🛡️ Sentinel: [MEDIUM] Add explicit timeouts to external fetch calls

[felirami]

User description

This adds explicit timeouts to all fetch calls in the codebase to prevent potential Denial-of-Service vulnerabilities from long-running or stalled network requests.

🚨 Severity: MEDIUM
💡 Vulnerability: Missing fetch timeouts on external API calls could result in indefinite hanging requests.
🎯 Impact: An unresponsive external API could cause the Next.js server to hang or exhaust memory due to unclosed fetch requests.
🔧 Fix: Used Node 20's AbortSignal.timeout(TIMEOUT_MS) to explicitly cap request lengths.
✅ Verification: Verified using npm run lint, npm run typecheck, and npm run build.

---

PR created automatically by Jules for task 6284980928893417545 started by @felirami

---

Note

Low Risk
Defensive reliability change with bounded failure behavior; no auth or data-model changes, though slow-but-valid responses may now fail after 10s.

Overview
Adds 10s AbortSignal.timeout caps on outbound fetch calls so stalled GitHub, node info, and Dexscreener requests cannot hang indefinitely.

The GitHub sync script (fetchGithubJson / fetchGithubText) gets a shared FETCH_TIMEOUT_MS. Runtime paths wire timeouts into getNetworkStatus in network.ts (node health checks already used NODE_PROBE_TIMEOUT_MS) and getSnapMarketData via new MARKET_FETCH_TIMEOUT_MS. A Sentinel note in .jules/sentinel.md records the pattern for future reviews.

Existing try/catch paths should surface abort/timeout errors as before rather than leaving connections open.

^{Reviewed by Cursor Bugbot for commit 814bfb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add timeouts to external API requests

What Changed

• External requests to GitHub, Dexscreener, and node status checks now stop after 10 seconds instead of waiting indefinitely
• Source sync and market data lookups now fail fast when an upstream service is slow or unresponsive
• Added a review note so the same timeout pattern is used on future external requests

Impact

✅ Fewer hung requests
✅ Lower risk of server resource exhaustion
✅ Clearer failures when external services stop responding

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add explicit 10s timeouts to external fetch calls in sync, network, and market modules

Node.js fetch has no default timeout, so calls could hang indefinitely. This PR adds AbortSignal.timeout() to all external fetch calls across three areas:

• scripts/sync-sources.mjs: adds FETCH_TIMEOUT_MS = 10_000 and applies it to fetchGithubJson and fetchGithubText
• src/lib/network.ts: applies AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS) to the getNetworkStatus probe
• src/lib/snap-market.ts: adds MARKET_FETCH_TIMEOUT_MS = 10_000 and applies it to getSnapMarketData
• Behavioral Change: timed-out calls now throw or return ok:false with an abort error message instead of hanging

^{Macroscope summarized 814bfb0.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jul 6, 2026 8:50pm

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 814bfb028d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep network status fetches memoized

On the server-rendered home and /network pages, NetworkStatusGrid calls getNetworkStatus() and getNodeHealthStatuses() in the same render, and the first known node probes the same /v1/info URL; /network also calls getNetworkStatus() before rendering the grid. Passing a fresh AbortSignal opts these GETs out of Next's request memoization, so a cache miss now sends duplicate public-node requests per render instead of sharing one. Keep the timeout in a shared/cached helper or reuse the first public-node result so the hardening doesn't increase upstream load.

Useful? React with 👍 / 👎.