@exodus/bitcoin-api 4.14.4 → 4.14.5

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.14.5](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.14.4...@exodus/bitcoin-api@4.14.5) (2026-04-24)
+
+
+### Bug Fixes
+
+
+* fix: enforce fetch timeouts in insight and mempool clients (#7854)
+
+
+
 ## [4.14.4](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.14.3...@exodus/bitcoin-api@4.14.4) (2026-04-23)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.14.4",
+  "version": "4.14.5",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -63,5 +63,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "b71dc8274c76060519eb7b2cebdccbc7919cd144"
+  "gitHead": "c420214d58816a0f5aa682822b066309d796fe30"
 }

package/src/insight-api-client/fetch-with-timeout.js

@@ -0,0 +1,34 @@
+const isPositiveTimeout = (timeout) => Number.isFinite(timeout) && timeout > 0
+
+export default async function fetchWithTimeout(url, fetchOptions) {
+  const { timeout, signal, ...restFetchOptions } = fetchOptions || Object.create(null)
+  const hasFetchOptions = signal !== undefined || Object.keys(restFetchOptions).length > 0
+  const normalizedFetchOptions = hasFetchOptions
+    ? signal
+      ? { ...restFetchOptions, signal }
+      : restFetchOptions
+    : undefined
+
+  if (!isPositiveTimeout(timeout) || typeof AbortController !== 'function') {
+    return fetch(url, normalizedFetchOptions)
+  }
+
+  const controller = new AbortController()
+  const abort = () => controller.abort()
+  const timeoutId = setTimeout(abort, timeout)
+
+  if (signal) {
+    if (signal.aborted) {
+      abort()
+    } else {
+      signal.addEventListener('abort', abort, { once: true })
+    }
+  }
+
+  try {
+    return await fetch(url, { ...restFetchOptions, signal: controller.signal })
+  } finally {
+    clearTimeout(timeoutId)
+    signal?.removeEventListener?.('abort', abort)
+  }
+}

package/src/insight-api-client/index.js

@@ -5,6 +5,8 @@ import delay from 'delay'
 import lodash from 'lodash'
 import urlJoin from 'url-join'
 
+import fetchWithTimeout from './fetch-with-timeout.js'
+
 const { isEmpty } = lodash
 
 const INSIGHT_HTTP_ERROR_MESSAGE = safeString`insight-api-http-error`
@@ -40,7 +42,7 @@ const fetchJson = async (
   nullWhen404,
   httpErrorMessage = INSIGHT_HTTP_ERROR_MESSAGE
 ) => {
-  const response = await fetch(url, fetchOptions)
+  const response = await fetchWithTimeout(url, fetchOptions)
 
   if (nullWhen404 && response.status === 404) {
     return null

package/src/insight-api-client/mempool-rest-client.js

@@ -4,6 +4,8 @@ import { TraceId } from '@exodus/traceparent'
 import delay from 'delay'
 import urlJoin from 'url-join'
 
+import fetchWithTimeout from './fetch-with-timeout.js'
+
 const API_PAGE_SIZE = 25
 const DEFAULT_PAGE_SIZE = 10
 const RETRY_WAIT_TIMES = ['5s', '10s', '20s', '30s']
@@ -109,7 +111,7 @@ async function withRetry(fn, args = [], { waitTimes = RETRY_WAIT_TIMES } = {}) {
 }
 
 async function fetchJson(url, fetchOptions, { nullWhen404 = false, httpErrorMessage } = {}) {
-  const response = await fetch(url, fetchOptions)
+  const response = await fetchWithTimeout(url, fetchOptions)
   if (nullWhen404 && response.status === 404) {
     return null
   }
@@ -132,7 +134,7 @@ async function fetchJson(url, fetchOptions, { nullWhen404 = false, httpErrorMess
 }
 
 async function fetchText(url, fetchOptions, { nullWhen404 = false, httpErrorMessage } = {}) {
-  const response = await fetch(url, fetchOptions)
+  const response = await fetchWithTimeout(url, fetchOptions)
   if (nullWhen404 && response.status === 404) {
     return null
   }