🛡️ Sentinel: [Medium] Add explicit timeouts to all external fetch calls

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: The native fetch API does not have a default timeout. Several external API calls to Dexscreener, Farcaster public node info endpoints, and GitHub lacked explicit timeouts.
🎯 Impact: If these external services are slow or unresponsive, requests can hang indefinitely, potentially exhausting server connections and causing denial of service (DoS) or very slow page loads.
🔧 Fix: Added signal: AbortSignal.timeout(TIMEOUT_MS) to all native fetch calls in src/lib/network.ts, src/lib/snap-market.ts, and scripts/sync-sources.mjs.
✅ Verification: Ran npm run lint, npm run typecheck, and npm run build successfully to ensure no build-time or type errors were introduced.

---

PR created automatically by Jules for task 13629205337412889224 started by @felirami

---

CodeAnt-AI Description

Add timeouts to external fetch requests to prevent hangs

What Changed

• External requests now stop after a set time instead of waiting indefinitely.
• Market data checks and network status checks now fail fast when the remote service is slow or unresponsive.
• The GitHub sync script also uses a timeout for its API and raw file requests.

Impact

✅ Fewer stuck page loads
✅ Lower risk of server connection exhaustion
✅ Clearer failures when external services are slow

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add 15s/10s AbortSignal timeouts to all external fetch calls

• Adds AbortSignal.timeout() to GitHub API fetches in sync-sources.mjs (15s), the node info probe in network.ts, and market data fetches in snap-market.ts (10s).
• On timeout, each call throws or returns ok: false with an error message via existing catch paths rather than hanging indefinitely.
• Behavioral Change: fetches that previously hung forever will now fail after their respective timeout, which may surface new errors in callers that did not previously handle fetch failures.

📊 Macroscope summarized 96c282e. 4 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jun 18, 2026 9:01pm

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[macroscopeapp]

🟡 Medium

https://github.com/felirami/hypersnaporg/blob/96c282ec0689e64f9bf8d36a2860a19f7331d88d/scripts/sync-sources.mjs#L29

When optional: true is passed and the request times out, AbortSignal.timeout() causes fetch to reject with a TimeoutError before the response status is checked. This bypasses the graceful handling of 404/409 on lines 39-41, causing the entire script to crash even for optional resources like hyper.md or SUMMARY.md when GitHub is slow.

Consider catching AbortError and returning null (or the appropriate empty value) when optional is true, so timeouts don't crash the script.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @scripts/sync-sources.mjs around line 29:

When `optional: true` is passed and the request times out, `AbortSignal.timeout()` causes `fetch` to reject with a `TimeoutError` before the response status is checked. This bypasses the graceful handling of 404/409 on lines 39-41, causing the entire script to crash even for optional resources like `hyper.md` or `SUMMARY.md` when GitHub is slow.

Consider catching `AbortError` and returning `null` (or the appropriate empty value) when `optional` is true, so timeouts don't crash the script.

Evidence trail:
scripts/sync-sources.mjs lines 29-49 (fetchGithubJson with AbortSignal.timeout on line 36, 404/409 handling on lines 39-41), lines 51-71 (fetchGithubText, same pattern), lines 346-357 (getRepoTree calls with optional:true, no try/catch), lines 359-374 (getLatestRelease, same), lines 376-444 (buildRepoSnapshot calls fetchGithubText with optional:true, no try/catch), lines 507-509 (main catch handler calls process.exit(1)). AbortSignal.timeout() behavior: https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/timeout_static — throws TimeoutError when deadline expires, which rejects the fetch promise before any response is available.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 96c282ec06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve fetch memoization for shared status probes

On /network, src/app/network/page.tsx:30 calls getNetworkStatus() and NetworkStatusGrid calls both getNetworkStatus() and getNodeHealthStatuses() (src/components/network-status.tsx:120-122), with the first known node using the same public /v1/info URL. Next's fetch docs state that passing a signal opts out of render-pass memoization, so when the revalidated cache entry is cold or stale this new signal turns the formerly deduped probe into multiple concurrent requests to the same external node. Please keep timeout handling in a shared cached helper or otherwise preserve memoization so the status page does not amplify load.

Useful? React with 👍 / 👎.