SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

🚨 Jira Linter Failed

Commit: b34fe59
Failed at: 2026-06-19 12:03:32 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to get Jira issue: failed to fetch Jira issue TT-17515: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

🎯 Recommended Merge Targets

Based on JIRA ticket TT-17515: Granular Endpoint Enforced Timeout for Tyk Classic API

Fix Version: Tyk 5.14.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

📋 Workflow

1. Merge this PR to master first

This pull request renames the timeout_duration field to duration within the HardTimeoutMeta struct for Tyk Classic API definitions. The change is a wire-format-only update to the JSON and BSON tags, aligning the field name with its equivalent in the Tyk OAS definition (enforceTimeout.duration). The Go field name TimeoutDuration remains unchanged, ensuring no impact on existing logic in the gateway's reverse proxy or validators.

Files Changed Analysis

The changes are confined to four files:

• apidef/api_definitions.go: The json and bson tags for TimeoutDuration were updated from "timeout_duration,omitempty" to "duration,omitempty".
• apidef/api_definitions_test.go: A new test, TestHardTimeoutMeta_DurationWireTag, was added to verify that the struct correctly marshals and unmarshals using the new duration key and respects the omitempty tag.
• apidef/schema.json: The API definition's JSON schema was updated to reflect the property rename.
• apidef/oas/middleware.go: A documentation comment was updated to reference the new field name.

The changes are minimal and consistent, with a net addition of 36 lines, primarily for the new test case.

Architecture & Impact Assessment

• Accomplishment: This PR achieves naming consistency between Tyk Classic and Tyk OAS API definitions for the granular timeout setting, improving developer experience and reducing ambiguity.
• Key Technical Changes: The core change is the modification of serialization tags on a Go struct. No application logic, validation, or data processing has been altered. The change is purely at the data definition layer.
• Affected Components: The primary impact is on systems that produce or consume Tyk Classic API definitions, such as the Tyk Gateway's configuration loader and the Tyk Dashboard. The gateway will now expect the duration field. As noted in the PR description, the old timeout_duration field was never part of a public release, so no backward compatibility measures are required.

graph TD
    subgraph id1[API Definition Layer]
        A[Classic API Definition JSON] -- Contains --> B(hard_timeouts);
        B -- "Field renamed" --> B_New["hard_timeouts with 'duration' field"];
    end

    subgraph id2[Go Structs]
        C[apidef.HardTimeoutMeta] --|`json:"duration"`|--> B_New;
    end

    subgraph id3["Gateway Logic (Unaffected)"]
        D[Reverse Proxy] -- Uses --> C;
        E[Validator] -- Uses --> C;
    end

    A -- "Parsed into" --> C;

    style B fill:#ffcccc
    style B_New fill:#ccffcc

Scope Discovery & Context Expansion

The scope of this change is narrow and well-defined, limited to the wire format of the Tyk Classic API definition. The author correctly notes that since the Go field HardTimeoutMeta.TimeoutDuration is unchanged, the core enforcement logic is not affected.

A search for usages of TimeoutDuration confirms it is primarily used in gateway/reverse_proxy.go to set the request context timeout. Since the field name in the Go struct is stable, the logic that reads the parsed configuration remains correct and does not require any changes. The impact is therefore isolated to the serialization and deserialization boundary of the API definition.

Powered by Visor from Probelabs

Last updated: 2026-06-19T12:05:39.700Z | Triggered by: pr_opened | Commit: b34fe59

💡 TIP: You can chat with Visor using /visor ask <your question>

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Powered by Visor from Probelabs

Last updated: 2026-06-19T12:05:19.260Z | Triggered by: pr_opened | Commit: b34fe59

💡 TIP: You can chat with Visor using /visor ask <your question>

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Isn't it backward incompatible change which breaks legacy API definitions which had this field before?

Isn't it backward incompatible change which breaks legacy API definitions which had this field before?

@buger not really, as the old naming wasn't released yet, it's only present in master

/release to release-5.14.0

/release to release-5.14

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #8369

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #8370