🛡️ Sentinel: [MEDIUM] Add timeout configurations to external fetch calls

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: Native fetch API calls lack explicit timeouts.
🎯 Impact: Without timeouts, requests to external APIs (GitHub, Dexscreener, Farcaster Nodes) can hang indefinitely, potentially leading to server resource exhaustion or unresponsive endpoints in the Next.js application.
🔧 Fix: Added explicit timeouts using AbortSignal.timeout() to all native fetch calls across the application and synchronization scripts.
✅ Verification: Run npm run lint, npm run typecheck, and npm run build to ensure no syntax errors. Verify npm run sync:sources completes successfully.

---

PR created automatically by Jules for task 17636196025121805113 started by @felirami

---

Note

Low Risk
Small, defensive networking changes with no auth or data-model impact; worst case is earlier failures on slow external APIs.

Overview
Adds AbortSignal.timeout() on outbound fetch calls that were previously unbounded, so slow or stuck GitHub, node probe, and market API requests fail fast instead of hanging server work.

scripts/sync-sources.mjs — 15s timeout on both GitHub JSON and raw text helpers used by npm run sync:sources.

src/lib/network.ts — getNetworkStatus() now uses the existing NODE_PROBE_TIMEOUT_MS (10s) abort signal on the public node info request.

src/lib/snap-market.ts — 10s timeout on the Dexscreener market data fetch.

.jules/sentinel.md — documents the “missing fetch timeouts” pattern and the AbortSignal.timeout prevention rule for future changes.

^{Reviewed by Cursor Bugbot for commit 3a4caec. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add AbortSignal timeouts to external fetch calls in network, market data, and GitHub utilities

• Adds AbortSignal.timeout(15000) to fetchGithubJson and fetchGithubText in sync-sources.mjs, aborting GitHub requests after 15s.
• Adds AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS) to getNetworkStatus in network.ts; on timeout, returns ok: false with an error message.
• Adds AbortSignal.timeout(10000) to getSnapMarketData in snap-market.ts; on timeout, returns ok: false from the catch path.
• Behavioral Change: Previously unbounded fetch calls now reject or return error states after their respective timeouts, which may surface new AbortError failures in callers that did not previously handle timeouts.

^{Macroscope summarized 3a4caec.}

---

CodeAnt-AI Description

Add timeouts to external fetch requests

What Changed

• External requests now fail fast instead of hanging when GitHub, Dexscreener, or node status endpoints are slow or unresponsive
• Source sync requests to GitHub now stop after 15 seconds for both JSON and raw content fetches
• Network status checks and market data lookups now stop after a fixed timeout
• The fetch-timeout pattern is now documented to prevent unbounded requests in future changes

Impact

✅ Fewer hanging server requests
✅ Lower risk of resource exhaustion from slow APIs
✅ Faster failure on unresponsive external services

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jul 8, 2026 9:14pm

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI finished reviewing your PR.