🛡️ Sentinel: [MEDIUM] Add timeouts to external fetch calls to prevent server resource exhaustion

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: External fetch calls lacked explicit timeouts. The native fetch API does not have a default timeout.
🎯 Impact: Without a timeout, a hanging connection to an external API can cause server resource exhaustion and eventually a Denial of Service (DoS).
🔧 Fix: Added signal: AbortSignal.timeout(TIMEOUT_MS) to external fetch calls in src/lib/network.ts, src/lib/snap-market.ts, and scripts/sync-sources.mjs.
✅ Verification: Ran npm run lint, npm run typecheck, and npm run build successfully. Confirmed changes passed the Sentinel checklist criteria for a security enhancement.

---

PR created automatically by Jules for task 4531735376751732223 started by @felirami

---

Note

Low Risk
Defensive timeouts on existing fetch paths with existing try/catch error handling; no auth or data-model changes.

Overview
Adds AbortSignal.timeout to outbound fetch calls so slow or stuck third-party APIs cannot hold connections open indefinitely.

scripts/sync-sources.mjs uses a 15s cap on GitHub JSON and raw text helpers. getNetworkStatus in src/lib/network.ts now uses the existing 10s node probe timeout (aligned with other node health checks). getSnapMarketData in src/lib/snap-market.ts aborts Dexscreener requests after 10s.

Documents the pattern in .jules/sentinel.md. eslint is pinned to ^9.39.4 in package.json / lockfile.

^{Reviewed by Cursor Bugbot for commit 43e213a. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add timeouts to external requests to avoid stuck connections

What Changed

• External requests now stop after a set time instead of waiting indefinitely
• Network status checks and market data lookups will fail fast when third-party services are slow or unresponsive
• Source sync requests to GitHub now also time out after 15 seconds
• The repo guidance now documents this timeout pattern for future external requests

Impact

✅ Fewer server hangs from slow external APIs
✅ Lower risk of resource exhaustion during network checks
✅ Faster recovery when GitHub or market data requests stall

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add 15s timeouts to external fetch calls in sync scripts and runtime network probes

• Adds AbortSignal.timeout() to GitHub API fetches in scripts/sync-sources.mjs with a 15s timeout (FETCH_TIMEOUT_MS = 15000).
• Adds a timeout to the network status probe in src/lib/network.ts using the existing NODE_PROBE_TIMEOUT_MS constant.
• Adds a 10s timeout (MARKET_DATA_TIMEOUT_MS = 10_000) to the dexscreener API fetch in src/lib/snap-market.ts.
• On timeout, fetches reject with an AbortError, which routes into existing error handling paths and returns ok: false where applicable.
• Behavioral Change: fetch calls that previously hung indefinitely now abort after their respective timeouts.

^{Macroscope summarized 43e213a.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jul 7, 2026 9:00pm

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 43e213a. Configure here.}

[cursor]

Optional GitHub fetches abort sync

Medium Severity

Adding AbortSignal.timeout to fetchGithubJson and fetchGithubText makes timeouts throw before optional handling runs. Callers that pass optional: true only degrade on HTTP 404/409; a slow optional doc, tree, or release fetch now fails the entire sync-sources run instead of continuing with empty or partial data like missing resources do.

Additional Locations (1)

• scripts/sync-sources.mjs#L50-L70

 

^{Reviewed by Cursor Bugbot for commit 43e213a. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 43e213a423

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add a timeout that survives revalidation

After this request has a cached response and the 30s next.revalidate interval expires, Next performs the refresh as a stale revalidation; in Next 16.2.5 the patched fetch intentionally omits init.signal for stale revalidations before calling the origin. This new AbortSignal.timeout therefore only covers cold cache misses, while the production background refresh to Dexscreener can still hang indefinitely and keep the pending revalidation/socket around. Use a timeout path that survives revalidation, or opt out of Next's fetch cache, before relying on this as the DoS mitigation.

Useful? React with 👍 / 👎.