# Changelog of Trustpilot Ultimate Scraper Pro (`netdesignr/trustpilot-reviews-scraper-pro`) Actor

- **URL**: https://apify.com/netdesignr/trustpilot-reviews-scraper-pro/changelog.md
- **Full Actor documentation**: https://apify.com/netdesignr/trustpilot-reviews-scraper-pro.md

## Changelog

All notable changes to Trustpilot Reviews Scraper Pro are documented here.

### 1.5.14 - 2026-05-31

#### Fixed

- User profile targets now use the built-in HTTP browser fallback when the direct Trustpilot profile page is blocked, restoring non-empty profile review output without premium third-party browser services or residential proxy fallback.
- Tightened live smoke fixtures so company and user-profile scenarios must emit real dataset records instead of passing as empty technical successes.
- Allowed one exact low-volume Trustpilot user-profile smoke input through the temporary profitability freeze so Apify-hosted quality verification can run before the scheduled price correction activates.

### 1.5.13 - 2026-05-29

#### Changed

- Added an emergency cloud-only profitability freeze until the scheduled Apify pricing correction becomes active.
- Allowed only the exact low-volume store quality smoke input to use HTTP browser recovery while the freeze is active, capped at 10 reviews and without residential proxy.

### 1.5.12 - 2026-05-29

#### Changed

- Switched the default `browserFallbackMode` from HTTP browser recovery to `off` as an immediate profitability guardrail while the scheduled Apify pricing correction waits for the required notice window.

### 1.5.11 - 2026-05-29

#### Changed

- Added `browserFallbackMode` with HTTP-only browser fallback as the default and residential proxy fallback as an explicit opt-in.
- Reduced default Actor memory bounds to 512-1024 MB and lowered browser fallback concurrency to control compute and proxy costs.
- Browser challenge waits and retries are shorter to avoid long blocked sessions.

#### Fixed

- Empty targets that already used residential fallback no longer retry the same expensive proxy path.

### 1.5.10 - 2026-05-06

#### Added

- Added optional Google Sheets export settings, with service-account authentication and automatic header plus row appends while still writing the Apify dataset.

#### Changed

- Updated Trustpilot scraper docs and tests to cover Google Sheets export setup and batch delivery behavior.

### 1.5.9 - 2026-04-22

#### Fixed

- Wired the existing `proxy` input into Trustpilot fetch layers so configured proxies are now actually used.
- Added automatic residential proxy fallback for browser-based Trustpilot fetches when the direct session is blocked with `403`, reducing empty runs on cloud QA.
- Fixed the Docker builder install so TypeScript is available during Apify cloud builds.

### 1.5.8 - 2026-03-26

#### Changed

- Reworked the README into a more visual Store-friendly summary of review, reviewer, verification, and company data coverage.

### 1.5.7 - 2026-02-17

#### Changed

- Refactored `main.ts` entry point: exported `runActor()` function for testability.
- Added 22 unit tests for actor orchestration (input validation, maxReviews capping, target dispatch, error handling, exit codes).
- 776 tests across monorepo (up from 714), 43 new shared package tests, 22 new Trustpilot main.ts tests.

### 1.5.6 - 2026-02-17

#### Security

- **ReDoS prevention** (SEC-TP-002): Replaced regex-based `__NEXT_DATA__` extraction with `indexOf`-based approach. Added HTML size limit (50 MB) and JSON size limit (50 MB) to prevent CPU exhaustion from oversized payloads.
- **Response body size limit** (SEC-TP-001): Layer 2 API responses are now rejected if they exceed 50 MB before JSON parsing, preventing memory exhaustion from adversarial payloads.
- **HTTPS enforcement** (SEC-TP-003): Added explicit `rejectUnauthorized: true` to all got-scraping calls, preventing MITM attacks on API responses.
- **Numeric field validation** (SEC-TP-004): All numeric fields from API responses (rating, likes, numberOfReviews, trustScore, stars, statistics) are now validated with `clampNumber()`. NaN, Infinity, and out-of-range values are replaced with safe defaults.
- **Text size limits** (SEC-TP-005): Review text (100K chars), title (10K chars), and reply messages (50K chars) are now truncated if oversized, preventing memory exhaustion from adversarial content.
- **Date semantic validation** (SEC-TP-006): `customDateFrom` now validates month (1-12) and day (1-31) ranges after format check. Previously "2025-13-32" passed the regex but created invalid Date objects.
- **SearchKeyword limit reduced** (SEC-TP-007): Max search keyword length reduced from 1000 to 200 chars, preventing URL encoding explosion (1000 special chars could URL-encode to 3000+ chars, exceeding URL limits).
- **Unicode control char rejection** (SEC-TP-008): User IDs now reject zero-width spaces (U+200B), RTL override (U+202E), zero-width joiners (U+200D), and BOM (U+FEFF) characters that could bypass visual inspection.

#### Changed

- 714 tests across monorepo (up from 673), 41 new security-focused tests.

### 1.5.5 - 2026-02-17

#### Security

- **SSRF protection**: `normalizeDomain()` now rejects localhost, private IPs (10.x, 172.16-31.x, 192.168.x), link-local (169.254.x), loopback (127.x), and IPv6 loopback addresses. Blocked domains are logged and skipped.
- **Runtime input sanitization**: New `sanitizeInput()` validates all user input at runtime:
  - `searchKeyword` truncated to 1000 chars (prevents memory exhaustion)
  - `customDateFrom` validated against YYYY-MM-DD format
  - `stars` validated against valid values (1-5)
  - `languages` validated against ISO 639-1 codes (2-3 char)
  - `topics` validated against known Trustpilot topic enum
- **userId format validation**: User profile IDs are validated (alphanumeric + hyphens/underscores, max 50 chars). Rejects path traversal and null byte injection attempts.

#### Changed

- Input is sanitized before processing via `sanitizeInput()` in main.ts
- 306 tests (up from 281), all passing

### 1.5.4 - 2026-02-13

#### Fixed

- Reviews with `verifiedOnly` or `withRepliesOnly` filters now correctly paginate beyond page 1 to find matching reviews
- Scraper tries up to 3 consecutive empty pages before stopping (previously stopped after 1 empty page)

### 1.5.3 - 2026-02-13

#### Fixed

- Removed noisy billing warnings from logs (Apify auto-charges via pushData)
- Removed unused cheerio dependency and billing constants

### 1.5.2 - 2026-02-12

#### Fixed

- Error logging now visible in production (previously hidden at debug level)
- One bad target no longer crashes the entire multi-target run
- Invalid custom date filter is now warned and ignored instead of silently filtering all reviews
- Billing errors are now logged instead of silently swallowed
- Reviews with missing IDs are filtered out to prevent dedup issues

#### Changed

- Known-corrupted WAF data is no longer used as fallback, returns empty results instead
- Maximum reviews capped at 100,000 to prevent runaway resource usage
- Actor exits with error code when all targets fail

### 1.5.0 - 2026-02-12

#### Added

- Automatic detection of Trustpilot WAF interference (data clamping and filter stripping)
- Browser fallback when WAF is detected
- 4 dataset views in Apify console: Overview, Detailed, Reviews with Replies, Company Alerts
- Improved input form with sections, labels, and placeholders

#### Changed

- Lower pricing from $0.40 to **$0.25 per 1,000 reviews** across all tiers

### 1.4.0 - 2026-02-12

#### Added

- New `company.consumerAlerts` and `company.hasWarning` fields, see active Trustpilot warnings on companies

#### Changed

- Improved README and input schema for Apify Store

### 1.3.0 - 2026-02-12

#### Added

- Extract more than 200 reviews per company by combining star and language filters automatically

#### Fixed

- Improved stability for large extractions, scraper now stops gracefully after repeated failures instead of hanging

### 1.2.0 - 2026-02-12

#### Fixed

- Fixed data loss that could occur on the last page of results
- Star rating filters now work reliably for all companies

### 1.1.0 - 2026-02-11

#### Added

- Initial release
- 30+ data fields per review
- Filters: stars, date, language, topics, keywords, verified, replies
- Company details and review statistics (optional)
- User profile scraping support
- Auto-detect input format (company domain, Trustpilot URL, or user profile)
- Pay-per-result pricing