src/services/suggestions-api/endpoints/class-endpoint-suggest-inbound-links.php (1)

63-64: Clamp and cast max_items before sending to the API.

Defensively ensure an integer ≥ 1 to avoid surprising upstream behavior.

-                'max_items' => $options['max_items'] ?? 10,
+                'max_items' => max( 1, (int) ( $options['max_items'] ?? 10 ) ),

src/rest-api/content-helper/class-endpoint-traffic-boost.php (4)

93-119: Add min/max bounds to max_items REST schema.

Declare limits in the route args so invalid values are rejected early and payload sizes are bounded.

                 'max_items'          => array(
                     'type'        => 'integer',
                     'description' => __( 'The maximum number of suggestions to return.', 'wp-parsely' ),
                     'default'     => 10,
+                    'minimum'     => 1,
+                    'maximum'     => 50,
                     'required'    => false,
                 ),

---

131-159: Validate/sanitize string lists for placement routes.

ignore_keywords and keyword_exclusion_list accept unvalidated arrays. Add callbacks to normalize to arrays of strings.

                 'ignore_keywords'        => array(
                     'type'        => 'array',
                     'description' => __( 'The keywords to ignore.', 'wp-parsely' ),
                     'required'    => false,
+                    'sanitize_callback' => array( __CLASS__, 'sanitize_string_array' ),
+                    'validate_callback' => array( __CLASS__, 'validate_string_array' ),
                 ),
                 'keyword_exclusion_list' => array(
                     'type'        => 'array',
                     'description' => __( 'The keywords to exclude from the suggestions.', 'wp-parsely' ),
                     'required'    => false,
                     'default'     => array(),
+                    'sanitize_callback' => array( __CLASS__, 'sanitize_string_array' ),
+                    'validate_callback' => array( __CLASS__, 'validate_string_array' ),
                 ),

Add these helpers in this class (outside the shown hunk):

private static function sanitize_string_array( $value ): array {
    $arr = is_array( $value ) ? $value : array();
    return array_values( array_filter( array_map( 'sanitize_text_field', $arr ), 'strlen' ) );
}
private static function validate_string_array( $value ) {
    if ( null === $value ) {
        return true;
    }
    if ( ! is_array( $value ) ) {
        return new \WP_Error( 'parsely_invalid_param', __( 'Expected an array of strings.', 'wp-parsely' ) );
    }
    foreach ( $value as $v ) {
        if ( ! is_string( $v ) ) {
            return new \WP_Error( 'parsely_invalid_param', __( 'Expected an array of strings.', 'wp-parsely' ) );
        }
    }
    return true;
}

---

346-348: Normalize request options sent to Suggestions API.

Cast and de-duplicate inputs to reduce surprises downstream.

-                'max_items'          => $max_items,
-                'url_exclusion_list' => $url_exclusion_list,
+                'max_items'          => max( 1, (int) $max_items ),
+                'url_exclusion_list' => array_values( array_unique( (array) $url_exclusion_list ) ),

---

454-455: Sanitize and de-duplicate keyword_exclusion_list before forwarding.

Pre-cleaning helps the Suggestions API and avoids false in_array matches later.

-                'keyword_exclusion_list' => $keyword_exclusion_list,
+                'keyword_exclusion_list' => array_values(
+                    array_unique( array_map( 'sanitize_text_field', (array) $keyword_exclusion_list ) )
+                ),

src/content-helper/dashboard-page/pages/traffic-boost/provider.ts (2)

293-299: Document the removal in JSDoc with a new @SInCE entry.

Add a second @SInCE line noting the auto-selection change so downstream integrators notice the behavior shift.

  /**
   * Generates suggestions for a given post.
   *
-  * @since 3.19.0
+  * @since 3.19.0
+  * @since X.Y.Z Removed performanceBlendingWeight; server now auto-selects the optimal blending weight.
   *
   * @param {number}   postId                   The ID of the post to generate suggestions for.
   * @param {Object}   options                  The options for the suggestions.
   * @param {number}   options.maxItems         The maximum number of items to generate.
   * @param {boolean}  options.discardPrevious  Whether to discard previous suggestions.
   * @param {string[]} options.urlExclusionList The list of URLs to exclude from the suggestions.
   * @param {boolean}  options.save             Whether to save the suggestions.

Please confirm the next plugin version to replace X.Y.Z.

---

333-340: Mirror the JSDoc change for placement generation.

Reflect the blending-weight removal here too for consistency.

  /**
   * Generates a placement suggestion for a given post.
   *
-  * @since 3.19.0
+  * @since 3.19.0
+  * @since X.Y.Z Removed performanceBlendingWeight; server now auto-selects the optimal blending weight.
   *
   * @param {HydratedPost}     sourcePost                  The source post.
   * @param {HydratedPost}     destinationPost             The destination post.
   * @param {TrafficBoostLink} trafficBoostLink            The traffic boost link to generate a placement for.
   * @param {Object}           options                     The options for the suggestion.
   * @param {string[]}         options.ignoreKeywords      The keywords to ignore.
   * @param {boolean}          options.save                Whether to save the suggestion.
   * @param {boolean}          options.allowDuplicateLinks Whether to allow duplicate links.

Also confirm X.Y.Z.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro