Purl matcher cache - #2819
Open
Hubtrick-Git wants to merge 6 commits into
Open
Conversation
Hubtrick-Git
requested review from
timbastin
and
a lite review from Copilot
and removed request for
Copilot
August 10, 2026 10:49
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an in-memory cache for PURL-to-affected-components lookups in the vuln DB scanner to reduce repeated database fetches during scans, and flushes that cache after a successful vuln DB import so cached results don’t go stale.
Changes:
- Introduces a generation-based, RWMutex-protected cache keyed by normalized PURL + query shape and integrates it into candidate resolution.
- Flushes the scan cache after a successful
ImportRCcommit. - Adds unit tests covering cache keying, flush/generation behavior, and cache usage in resolver logic.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| vulndb/vulndb_service.go | Flushes the scan cache after a successful vuln DB import commit. |
| vulndb/scan/purl_comparer.go | Implements and uses an affected-components cache during PURL matching. |
| vulndb/scan/purl_comparer_test.go | Adds tests for cache behavior, safety, and resolver cache hits. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+148
to
+149
| components, ok := acc.cache[candidate.cacheKey()] | ||
| return components, ok |
Comment on lines
+219
to
223
| // only cache after every shape is finished | ||
| cache.SetForCandidates(candidates, generationOfValues) | ||
|
|
||
| slog.Info("finished purl matching", "cache usage", float32(cacheUsage)/float32(len(purls))) | ||
| // the candidates are in request order, whereas byShape is not |
Co-authored-by: Hubtrick-Git <199759119+Hubtrick-Git@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Added a cache which caches affected components for a given purl, if recently fetched from the database.
This aims to reduce fetch requests to the database on scans
Cache if flushed only after a successful vulndb import.
Discussion
The cache holds slices of affected components. Currently its initialized with 10_000 entries (arbitrary value). Also it can grow indefinitely; this could potentially lead to big memory consumption.
Ideas to solve: