🛡️ Sentinel: [MEDIUM] Add missing timeouts to external API calls

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: Missing timeouts on external fetch calls. Native fetch lacks a default timeout, leading to potential hanging connections if external APIs (like Dexscreener, GitHub, or public nodes) are slow or unresponsive.
🎯 Impact: This could result in server resource exhaustion, connection pooling issues, or indefinite hangs during Next.js data fetching or background synchronization scripts.
🔧 Fix: Explicitly added signal: AbortSignal.timeout(TIMEOUT_MS) to unprotected fetch calls.
✅ Verification: Successfully ran npm run lint, npm run typecheck, and npm run build to confirm no syntax or compilation issues exist, and that variables like NODE_PROBE_TIMEOUT_MS were successfully defined/reused.

---

PR created automatically by Jules for task 1666619706137427155 started by @felirami

---

Note

Low Risk
Defensive networking only; failures surface as existing timeout/error paths without changing auth or business logic.

Overview
Adds 10 second AbortSignal.timeout on outbound fetch calls that previously had no deadline, so slow or stuck GitHub, Dexscreener, and public node APIs cannot hang scripts or Next.js data fetching indefinitely.

In scripts/sync-sources.mjs, introduces GITHUB_FETCH_TIMEOUT_MS and applies it to both fetchGithubJson and fetchGithubText. In src/lib/snap-market.ts, adds SNAP_MARKET_TIMEOUT_MS on the Dexscreener request in getSnapMarketData. In src/lib/network.ts, wires the existing NODE_PROBE_TIMEOUT_MS into getNetworkStatus (node health checks in the same file already used this constant).

^{Reviewed by Cursor Bugbot for commit b153f13. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add time limits to external data requests so they stop hanging

What Changed

• External requests to GitHub, Dexscreener, and public node APIs now stop after 10 seconds instead of waiting indefinitely
• Network status checks now fail fast when a node is slow or unresponsive
• Market data and source-sync jobs now return an error sooner when external services do not respond

Impact

✅ Fewer stuck data refreshes
✅ Faster failure on slow API calls
✅ Lower risk of hanging background sync jobs

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add 10-second timeouts to GitHub, network, and market data fetch calls

• Adds AbortSignal.timeout() to fetchGithubJson and fetchGithubText in sync-sources.mjs, aborting GitHub API calls after 10s.
• Adds a timeout to the node info probe in getNetworkStatus in network.ts using the existing NODE_PROBE_TIMEOUT_MS constant.
• Adds a new SNAP_MARKET_TIMEOUT_MS constant (10s) and applies it to getSnapMarketData in snap-market.ts; on timeout, the function returns ok: false with the abort error message.
• Behavioral Change: previously these fetches had no timeout and could hang indefinitely; they now reject or return errors after 10 seconds.

^{Macroscope summarized b153f13.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jun 25, 2026 8:48pm

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b153f13a1d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve fetch memoization for the status probe

On /network, NetworkPage awaits getNetworkStatus() and then NetworkStatusGrid calls the same helper again; Next's fetch docs state that passing a signal opts out of same-render GET memoization. Because this new timeout signal is recreated for each call, a slow-but-successful public node probe on a cache miss is no longer shared and can be fetched twice serially, delaying the streamed grid by another probe interval; consider keeping the timeout below a memoized/cached helper or passing the already-fetched status into the grid.

Useful? React with 👍 / 👎.