Remove the HTTP request towards `https://aur.archlinux.org`

[christian-heusel]

Your project queries our service so much that this is the top requested endpoint:

copilot-api/src/services/get-vscode-version.ts

Lines 10 to 15 in 0ea08fe

	const response = await fetch(
	"https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=visual-studio-code-bin",
	{
	signal: controller.signal,
	},
	)

Please immediately remove the reference to this endpoint in your codebase as we do not consider it fair use in it's current implementation! ⚠️

If you need an endpoint to hammer please rely on the GitHub mirror of the package https://github.com/archlinux/aur/tree/visual-studio-code-bin (or think of a proper implementation of a version check instead (hinthinthint).

Even something as simple as this would do the trick:

$ curl -s https://code.visualstudio.com/sha/download\?build\=stable\&os\=linux-x64 | awk -F/ '{ print $NF }'
code-stable-x64-1781225422.tar.g

This has caused 42 million requests to this endpoint on our service with the node user agent in the last few weeks:

$ zgrep "cgit/aur.git/plain/PKGBUILD?h=visual-studio-code-bin" $(ls -1 access* | grep -v "json") | grep "node" | wc -l
42072844

If you think that this is a wrongful analysis of the overall situation please let us (the Arch Linux DevOps Team) know!

[johnib]

@christian-heusel from your numbers it looks like getVSCodeVersion() (src/services/get-vscode-version.ts) is fetching the AUR PKGBUILD at module load, so every cold start hits aur.archlinux.org - that'd explain the 42M.

it's only used for the Editor-Version header (plus a cosmetic startup line), doesn't need to be live. easiest is to just make it a constant:

export function getVSCodeVersion() {
  return "1.121.0-insider"
}

bump it when you bump the pinned client version. if you ever actually want it live, code.visualstudio.com/sha is probably better than the AUR.

fwiw i maintain a fork where this is already just the constant - no fetch - so it doesn't hit your endpoint at all. either way sorry for the traffic, this should never have been on a hot path.