Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@web/migrations/0064_alter_goods_options_alter_order_options.py`:
- Around line 8-21: Do not modify the autogenerated migration's dependencies or
operations lists; instead suppress RUF012 for migration files via the Ruff
config by adding a per-file-ignores entry that targets your migrations (e.g.,
"web/migrations/*.py" or "*/migrations/*.py") and ignores RUF012; update
pyproject.toml or ruff.toml accordingly so the linter skips the mutable class
attribute warning for the generated symbols dependencies and operations in
migration files.

In `@web/urls.py`:
- Line 105: The fetch to the search endpoint is hardcoded and will 404 under
i18n prefixes; update the template (web/templates/base.html) to resolve the URL
with Django's url tag and expose it to JS (e.g. add a data-search-url attribute
on the search input using {% url 'global_search_api' %}), then change the JS
that currently calls fetch('/api/search/?q=...') to read that attribute (e.g.
input.getAttribute('data-search-url')) and call
fetch(`${searchUrl}?q=${encodeURIComponent(query)}`) so global_search_api is
correctly resolved for all language prefixes.

In `@web/views.py`:
- Around line 8869-8871: The Course queryset line exceeds the 120-char limit;
refactor the call to Course.objects.filter(...) by breaking the arguments across
multiple lines using parentheses so each line is under 120 chars — e.g., place
the Q(title__icontains=query) | Q(tags__icontains=query) expression and the
status="published" kwarg on separate indented lines inside the filter invocation
(referencing Course.objects.filter and Q) and keep the slice [:5] on its own
line or together with the closing parenthesis to maintain readability.
- Around line 8849-8854: Add the `@require_GET` decorator to the global_search_api
view and add type hints: annotate the parameter as request: HttpRequest and the
return as -> JsonResponse in the global_search_api function signature; also
ensure require_GET is imported from django.views.decorators.http and
HttpRequest/JsonResponse are imported from django.http if not already present so
the endpoint is explicitly GET-only and satisfies typing requirements.

---

Outside diff comments:
In `@web/models.py`:
- Around line 1631-1651: The Meta class for the Order model is misplaced after
method definitions and uses a list for ordering; move the class Meta so it sits
immediately after the model field declarations (i.e., before methods like save
and generate_tracking_number) and change ordering = ["-created_at"] to a tuple
ordering = ("-created_at",) to conform to the Django style guide and avoid
DJ012/RUF012 violations; update references to Order.Meta location only—no logic
changes to save(), generate_tracking_number(), or other methods.
- Around line 1308-1325: Move the Meta class so it appears before any method
definitions (i.e., place the Meta block above the save() and __str__ methods) to
satisfy Django ordering (DJ012), and change the ordering attribute from a
mutable list to an immutable tuple (ordering = ("-created_at",)) to satisfy
RUF012; ensure this Meta repositioning is applied within the same model class
that defines save(), __str__, and the sku/slug logic so references like save()
and Goods.objects.filter(slug=...) remain unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@web/templates/base.html`:
- Line 354: Replace the JS-only CSS selectors by adding data attributes to the
desktop and mobile search input and results elements (e.g. change
class="navbar-search-input" to data-navbar-search-input and
class="navbar-search-results" to data-navbar-search-results) and then update the
JS that currently queries ".navbar-search-input" and ".navbar-search-results" to
use document.querySelector('[data-navbar-search-input]') /
'[data-navbar-search-results]' (and the same for querySelectorAll or closest
uses) so the styling classes are not used as JS hooks; apply the change
consistently for both desktop and mobile inputs/results and update all JS
references that select these elements.
- Around line 1155-1158: The shared debounceTimer declared outside the loop
causes cross-input cancellation; move the timer into the per-input closure so
each `.navbar-search-input` gets its own timer. Specifically, inside the
searchInputs.forEach(input => { ... }) block, declare a local let debounceTimer
(or const createDebounce) and use that timer in the input event listener instead
of the outer debounceTimer so clearTimeout/setTimeout only affect the current
input's pending request.
- Around line 1209-1215: The click-outside guard in the document click handler
is too broad because it checks event.target.closest('.relative'), which matches
many unrelated navbar elements; update the guard inside the
document.addEventListener('click', ...) handler to only treat clicks inside the
actual search component(s) as in-scope (e.g., use a specific selector like
closest('.navbar-search') or a dedicated data attribute such as
closest('[data-navbar-search]') or closest('.navbar-search-results')), and leave
the existing logic that hides elements matching '.navbar-search-results'
unchanged so only clicks outside the real search container hide the results.
- Around line 1158-1206: Add the required ARIA attributes to the search input
and results container to implement the live-results combobox pattern: ensure the
input elements (the ones iterated by searchInputs in the searchInputs.forEach
block) include role="combobox", aria-autocomplete="list", aria-expanded="false"
and aria-controls pointing to a unique id for their corresponding
resultsContainer, and give the resultsContainer element role="listbox" and that
same id; in the JS (inside the input 'input' handler and the Escape key handler)
toggle the input's aria-expanded between "true"/"false" when you show/hide
resultsContainer and update resultsContainer.innerHTML as before so screen
readers can navigate the dynamic list.
- Around line 1172-1196: The fetch block that calls
fetch(`/api/search/?q=${encodeURIComponent(query)}`) lacks error handling and a
response.ok check, so add a guard after the fetch to verify response.ok before
calling response.json() and handle non-OK responses (e.g., show a friendly "No
results" or error message in resultsContainer); also chain a .catch(...) to the
promise to handle network/parse errors and ensure resultsContainer is hidden or
displays an error instead of leaving the UI broken, and when using the parsed
data check that data && Array.isArray(data.results) before accessing
data.results.length (update the anonymous then callbacks around response.json()
and the subsequent data handler accordingly).
- Around line 374-386: The badge currently chooses {{ item_count }} whenever
request.user.is_authenticated even if item_count == 0 while s_count > 0; update
the span rendering logic so that when request.user.is_authenticated you display
s_count if item_count is zero (or prefer s_count when >0), otherwise display
item_count — i.e. make the inner branch consider both item_count and s_count
(use a nested conditional that shows s_count when item_count == 0 and s_count >
0); apply the same change to the mobile block that uses the same variables at
the other location.
- Around line 1176-1193: The code injects unsanitized values into innerHTML
(resultsContainer.innerHTML) using query, result.title, result.type, result.url,
and result.icon which enables XSS; fix by replacing the template-literal
innerHTML construction with explicit DOM creation: for each item in
data.results, create elements via document.createElement, set text nodes via
textContent for title/type and use element.setAttribute('href', validatedUrl)
after validating result.url only allows http(s) or safe relative paths, and only
apply result.icon to className after validating/whitelisting allowed icon class
tokens (or escape/omit unsafe characters); for the "no results" branch create a
div and set its textContent to include the query safely rather than
interpolating into innerHTML, then append the constructed nodes to
resultsContainer and remove any use of innerHTML to prevent attribute/event
injection.