- Rate limiting counters live in PostgreSQL (throttler_records), shared by
every instance, one atomic upsert per request; fails open.
- On shutdown, new syncs are refused (503) and the running one is waited for
up to SYNC_SHUTDOWN_TIMEOUT; Prisma disconnects last.
- Hiboutik calls never follow redirects and are capped at 50 MB.
- Prisma errors no longer print query arguments (errorFormat minimal).
- In production, DATABASE_URL must require TLS.
- The sync lock connection times out after 10 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Hiboutik payloads are zod schemas, validated by HiboutikClient (getOne
added for single resources: null on 404 or empty answer).
- Hiboutik dates are read as Europe/Paris whatever the server time zone.
- Paginated lists driving deletions are walked twice when they span several
pages (brands, categories, products); categories are sorted by id.
- A customer missing from the list is deleted only once Hiboutik confirms
it; completed orders that lost their customer are linked back.
- Each product and its versions are written in one transaction.
- An email removed in Hiboutik is erased in database.
- A 429 is retried with backoff, then stops the synchronization.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
NestJS 11.1.29 fixes the path-to-regexp ReDoS advisories. No NestJS release
ships multer >= 2.5.0 yet, which fixes several DoS advisories: it is forced
through overrides until one does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
