The current implementation of the package bulk_search in API v2 is not usable.
It takes over 2 minutes to fetch a single purl, and searching for several purls ends in a timeout.
from timeit import default_timer as timer
import requests
purls = [
"pkg:alpm/archlinux/npm@8.1.4-1",
"pkg:composer/guzzlehttp/guzzle@6.5.8",
"pkg:composer/guzzlehttp/psr7@1.9.0",
"pkg:maven/org.apache.commons/commons-compress@1.9",
"pkg:maven/org.elasticsearch/elasticsearch@7.17.9",
"pkg:nuget/System.Text.Encodings.Web@6.0.0",
"pkg:nuget/System.Text.Encodings.Web@6.0.2",
"pkg:nuget/System.Text.Json@6.0.0",
"pkg:pypi/django@5.0.2",
"pkg:pypi/django@5.0.3",
"pkg:pypi/django@5.0.4",
"pkg:pypi/django@5.0.5",
"pkg:pypi/django@5.0.7",
"pkg:pypi/django@5.0.8",
"pkg:pypi/setuptools@68.0.0",
]
data = {
"purls": purls,
}
# v1, 15 purls
url = "https://public.vulnerablecode.io/api/packages/bulk_search"
start_time = timer()
response = requests.post(url, data)
print(timer() - start_time) # 7 seconds
print(len(response.json())) # -> 15 entries
# v2, 15 purls
url = "https://public.vulnerablecode.io/api/v2/packages/bulk_search"
start_time = timer()
response = requests.post(url, data) # -> TIMEOUT
print(timer() - start_time)
# v2, single purl
url = "https://public.vulnerablecode.io/api/v2/packages/bulk_search"
data = {"purls": "pkg:pypi/django@5.0.2"}
start_time = timer()
response = requests.post(url, data)
print(timer() - start_time) # -> 138 seconds
The current implementation of the package bulk_search in API v2 is not usable.
It takes over 2 minutes to fetch a single purl, and searching for several purls ends in a timeout.