google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.28k stars 363 forks source link

Do mutliple BatchQueries requests in parallel #1411

Open michaelkedar opened 1 week ago

michaelkedar commented 1 week ago

BatchQueries have to be chunked into groups of 1000 packages per request. We currently make each chunked BatchQuery sequentially: https://github.com/google/osv-scanner/blob/8d59ca5d95eca2b5c3b5cb4cb0d519fd468b3129/pkg/osv/osv.go#L185-L191

We could get a decent performance improvement on large scans if we do these in parallel, though we might want to make sure the OSV API is okay with these kinds of spikes.