@exodus/bitcoin-api 4.14.3 → 4.14.5

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.14.5](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.14.4...@exodus/bitcoin-api@4.14.5) (2026-04-24)
+
+
+### Bug Fixes
+
+
+* fix: enforce fetch timeouts in insight and mempool clients (#7854)
+
+
+
+## [4.14.4](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.14.3...@exodus/bitcoin-api@4.14.4) (2026-04-23)
+
+
+### Bug Fixes
+
+
+* fix: append valid path for btc mempool websocket url (#7851)
+
+
+
 ## [4.14.3](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.14.2...@exodus/bitcoin-api@4.14.3) (2026-04-15)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.14.3",
+  "version": "4.14.5",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -63,5 +63,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "166b906440f92ef09d2f2563fec9d9a365a81015"
+  "gitHead": "c420214d58816a0f5aa682822b066309d796fe30"
 }

package/src/insight-api-client/fetch-with-timeout.js

@@ -0,0 +1,34 @@
+const isPositiveTimeout = (timeout) => Number.isFinite(timeout) && timeout > 0
+
+export default async function fetchWithTimeout(url, fetchOptions) {
+  const { timeout, signal, ...restFetchOptions } = fetchOptions || Object.create(null)
+  const hasFetchOptions = signal !== undefined || Object.keys(restFetchOptions).length > 0
+  const normalizedFetchOptions = hasFetchOptions
+    ? signal
+      ? { ...restFetchOptions, signal }
+      : restFetchOptions
+    : undefined
+
+  if (!isPositiveTimeout(timeout) || typeof AbortController !== 'function') {
+    return fetch(url, normalizedFetchOptions)
+  }
+
+  const controller = new AbortController()
+  const abort = () => controller.abort()
+  const timeoutId = setTimeout(abort, timeout)
+
+  if (signal) {
+    if (signal.aborted) {
+      abort()
+    } else {
+      signal.addEventListener('abort', abort, { once: true })
+    }
+  }
+
+  try {
+    return await fetch(url, { ...restFetchOptions, signal: controller.signal })
+  } finally {
+    clearTimeout(timeoutId)
+    signal?.removeEventListener?.('abort', abort)
+  }
+}

package/src/insight-api-client/index.js

@@ -5,6 +5,8 @@ import delay from 'delay'
 import lodash from 'lodash'
 import urlJoin from 'url-join'
 
+import fetchWithTimeout from './fetch-with-timeout.js'
+
 const { isEmpty } = lodash
 
 const INSIGHT_HTTP_ERROR_MESSAGE = safeString`insight-api-http-error`
@@ -40,7 +42,7 @@ const fetchJson = async (
   nullWhen404,
   httpErrorMessage = INSIGHT_HTTP_ERROR_MESSAGE
 ) => {
-  const response = await fetch(url, fetchOptions)
+  const response = await fetchWithTimeout(url, fetchOptions)
 
   if (nullWhen404 && response.status === 404) {
     return null

package/src/insight-api-client/mempool-rest-client.js

@@ -4,6 +4,8 @@ import { TraceId } from '@exodus/traceparent'
 import delay from 'delay'
 import urlJoin from 'url-join'
 
+import fetchWithTimeout from './fetch-with-timeout.js'
+
 const API_PAGE_SIZE = 25
 const DEFAULT_PAGE_SIZE = 10
 const RETRY_WAIT_TIMES = ['5s', '10s', '20s', '30s']
@@ -109,7 +111,7 @@ async function withRetry(fn, args = [], { waitTimes = RETRY_WAIT_TIMES } = {}) {
 }
 
 async function fetchJson(url, fetchOptions, { nullWhen404 = false, httpErrorMessage } = {}) {
-  const response = await fetch(url, fetchOptions)
+  const response = await fetchWithTimeout(url, fetchOptions)
   if (nullWhen404 && response.status === 404) {
     return null
   }
@@ -132,7 +134,7 @@ async function fetchJson(url, fetchOptions, { nullWhen404 = false, httpErrorMess
 }
 
 async function fetchText(url, fetchOptions, { nullWhen404 = false, httpErrorMessage } = {}) {
-  const response = await fetch(url, fetchOptions)
+  const response = await fetchWithTimeout(url, fetchOptions)
   if (nullWhen404 && response.status === 404) {
     return null
   }

package/src/insight-api-client/util.js

@@ -80,12 +80,12 @@ export function orderTxs(txs) {
 }
 
 /**
- * It concerts an api URL to a WS service URL.
+ * Strips a service URL down to its origin while preserving the scheme.
  *
  * https://somebtc.a.exodus.io/insight/ => https://somebtc.a.exodus.io
  *
  * @param {string} apiUrl the original apiUrl
- * @returns {string} a WS url without the paths.
+ * @returns {string} a service origin URL.
  */
 export function toWSUrl(apiUrl) {
   if (!apiUrl) {
@@ -106,12 +106,21 @@ export function toWSUrl(apiUrl) {
   }
 }
 
+export function toMempoolWebSocketUrl(apiUrl) {
+  const wsUrl = toWSUrl(apiUrl)
+  if (typeof wsUrl !== 'string') {
+    return wsUrl
+  }
+
+  return `${wsUrl}/api/v1/ws`
+}
+
 export function normalizeInsightConfig(config, monitorType) {
   const apiUrl = config?.insightServers?.[0]
   const mempoolApiUrl = config?.mempoolServer
   const wsUrl =
     monitorType === 'mempool'
-      ? config?.mempoolServerWS || toWSUrl(mempoolApiUrl)
+      ? config?.mempoolServerWS || toMempoolWebSocketUrl(mempoolApiUrl)
       : config?.insightServersWS?.[0] || toWSUrl(apiUrl)
   return { apiUrl, mempoolApiUrl, wsUrl }
 }

package/src/tx-log/bitcoin-monitor.js

@@ -5,7 +5,11 @@ import assert from 'minimalistic-assert'
 import ms from 'ms'
 
 import MempoolWSClient from '../insight-api-client/mempool-ws-client.js'
-import { normalizeInsightConfig, toWSUrl } from '../insight-api-client/util.js'
+import {
+  normalizeInsightConfig,
+  toMempoolWebSocketUrl,
+  toWSUrl,
+} from '../insight-api-client/util.js'
 import InsightWSClient from '../insight-api-client/ws.js'
 import { resolveUnconfirmedAncestorData } from '../unconfirmed-ancestor-data.js'
 import { BitcoinMonitorScanner } from './bitcoin-monitor-scanner.js'
@@ -103,7 +107,9 @@ export class Monitor extends BaseMonitor {
       this.#connectWS(
         wsUrl ||
           this.#wsUrl ||
-          toWSUrl(this.#monitorType === 'mempool' ? this.#mempoolApiUrl : this.#apiUrl)
+          (this.#monitorType === 'mempool'
+            ? toMempoolWebSocketUrl(this.#mempoolApiUrl)
+            : toWSUrl(this.#apiUrl))
       )
     }
   }