🛡️ Sentinel: [MEDIUM] Add timeouts to external fetch calls to prevent resource exhaustion

[felirami]

User description

🚨 Severity: MEDIUM
💡 Vulnerability: Missing timeouts on native fetch calls, which can cause requests to wait indefinitely if an external service hangs, leading to application DoS or resource exhaustion.
🎯 Impact: Unbounded fetch requests could lock up Next.js render threads, background synchronization scripts (scripts/sync-sources.mjs), or serverless function handlers if upstream APIs like DexScreener or GitHub stop responding.
🔧 Fix: Added explicit timeouts using AbortSignal.timeout(10_000) to all vulnerable fetch calls in the codebase (network.ts, snap-market.ts, and sync-sources.mjs). Also added a Sentinel journal entry documenting the missing timeout vulnerability and its prevention.
✅ Verification: Ran npm run lint, npm run typecheck, and npm run build to verify no regressions in type safety, linting, or production build generation.

---

PR created automatically by Jules for task 15186157582155879778 started by @felirami

---

Note

Low Risk
Defensive timeouts on external HTTP with existing try/catch error paths; no auth or data-model changes. Slow upstreams may surface as timeouts instead of long hangs.

Overview
Adds 10 second AbortSignal.timeout on outbound fetch calls that previously had no bound, so hung GitHub, DexScreener, or node probes cannot hold scripts or server renders indefinitely.

scripts/sync-sources.mjs applies the timeout in both GitHub JSON and raw-text helpers. getNetworkStatus in network.ts now uses the existing NODE_PROBE_TIMEOUT_MS constant (same as node health checks). snap-market.ts introduces FETCH_TIMEOUT_MS for the DexScreener request.

Documents the pattern in .jules/sentinel.md as a missing-timeout / resource-exhaustion lesson.

^{Reviewed by Cursor Bugbot for commit 841a4f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add timeouts to external network requests

What Changed

• External requests now stop after a set time instead of hanging indefinitely when a service is slow or unresponsive.
• Network checks, market data lookups, and source-sync scripts all use request timeouts to avoid long waits and stalled jobs.
• The timeout safety pattern is now recorded for future reference in the Sentinel notes.

Impact

✅ Fewer stalled server renders
✅ Shorter sync jobs when GitHub is slow
✅ Fewer hanging market data requests

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Add 10-second AbortSignal timeouts to external fetch calls to prevent resource exhaustion

• Adds AbortSignal.timeout(10_000) to GitHub fetch calls in sync-sources.mjs and the dexscreener API call in snap-market.ts
• Adds AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS) to the network status probe in network.ts, returning ok: false on timeout
• Exports a new FETCH_TIMEOUT_MS constant (10,000 ms) from snap-market.ts
• Behavioral Change: all affected fetch calls now reject/return error after their timeout instead of waiting indefinitely

📊 Macroscope summarized 841a4f4. 4 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hypersnaporg	Ready	Preview, Comment	Jul 1, 2026 8:58pm

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 841a4f4d1b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the status probe request memoized

On the /network route, src/app/network/page.tsx:30 calls getNetworkStatus() and then NetworkStatusGrid calls it again at src/components/network-status.tsx:121. Next's fetch docs note that passing an AbortController signal opts that request out of server-render memoization, so this new signal makes those two identical status probes run separately; when the public node is slow or hanging, the page can spend another full 10-second timeout and doubles the upstream probe load instead of sharing the first result. Consider wrapping getNetworkStatus in React cache() or otherwise deduplicating while still enforcing the timeout.

Useful? React with 👍 / 👎.

[macroscopeapp]

🟡 Medium scripts/sync-sources.mjs:35

fetchGithubJson aborts every request after 10s via AbortSignal.timeout(10_000), so a single slow GitHub API response throws a TimeoutError out of buildRepoSnapshot into main().catch(...), which exits before writing src/data/farcasterorg-sources.json. Transient API slowness now aborts the entire sync job instead of just delaying it. Consider catching timeout errors in buildRepoSnapshot so one slow request yields a partial snapshot rather than killing the run.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @scripts/sync-sources.mjs around line 35:

`fetchGithubJson` aborts every request after 10s via `AbortSignal.timeout(10_000)`, so a single slow GitHub API response throws a `TimeoutError` out of `buildRepoSnapshot` into `main().catch(...)`, which exits before writing `src/data/farcasterorg-sources.json`. Transient API slowness now aborts the entire sync job instead of just delaying it. Consider catching timeout errors in `buildRepoSnapshot` so one slow request yields a partial snapshot rather than killing the run.