect unreleased dependencies
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: |
           for reqfile in requirements.txt test-requirements.txt ; do
               if [ -f ${reqfile} ] ; then
@@ -50,7 +54,7 @@ jobs:
             makepot: "true"
     services:
       postgres:
-        image: postgres:12.0
+        image: postgres:13
         env:
           POSTGRES_USER: odoo
           POSTGRES_PASSWORD: odoo
@@ -61,9 +65,14 @@ jobs:
       INSTALL_ADDONS_DIR: "/tmp/addons-merged"
       ADDITIONAL_ADDONS_DIR: "/tmp/additional-addons"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
+      - name: Configure git authentication
+        env:
+          TOKEN: ${{ secrets.PRIVATE_TOKEN }}
+        run: |
+          git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
       - name: Set pip constraints (pyOpenSSL / cryptography)
         run: |
           cat > /tmp/constraints.txt <<'EOF'
@@ -77,15 +86,13 @@ jobs:
         run: python -m pip install git+https://github.com/odoo/upgrade-util@master
       - name: Add Noviat CI Tools to PATH
         run: |
-          git clone https://${{ secrets.PRIVATE_TOKEN }}@github.com/Noviat-CI/noviat-ci-tools.git /opt/noviat-ci-tools
+          git clone https://github.com/Noviat-CI/noviat-ci-tools.git /opt/noviat-ci-tools
           echo "/opt/noviat-ci-tools" >> $GITHUB_PATH
       - name: Clone Odoo Enterprise
         if: ${{ matrix.odoo_enterprise == 1 }}
         run : |
-          git clone https://${{ secrets.PRIVATE_TOKEN }}@github.com/odoo/enterprise.git --depth 1 -b 19.0 /opt/enterprise
+          git clone https://github.com/odoo/enterprise.git --depth 1 -b 19.0 /opt/enterprise
       - name: Clone Noviat Dependencies
-        env:
-          PRIVATE_TOKEN: ${{ secrets.PRIVATE_TOKEN }}
         run: clone_oca_dependencies_by_noviat
       - name: Create addons path
         run: |
@@ -109,21 +116,30 @@ jobs:
         run: |
           echo "server_wide_modules = web,module_change_auto_install" >> ${ODOO_RC}
           echo "ODOO_MODULES_AUTO_INSTALL_DISABLED=${{ matrix.EXCLUDE_MODULES }}" >> $GITHUB_ENV
-      - name: Inject GitHub token for Noviat orgs in test-requirements.txt
-        run: |
-          sed -i -E "s#https://github.com/(Noviat-(Projects|Generic|ARP|Internal))#https://${{ secrets.PRIVATE_TOKEN }}@github.com/\1#g" test-requirements.txt
       - name: Install addons and dependencies
         run: |
           (ADDONS_PATH=${ADDONS_PATH} ADDONS_DIR=${INSTALL_ADDONS_DIR} oca_install_addons)
+      - name: Install external dependencies of core addons (not in Odoo requirements.txt)
+        run: |
+          (ADDONS_DIR=${INSTALL_ADDONS_DIR} noviat_install_odoo_external_dependencies)
       - name: Initialize test db
         run: oca_init_test_database
       - name: Run tests
         run: oca_run_tests
       - name: Generate coverage files
+        id: coverage
         run: |
+          # oca_run_tests exits early without coverage data when there is no
+          # addon to test (e.g. a freshly scaffolded version branch).
+          if [ -z "$(oca_list_addons_to_test)" ]; then
+            echo "No addon to test, skipping coverage report."
+            exit 0
+          fi
           coverage report -m
           coverage xml -o coverage.xml
+          echo "report=true" >> "$GITHUB_OUTPUT"
       - name: Code Coverage Summary Report
+        if: steps.coverage.outputs.report == 'true'
         uses: irongut/CodeCoverageSummary@v1.3.0
         with:
           filename: 'coverage.xml'
@@ -132,7 +148,8 @@ jobs:
           output: 'both'
           hide_complexity: true
       - name: Write to Job Summary
+        if: steps.coverage.outputs.report == 'true'
         run: cat code-coverage-results.md >> $GITHUB_STEP_SUMMARY
       - name: Update .pot files
-        run: noviat_export_and_push_pot https://x-access-token:${{ secrets.PRIVATE_TOKEN }}@github.com/${{ github.repository }}
+        run: noviat_export_and_push_pot https://github.com/${{ github.repository }}
         if: ${{ matrix.makepot == 'true' && github.event_name == 'push' }}
diff --git a/.github/workflows/update-addons-table.yml b/.github/workflows/update-addons-table.yml
index 44e4010..a42fb8f 100644
--- a/.github/workflows/update-addons-table.yml
+++ b/.github/workflows/update-addons-table.yml
@@ -14,11 +14,11 @@ jobs:
   gen-addons-table:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -28,14 +28,15 @@ jobs:
         continue-on-error: true
       - name: Commit & push if changed
         env:
-          PUSH_URL: https://x-access-token:${{ secrets.PRIVATE_TOKEN }}@github.com/${{ github.repository }}.git
+          TOKEN: ${{ secrets.PRIVATE_TOKEN }}
         run: |
           if ! git diff --quiet; then
             git config user.name  "noviat-ci-bot"
             git config user.email "bot+ci@noviat.com"
             git add -A
             git commit -m "update addons table"
-            git remote set-url origin "$PUSH_URL"
+            # Header instead of URL credentials, see test.yml
+            git config http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
             git config --global --add safe.directory "$GITHUB_WORKSPACE"
             git push origin HEAD:19.0
           fi
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f1ae3dd..9cc3fae 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -22,7 +22,7 @@ exclude: |
   (LICENSE.*|COPYING.*)
 default_language_version:
   python: python3
-  node: "22.9.0"
+  node: "22.23.3"
 repos:
   - repo: local
     hooks:
@@ -42,20 +42,31 @@ repos:
     rev: v1.3
     hooks:
       - id: whool-init
+        additional_dependencies:
+          # force a fresh pre-commit env: up-to-date core addons lists and
+          # Odoo 20 support (since v1.16.0)
+          - manifestoo-core>=1.16.1
   - repo: https://github.com/oca/maintainer-tools
-    rev: 71aa4caec15e8c1456b4da19e9f39aa0aa7377a9
+    rev: b8311a95009805a6e5593f0390f52c0fa350117f
     hooks:
       # update the NOT INSTALLABLE ADDONS section above
       - id: oca-update-pre-commit-excluded-addons
       - id: oca-fix-manifest-website
         args: ["https://www.noviat.com/"]
       - id: oca-gen-external-dependencies
+        additional_dependencies:
+          # an outdated manifestoo-core ignores recent core addons, and wipes
+          # requirements.txt on an Odoo series it does not know
+          - manifestoo-core>=1.16.1
       - id: oca-gen-addons-table
         stages: [manual]
   - repo: https://github.com/OCA/odoo-pre-commit-hooks
-    rev: v0.2.20
+    rev: v0.2.27
     hooks:
       - id: oca-checks-odoo-module
+      - id: oca-checks-odoo-module-fixit
+        args:
+          - --disable=use-header-comments
       - id: oca-checks-po
         args:
           - --disable=po-pretty-format
@@ -73,7 +84,7 @@ repos:
         files: \.(css|htm|html|js|json|jsx|less|md|scss|toml|ts|xml|yaml|yml)$
         language: node
         additional_dependencies:
-          - "prettier@3.8.1"
+          - "prettier@3.9.9"
           - "@prettier/plugin-xml@3.4.2"
   - repo: local
     hooks:
@@ -87,9 +98,9 @@ repos:
         types: [javascript]
         language: node
         additional_dependencies:
-          - "eslint@9.39.3"
-          - "eslint-plugin-jsdoc@62.7.1"
-          - "globals@16.0.0"
+          - "eslint@10.11.0"
+          - "eslint-plugin-jsdoc@65.0.0"
+          - "globals@17.12.0"
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -115,13 +126,15 @@ repos:
     hooks:
       - id: pyupgrade
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.2
+    rev: v0.16.9
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
+        # markdown is prettier's job (ruff >= 0.16 also formats its code blocks)
+        types_or: [python, pyi, jupyter]
   - repo: https://github.com/OCA/pylint-odoo
-    rev: v10.0.1
+    rev: v10.0.11
     hooks:
       - id: pylint_odoo
         name: pylint (optional, core only)
diff --git a/.pylintrc b/.pylintrc
index 03a264c..0c0cd9a 100644
--- a/.pylintrc
+++ b/.pylintrc
@@ -3,6 +3,9 @@ ignore-patterns=["^.*/TODO/.*$"]
 load-plugins=pylint_odoo
 score=n
 
+[IMPORTS]
+deprecated-modules=pdb,pudb,ipdb,bs4
+
 [ODOOLINT]
 #readme-template-url="https://github.com/OCA/maintainer-tools/blob/master/template/module/README.rst"
 manifest-required-authors=Noviat
@@ -26,6 +29,7 @@ enable =
     assignment-from-none,
     attribute-deprecated,
     dangerous-default-value,
+    deprecated-module,
     development-status-allowed,
     duplicate-key,
     eval-used,
@@ -57,10 +61,12 @@ enable =
     context-overridden,
     except-pass,
     invalid-commit,
+    manifest-external-assets,
     manifest-maintainers-list,
     missing-readme,
     missing-return,
     odoo-addons-relative-import,
+    odoo-exception-warning,
     renamed-field-parameter,
     resource-not-exist,
     test-folder-imported,
@@ -74,6 +80,7 @@ enable =
     category-allowed,
     deprecated-name-get,
     deprecated-odoo-model-method,
+    deprecated-self-cr,
     inheritable-method-lambda,
     inheritable-method-string,
     invalid-email,
@@ -87,6 +94,7 @@ enable =
     prefer-env-translation,
     translation-format-interpolation,
     translation-format-truncated,
+    translation-injection,
     translation-fstring-interpolation,
     translation-not-lazy,
     translation-too-few-args,
@@ -94,14 +102,14 @@ enable =
     translation-unsupported-format,
     no-write-in-compute,
     odoolint,
+    # >= 20
+    manifest-summary-multiline,
     # messages that do not cause the lint step to fail
     consider-merging-classes-inherited,
-    deprecated-module,
     invalid-commit,
     missing-readme,
     odoo-addons-relative-import,
-    redefined-builtin,
-    manifest-external-assets
+    redefined-builtin
 
 
 [REPORTS]
diff --git a/.pylintrc-mandatory b/.pylintrc-mandatory
index c75030d..e422f25 100644
--- a/.pylintrc-mandatory
+++ b/.pylintrc-mandatory
@@ -3,6 +3,9 @@ ignore-patterns=["^.*/TODO/.*$"]
 load-plugins=pylint_odoo
 score=n
 
+[IMPORTS]
+deprecated-modules=pdb,pudb,ipdb,bs4
+
 [ODOOLINT]
 #readme-template-url="https://github.com/OCA/maintainer-tools/blob/master/template/module/README.rst"
 manifest-required-authors=Noviat
@@ -19,6 +22,7 @@ enable =
     assignment-from-none,
     attribute-deprecated,
     dangerous-default-value,
+    deprecated-module,
     development-status-allowed,
     duplicate-key,
     eval-used,
@@ -50,10 +54,12 @@ enable =
     context-overridden,
     except-pass,
     invalid-commit,
+    manifest-external-assets,
     manifest-maintainers-list,
     missing-readme,
     missing-return,
     odoo-addons-relative-import,
+    odoo-exception-warning,
     renamed-field-parameter,
     resource-not-exist,
     test-folder-imported,
@@ -67,6 +73,7 @@ enable =
     category-allowed,
     deprecated-name-get,
     deprecated-odoo-model-method,
+    deprecated-self-cr,
     inheritable-method-lambda,
     inheritable-method-string,
     invalid-email,
@@ -80,13 +87,16 @@ enable =
     prefer-env-translation,
     translation-format-interpolation,
     translation-format-truncated,
+    translation-injection,
     translation-fstring-interpolation,
     translation-not-lazy,
     translation-too-few-args,
     translation-too-many-args,
     translation-unsupported-format,
     no-write-in-compute,
-    odoolint
+    odoolint,
+    # >= 20
+    manifest-summary-multiline
 
 [REPORTS]
 msg-template={path}:{line}: [{msg_id}({symbol}), {obj}] {msg}
diff --git a/.ruff.toml b/.ruff.toml
index 5e63128..b153261 100644
--- a/.ruff.toml
+++ b/.ruff.toml
@@ -3,7 +3,14 @@ target-version = "py310"
 fix = true
 
 [lint]
-extend-select = [
+# Explicit rule set: ruff >= 0.16 enables 413 rules by default, many of which go
+# against Odoo idioms (naive UTC datetimes, `self = self.with_context()`, list
+# `_inherit`). "E4", "E7", "E9" and "F" are the defaults of ruff < 0.16.
+select = [
+    "E4",
+    "E7",
+    "E9",
+    "F",
     "B",
     "C90",
     "E501",  # line too long (default 88)
diff --git a/README.md b/README.md
index caf1c70..1df396d 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 [![Pre-commit Status](https://github.com/Noviat/account_ebics/actions/workflows/pre-commit.yml/badge.svg?branch=19.0)](https://github.com/Noviat/account_ebics/actions/workflows/pre-commit.yml?query=branch%3A19.0)
 [![Build Status](https://github.com/Noviat/account_ebics/actions/workflows/test.yml/badge.svg?branch=19.0)](https://github.com/Noviat/account_ebics/actions/workflows/test.yml?query=branch%3A19.0)
-[![Translation state](https://translation.noviat.com/widget/noviat-generic-account-ebics-v19/multi-auto.svg)](https://translation.noviat.com/engage/noviat-generic-account-ebics-v19/)
+[![Translation state](https://translation.noviat.io/widget/noviat-generic-account-ebics-v19/multi-auto.svg)](https://translation.noviat.io/engage/noviat-generic-account-ebics-v19/)
 <!-- /!\ do not modify above this line -->
 
 # Modules dedicated to manage the EBICS protocol
diff --git a/account_ebics/__manifest__.py b/account_ebics/__manifest__.py
index 1ad0301..856aadd 100644
--- a/account_ebics/__manifest__.py
+++ b/account_ebics/__manifest__.py
@@ -5,7 +5,7 @@
     "name": "EBICS Banking Protocol",
     "summary": "Download bank statements and upload payment "
     "files directly from Odoo, using the European EBICS standard",
-    "version": "19.0.1.3.1",
+    "version": "19.0.1.3.2",
     "license": "LGPL-3",
     "author": "Noviat",
     "website": "https://www.noviat.com/",
diff --git a/account_ebics/models/ebics_config.py b/account_ebics/models/ebics_config.py
index 463653a..0665f15 100644
--- a/account_ebics/models/ebics_config.py
+++ b/account_ebics/models/ebics_config.py
@@ -8,7 +8,7 @@ import re
 from odoo import api, fields, models
 from odoo.exceptions import UserError
 
-_logger = logging.getLogger(__name__)
+_logger = logging.getLogger(__name__)  # lint-ignore=unused-logger
 
 
 class EbicsConfig(models.Model):
diff --git a/account_ebics/models/ebics_file.py b/account_ebics/models/ebics_file.py
index b63df42..126425c 100644
--- a/account_ebics/models/ebics_file.py
+++ b/account_ebics/models/ebics_file.py
@@ -14,7 +14,7 @@ from odoo.exceptions import UserError
 
 from odoo.addons.base.models.res_bank import sanitize_account_number
 
-_logger = logging.getLogger(__name__)
+_logger = logging.getLogger(__name__)  # lint-ignore=unused-logger
 
 DUP_CHECK_FORMATS = ["cfonb120", "camt053"]