🛡️ Sentinel: [MEDIUM] Add timeouts to external fetch requests

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: The native fetch API lacks a default timeout. Requests to external endpoints might hang indefinitely if the remote server is unresponsive, potentially leading to server-side resource exhaustion and a Denial of Service (DoS) risk.
🎯 Impact: If external APIs like GitHub, Dexscreener, or public nodes are slow or hang, the application could consume unbounded resources, eventually blocking subsequent legitimate requests.
🔧 Fix: Added explicit timeouts to external fetch calls in scripts/sync-sources.mjs, src/lib/network.ts, and src/lib/snap-market.ts using AbortSignal.timeout().
✅ Verification: Run npm run typecheck and npm run build to verify the codebase compiles correctly without any issues. The application should now fail fast instead of hanging on external network requests.

---

PR created automatically by Jules for task 17301272163866889054 started by @felirami

---

Note

Low Risk
Small, defensive networking changes with existing try/catch error paths; no auth or data-model changes.

Overview
Adds fail-fast timeouts on server-side fetch calls that previously could hang indefinitely when upstream APIs stall.

scripts/sync-sources.mjs introduces a 30s GitHub API timeout on both JSON and raw text helpers. getNetworkStatus in src/lib/network.ts now uses the existing 10s node probe timeout (matching other health checks). getSnapMarketData in src/lib/snap-market.ts adds a 10s Dexscreener timeout.

Documents the pattern in .jules/sentinel.md for future reviews.

^{Reviewed by Cursor Bugbot for commit f222a60. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add timeouts to external requests so slow upstream services do not hang the app

What Changed

• External requests to GitHub, Dexscreener, and node health checks now stop after a fixed wait instead of staying open indefinitely
• Source-syncing requests now fail fast on unresponsive GitHub responses
• The review notes now include this timeout pattern for future reference

Impact

✅ Fewer stuck data refreshes
✅ Lower risk of request pileups
✅ Clearer failure behavior when upstream services are slow

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add 30s/10s AbortSignal timeouts to external fetch requests

• Adds signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS) (30s) to fetchGithubJson and fetchGithubText in sync-sources.mjs
• Adds signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS) to the fetch in getNetworkStatus in network.ts
• Adds signal: AbortSignal.timeout(SNAP_MARKET_TIMEOUT_MS) (10s) to the fetch in getSnapMarketData in snap-market.ts
• Behavioral Change: all three call sites now reject/return { ok: false, error: ... } on timeout instead of hanging indefinitely

^{Macroscope summarized f222a60.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jun 22, 2026 8:55pm

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f222a60. Configure here.}

[cursor]

Optional GitHub fetch throws on timeout

Medium Severity

Adding AbortSignal.timeout to fetchGithubJson and fetchGithubText lets timed-out requests throw before the HTTP status checks. Call sites that pass optional: true only treat 404/409 as skippable, so a slow or stuck optional GitHub resource aborts the whole sync:sources run instead of returning null or "" like a missing file.

 

^{Reviewed by Cursor Bugbot for commit f222a60. Configure here.}