[JOY (JOY)]

Promote dev to main.

• fix(web): /api/health checks the database and answers 503 when it cannot read it (#829) #830 (ops(web): /api/health reports ok while the database is unreachable #829): /api/health checks the database and answers 503 when it cannot read it.
• fix(importer): enforce integer memory bounds and Arena URLs in ArenaSpecSyncer (#831) #832 (fix(importer): enforce integer memory bounds and validate Arena URLs in ArenaSpecSyncer #831): ArenaSpecSyncer enforces integer memory bounds and Arena URLs.
• fix(importer): enforce spec bounds and sanitize key_specs in AiSpecEnricher (#825) #828 (fix(importer): enforce integer/domain bounds and sanitize key_specs in AiSpecEnricher #825): AiSpecEnricher enforces spec bounds and sanitizes key_specs.
• fix(normalizer): xiaomi "mipad" is no apple ipad (#826) #827 (Normalizer: máy tính bảng Xiaomi "Mipad 5" bị gán thương hiệu Apple, key apple:ipad-5 #826): Xiaomi "mipad" is no longer taken for an Apple iPad.
• fix(normalizer): fix earbud keys, AirPods Pro years, iPad RAM and non-phone specs (#643, #657) #824 (ProductNormalizer: earbuds keyed :1gb, iPad RAM taken as storage, AirPods Pro by year #643, ProductNormalizer: benchmark and phone-template specs override the title (RAM, earbud storage, SAR, Face ID) #657): normalizer fixes for earbud keys, AirPods Pro years, iPad RAM and non-phone specs.
• fix(importer): enforce spec bounds and HTTP URL sanitization (#821) #823 (fix(importer): enforce spec bounds and HTTP URL sanitization in EntityMatcher and ingestion #821): importer spec bounds and HTTP URL sanitization.
• fix(normalizer): "iPad mini 5G" is no iPad mini 5 (#819) #822, fix(normalizer): key iPad mini 6 and 7 apart (#819) #820 (Follow-up #818: các key Apple còn gộp hoặc tách sai (iPad mini 6/7, A16 không liền kề, Apple TV, Watch Ultra 49mm) #819): iPad mini model keys.
• fix(normalizer): stop keying iPads, MacBook Neo and "(2nd generation)" titles as iPhones (#817) #818 (Normalizer: iPad A16, iPad Gen 10, MacBook Neo và "(2nd generation)" bị gán model_key iPhone #817): iPads, MacBook Neo and "(2nd generation)" titles are no longer keyed as iPhones.
• fix(normalizer): key "256 GB", "ProMax" and "WF1000XM5" like their usual spellings (#815) #816 (Normalizer: "256 GB" có dấu cách, "ProMax" viết liền và "WF1000XM5" không gạch nối làm lệch model_key #815): "256 GB", "ProMax" and "WF1000XM5" spellings are keyed like their usual forms.
• fix(web): drop the dead 320px toggle-gap rule and test the tap area (#809) #813, fix(web): fit the phone header in 320px and keep excluded reviews legible (#809, #811) #812 (fix(web): pages scroll sideways at 320px; the phone menu button is cut off #809, fix(a11y): de-weighted review cards fail text contrast (opacity-75) #811): 320 px phone header and excluded-review legibility.

Merge with a merge commit (no squash).

🤖 Generated with Claude Code

---

📌 TL;DR

This PR hardens the product ingestion pipeline against malformed data and security vulnerabilities by enforcing strict integer bounds on hardware specs, sanitizing HTTP URLs to prevent injection, and refining product normalization logic for Apple and Xiaomi devices. It also updates the test suite to validate these new safety constraints and parsing edge cases.

🎯 Type of Change

• 🚀 New feature
• 🐛 Bugfix
• 🧹 Refactor
• ⚡ Performance
• 📚 Documentation
• ⚙️ CI / Configuration

🔍 Changes Walkthrough

File	Summary of Changes
apps/importer/src/shopee/ai-spec-enricher.ts	Added strict integer bounds for RAM, storage, and battery specs. Implemented sanitizeKeySpecText to clean AI-generated text. Added URL validation for the AI base URL and bounded timeout/temperature parameters.
apps/importer/src/shopee/arena-spec-syncer.ts	Introduced normalizeArenaUrl to validate and sanitize GSM Arena and Phone Arena URLs, rejecting non-HTTP(S) or path-traversal attempts. Enforced integer constraints on RAM/storage parsing and fixed TB formatting logic.
apps/importer/src/shopee/entity-matcher.ts	Added sanitizeHttpUrl and sanitizeHttpUrlList to filter out invalid or malicious image URLs. Applied strict bounds checking to RAM, storage, screen size, and battery values before database insertion. Filtered fuzzy matches to exclude invalid IDs or similarity scores.
apps/importer/src/shopee/product-normalizer.ts	Refined brand and category detection for Xiaomi "Mi Pad" and Apple products. Removed invalid phone-shaped specs (RAM, storage, screen) from earbuds and watches in the canonical registry. Added logic to handle "ProMax" vs "Pro Max" and specific Apple model generations.
apps/importer/src/shopee/__tests__/arena-audit.test.ts	Added tests for URL sanitization, integer spec bounds, and TB formatting in the arena spec parser.
apps/importer/src/shopee/__tests__/entity-matcher.test.ts	Added tests for HTTP URL sanitization, malformed fuzzy match filtering, and out-of-bounds spec handling.
apps/importer/src/shopee/__tests__/open-core-intelligence.test.ts	Expanded tests for Apple/Xiaomi model normalization, earbud spec hygiene (removing fake RAM/storage), and ReDoS protection for long whitespace inputs.
apps/importer/src/shopee/__tests__/shopee-to-supabase.test.ts	Added tests for price normalization, URL sanitization in product images, and rejection of unpriced products.

📊 Architectural Flow

flowchart TD
    A[Raw Product Data] --> B{Product Normalizer}
    B -->|Clean Title/Brand/Model| C[Entity Matcher]
    C -->|Sanitize URLs & Bounds| D[Supabase DB]
    C -->|Needs Enrichment| E[AI Spec Enricher]
    E -->|Validate AI Output Bounds| F[Sanitized Specs]
    F --> D
    G[Arena HTML] --> H[Arena Spec Syncer]
    H -->|Normalize URLs & Parse Specs| I[Valid Arena Specs]
    I --> D

Loading

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
rate	Ready	Preview	Oct 24, 2026 9:34am UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 397e79e4-fb68-42b8-ad1f-677394b2a543

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}