From 2d450239ac522e31ebb5a603faaa3f628dcfdda8 Mon Sep 17 00:00:00 2001
From: Thomas <thomas@ajnart.fr>
Date: Wed, 15 Jul 2026 11:27:32 +0200
Subject: [PATCH] fix(releases): add required octokit throttling rate limit
 handlers (#6338)

---
 packages/api/src/router/widgets/releases.ts   | 11 +++++---
 .../request-handler/src/release-providers.ts  | 28 ++++++++++++++++++-
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/packages/api/src/router/widgets/releases.ts b/packages/api/src/router/widgets/releases.ts
index 84e903627..d234a75c1 100644
--- a/packages/api/src/router/widgets/releases.ts
+++ b/packages/api/src/router/widgets/releases.ts
@@ -3,6 +3,7 @@ import { escapeForRegEx } from "@tiptap/react";
 import { z } from "zod/v4";
 
 import { decryptSecret } from "@homarr/common/server";
+import { createLogger } from "@homarr/core/infrastructure/logs";
 import { eq } from "@homarr/db";
 import { boards, items, widgetSecrets } from "@homarr/db/schema";
 import { releaseProviderKinds } from "@homarr/definitions";
@@ -11,6 +12,8 @@ import { releasesRequestHandler } from "@homarr/request-handler/releases";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
 import { throwIfActionForbiddenAsync } from "../board/board-access";
 
+const logger = createLogger({ module: "releasesRouter" });
+
 const formatVersionFilterRegex = (versionFilter: z.infer<typeof releaseVersionFilterSchema> | undefined) => {
   if (!versionFilter) return undefined;
 
@@ -71,13 +74,13 @@ export const releasesRouter = createTRPCRouter({
             for (const secret of secrets) {
               try {
                 tokensByProvider.set(secret.kind, decryptSecret(secret.value));
-              } catch {
-                // Skip corrupt secrets
+              } catch (error) {
+                logger.warn("Failed to decrypt widget secret", { itemId: input.itemId, kind: secret.kind, error });
               }
             }
           }
-        } catch {
-          // Access denied or table not yet migrated -- proceed without tokens
+        } catch (error) {
+          logger.warn("Failed to load release widget tokens", { itemId: input.itemId, error });
         }
       }
 
diff --git a/packages/request-handler/src/release-providers.ts b/packages/request-handler/src/release-providers.ts
index d4a9dd2b3..5bfde69b9 100644
--- a/packages/request-handler/src/release-providers.ts
+++ b/packages/request-handler/src/release-providers.ts
@@ -134,7 +134,33 @@ const getGithubApi = (baseUrl: string, userAgent: string, token?: string) =>
     baseUrl,
     auth: token,
     request: { fetch: fetchWithTrustedCertificatesAsync },
-    throttle: { enabled: true },
+    throttle: {
+      enabled: true,
+      onRateLimit: (
+        retryAfter: number,
+        options: { url?: string; method?: string },
+        _octokit: unknown,
+        retryCount: number,
+      ) => {
+        logger.warn(`GitHub rate limit exceeded, retrying after ${retryAfter}s (attempt ${retryCount + 1})`, {
+          url: options.url,
+          method: options.method,
+        });
+        return retryCount < 1;
+      },
+      onSecondaryRateLimit: (
+        retryAfter: number,
+        options: { url?: string; method?: string },
+        _octokit: unknown,
+        retryCount: number,
+      ) => {
+        logger.warn(`GitHub secondary rate limit exceeded, retrying after ${retryAfter}s (attempt ${retryCount + 1})`, {
+          url: options.url,
+          method: options.method,
+        });
+        return retryCount < 1;
+      },
+    },
     userAgent,
   });