perf: CLI scan performance audit and optimization
Open
@sonukapoor is already working on this.
Since Jul 14, 2026.
enhancement
- Dominant language
- TypeScript
- Stars
- 715
- Forks
- 145
- Avg merge
- 21h 39m
- Merged PRs (30d)
- 66
Description
Overview
Profile the CLI's end-to-end scan execution time and identify the highest-impact optimizations.
Motivation
As the feature set grows (override hygiene, phantom detection, maintenance risk, SARIF output), scan time should be validated against the original fast-scan promise. This issue tracks a focused performance audit to find and fix the top bottlenecks.
Scope
- Profile a representative scan (medium-sized project, ~500 packages, live OSV queries)
- Identify the top 3-5 slowest paths (network I/O, parsing, fix validation, output rendering)
- Implement targeted fixes - no speculative optimization
- Measure before/after for each change
Candidates to investigate
- OSV batch query efficiency
- Packument fetch parallelism and cache hit rate
- Lockfile parsing time on large monorepos
- Fix validation concurrency (
validateDirectFixTargets) - Output rendering for large finding sets
To be done in-house
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.