Improve fixed version daemon

[Hubtrick-Git]

Fixed Version Daemon

Changed the approach from a iterative approach processing 1 vuln at a time, to an aggregated processing. More concretely:

• Now filters for distinct dependency vulns instead of all vulns.
• Calculate fixed version in batches now instead of individual purls
• Updates rows using staging table instead of individual updates

Purl Comparer Improvements

In Order to make the fixed version daemon faster, I also made some performance improvements regarding the affected components matching logic:

• The purl comparer now is customizable regarding what gets preloaded. The default is the existing preload behaviour, but fixed version daemon can skip all preloads except cves.
• The version based filter now happens BEFORE the additional preloads. SO we first fetch the colums necessary for version matching and then preload only the components which survived the filter
• Uses ANY instead of IN to for more efficient parameter parsing and query peformance

Disclaimer

When testing against the main database it seems like no vulns need to be updated. After intensively searching for a bug I could not find one. It seems like that the underlying data is just up to date.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

vulndb/scan/purl_comparer.go:105

• GetAffectedComponentsBatch is exported but returns []*candidate where candidate is an unexported type. This makes the public API awkward for callers (they can’t name the type) and typically triggers lint/vet warnings. Consider exporting the type (e.g., Candidate) or returning an exported result type instead.

// wrapper for calling resolve candidates itself with multiple purls
func (comparer *PurlComparer) GetAffectedComponentsBatch(ctx context.Context, purls []packageurl.PackageURL) ([]*candidate, error) {
	return comparer.resolveCandidates(ctx, purls)
}

daemons/fixed_version_daemon.go:66

• FetchVulnsToUpdate starts a tracing span but never ends it, which can leak spans and skew tracing data. Add a deferred span.End().

	ctx, span := daemonTracer.Start(ctx, "daemon.fixed-versions.FetchVulnsToUpdate")
	var fixedVersionJobs []fixedVersionJob

daemons/fixed_version_daemon.go:110

• The deferred rollback block logs "successfully rolled back transaction" based on the outer err variable, so it can log a rollback even after a successful commit. It also shadows err inside the Rollback call, making the intent unclear. Prefer checking the rollback error explicitly and avoid logging a rollback on success.

		if err := tx.Rollback(ctx); err != nil && err != pgx.ErrTxClosed {
			slog.Error("fatal could not rollback updating transaction, database state possibly inconsistent", "error", err)
		}
		if err == nil {
			slog.Info("successfully rolled back transaction")