🛡️ Sentinel: [MEDIUM] Add explicit timeouts to external fetch calls

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: DoS risk due to hanging external fetch calls. The native fetch API does not include a default timeout.
🎯 Impact: If a remote endpoint is unresponsive, requests can hang indefinitely, exhausting server resources or stalling background tasks.
🔧 Fix: Added an explicit timeout via signal: AbortSignal.timeout(ms) to external fetch calls in src/lib/network.ts, src/lib/snap-market.ts, and scripts/sync-sources.mjs.
✅ Verification: Verified that npm run lint, npm run typecheck, and npm run build pass without errors.

---

PR created automatically by Jules for task 16850101890054976421 started by @felirami

---

Note

Low Risk
Bounded timeouts on existing external fetches; failures should surface as existing error paths rather than indefinite hangs.

Overview
Adds 10s AbortSignal.timeout on outbound fetch calls that previously had no cap, so slow or stuck remotes cannot hang sync jobs or server work indefinitely.

scripts/sync-sources.mjs defines GITHUB_API_TIMEOUT_MS and applies it to both GitHub JSON and raw-text helpers. src/lib/network.ts adds the same pattern to the public node getNetworkStatus probe (node health checks in that file already used NODE_PROBE_TIMEOUT_MS). src/lib/snap-market.ts adds SNAP_MARKET_TIMEOUT_MS for the Dexscreener request.

Documents the pattern in .jules/sentinel.md as a DoS/hanging-request prevention note.

^{Reviewed by Cursor Bugbot for commit 64c3679. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add timeouts to external fetches so slow services do not stall requests

What Changed

• External requests now stop after 10 seconds instead of hanging indefinitely
• Network status checks, market data lookups, and GitHub sync requests now fail within a fixed time limit
• Added a note explaining that every external fetch should include an explicit timeout

Impact

✅ Fewer hung sync jobs
✅ Lower risk of stalled server work
✅ Clearer failures when remote services are unresponsive

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add explicit 10-second timeouts to external fetch calls in GitHub API, network, and market data utilities

• Adds AbortSignal.timeout() to all outbound fetch calls in scripts/sync-sources.mjs, src/lib/network.ts, and src/lib/snap-market.ts to prevent indefinitely hanging requests.
• GitHub API and dexscreener fetches use a new 10-second constant; the network node probe uses the existing NODE_PROBE_TIMEOUT_MS.
• Behavioral Change: timed-out requests now throw (or fall into the catch path returning { ok: false }) instead of hanging indefinitely.

^{Macroscope summarized 64c3679.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jun 26, 2026 9:17pm

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI finished reviewing your PR.