🛡️ Sentinel: [MEDIUM] Add timeouts to external fetch calls

[felirami]

User description

🚨 Severity: MEDIUM

💡 Vulnerability: The native Javascript fetch API does not have a default timeout. When querying external services (such as GitHub APIs, Dexscreener, or public Farcaster nodes), if the service hangs or stops responding, the fetch request will wait indefinitely.

🎯 Impact: In a high-traffic environment, hanging requests can lead to server resource exhaustion (e.g., hanging worker threads or Vercel serverless function timeouts), potentially causing a Denial of Service (DoS) for the application. It can also cause build scripts like sync-sources.mjs to hang indefinitely in CI/CD pipelines.

🔧 Fix: Added explicit timeouts to all external fetch calls using signal: AbortSignal.timeout(TIMEOUT_MS).

• src/lib/network.ts: Re-used existing NODE_PROBE_TIMEOUT_MS for getNetworkStatus.
• src/lib/snap-market.ts: Introduced SNAP_MARKET_TIMEOUT_MS (10s) for Dexscreener API queries.
• scripts/sync-sources.mjs: Introduced FETCH_TIMEOUT_MS (30s) for GitHub API queries.
• Documented this pattern in .jules/sentinel.md to ensure future external fetch calls include timeouts.

✅ Verification:

• Ran npm run lint and npm run typecheck (Pass).
• Ran npm run build (Successfully compiled).
• Verified the codebase via manual inspection to ensure no external fetch calls are missing an AbortSignal.

---

PR created automatically by Jules for task 9745223678269127453 started by @felirami

---

CodeAnt-AI Description

Prevent external requests from hanging indefinitely

What Changed

• Added timeouts to network calls that check node status and market data, so they stop instead of waiting forever when a service is unresponsive
• Added timeouts to GitHub requests used by the source-sync script, reducing the chance of CI or maintenance jobs getting stuck
• Documented the timeout requirement so future external requests follow the same pattern

Impact

✅ Fewer stuck server requests
✅ Lower risk of build jobs hanging
✅ Fewer service outages from unresponsive APIs

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add 30s/10s AbortSignal timeouts to external fetch calls

• Adds AbortSignal.timeout(FETCH_TIMEOUT_MS) (30s) to fetchGithubJson and fetchGithubText in sync-sources.mjs
• Adds AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS) to getNetworkStatus in network.ts
• Adds AbortSignal.timeout(SNAP_MARKET_TIMEOUT_MS) (10s) to getSnapMarketData in snap-market.ts
• Behavioral Change: all three fetch sites previously hung indefinitely on unresponsive hosts; they now abort and surface an error via their existing catch blocks

^{Macroscope summarized 714ada5.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jun 17, 2026 9:07pm

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn