Take the token out of the tracked file, and put a timeout on the two API calls

azer commented

2026-09-16 08:18:38 +00:00

Owner

config.py held the bot token as a literal, so running this starts with editing a file git is watching, and one 'git commit -a' later it is in the history of a public repository for good. It now comes from BOT_TOKEN, main refuses to start without one instead of handing Telegram an empty string, and a .gitignore is added (there was none). The two requests.get calls are blocking and are made from inside coroutines, so an API that stops answering does not slow one reply down - it stops the bot answering anybody; both now carry a 10s timeout. Checked by calling both Animals methods against the live APIs: URLs and captions come back as before. Separately, and not touched here: requirements.txt pins aiohttp 3.7.4, requests 2.23.0, idna 2.9 and Babel 2.9.1, all of which carry published advisories - moving them means moving aiogram off 2.7, which is a change worth making deliberately.

azer added 1 commit

2026-09-16 08:18:38 +00:00

Take the token out of the tracked file, and put a timeout on the two API calls 5b9b0d06f2

config.py held the token as a literal, so running the bot started with editing
a file git is watching — and the next 'git commit -a' puts it in the history of
a public repository for good. It comes from BOT_TOKEN now, and main refuses to
start without one rather than handing an empty string to Telegram.

The two requests.get calls are blocking and are made from inside coroutines, so
an API that stops answering stops the bot answering anybody.

azer merged commit 2763575da4 into master

2026-09-16 15:39:54 +00:00

azer referenced this pull request from a commit

2026-09-16 15:39:56 +00:00

Merge pull request 'Take the token out of the tracked file, and put a timeout on the two API calls' (#10) from azer/token-from-env-and-timeouts into master

Rows
Columns

Take the token out of the tracked file, and put a timeout on the two API calls #10