Skip to content

perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir - #10325

Merged
knqyf263 merged 1 commit into
aquasecurity:mainfrom
ankit98040:perf/optimize-filepath-walkdir
Mar 11, 2026
Merged

knqyf263 merged 1 commit into
aquasecurity:mainfrom
ankit98040:perf/optimize-filepath-walkdir

Conversation

@ankit98040

@ankit98040 ankit98040 commented Mar 5, 2026 •

Copy link
Copy Markdown
Contributor

Description

perf(plugin): optimize directory traversal with filepath.WalkDir

Prior to Go 1.16, filepath.Walk invoked os.Lstat on every visited file or directory to retrieve a heavy fs.FileInfo object, causing a significant performance bottleneck due to excessive system calls.

This commit replaces filepath.Walk with the more performant filepath.WalkDir API in the pkg/module package. The newer API passes an fs.DirEntry instead, which utilizes cached directory entry information provided by modern operating systems during the initial directory read.

This optimization minimizes unnecessary lstat syscalls over large directory structures when loading WebAssembly modules, significantly improving filesystem traversal speed and reducing CPU overhead.

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

… with filepath.WalkDir

Prior to Go 1.16, `filepath.Walk` invoked `os.Lstat` on every visited file or directory to retrieve a heavy `fs.FileInfo` object, causing a significant performance bottleneck due to excessive system calls.

This commit replaces `filepath.Walk` with the more performant `filepath.WalkDir` API in the `pkg/module` package. The newer API passes an `fs.DirEntry` instead, which utilizes cached directory entry information provided by modern operating systems during the initial directory read.

This optimization minimizes unnecessary `lstat` syscalls over large directory structures when loading WebAssembly modules, significantly improving filesystem traversal speed and reducing CPU overhead.
@ankit98040
ankit98040 requested a review from knqyf263 as a code owner March 5, 2026 03:45
@ankit98040 ankit98040 changed the title perf(module): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir Mar 5, 2026

@knqyf263 knqyf263 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your contribution. While the practical performance gain may be minimal since the WASM module directory typically doesn't contain a large number of files, there's no downside to this change. filepath.WalkDir is the recommended API since Go 1.16.

@knqyf263
knqyf263 added this pull request to the merge queue Mar 11, 2026
Merged via the queue into aquasecurity:main with commit d7fb355 Mar 11, 2026
14 of 15 checks passed
hjmcnew pushed a commit to hjmcnew/esphome-configs that referenced this pull request Jul 25, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | docker | minor | `0.69.3` → `0.72.0` |

---

### Release Notes

<details>
<summary>aquasecurity/trivy (aquasec/trivy)</summary>

### [`v0.72.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0720-2026-06-30)

[Compare Source](aquasecurity/trivy@v0.71.2...v0.72.0)

##### ⚠ BREAKING CHANGES

- migrate docker config to dockers\_v2 ([#&#8203;10783](aquasecurity/trivy#10783))

##### Features

- **bottlerocket:** add vulnerability matching for Bottlerocket OS ([#&#8203;10893](aquasecurity/trivy#10893)) ([246ee3c](aquasecurity/trivy@246ee3c))
- **dotnet:** detect bundled runtime in self-contained deployments ([#&#8203;10786](aquasecurity/trivy#10786)) ([bd78842](aquasecurity/trivy@bd78842))
- **java:** detect JAR licenses from packaged LICENSE files ([#&#8203;10856](aquasecurity/trivy#10856)) ([b8a1ccd](aquasecurity/trivy@b8a1ccd))
- **java:** detect JAR licenses from the embedded pom.xml ([#&#8203;10851](aquasecurity/trivy#10851)) ([0a166c3](aquasecurity/trivy@0a166c3))
- **misconf:** Adds CloudFront standard logging v2 support to AVD-AWS-0010 ([#&#8203;10848](aquasecurity/trivy#10848)) ([a848925](aquasecurity/trivy@a848925))
- **secret:** add OpenAI secret detection rules ([#&#8203;10798](aquasecurity/trivy#10798)) ([65e5128](aquasecurity/trivy@65e5128))
- **secret:** support new stateless format for GitHub App installation tokens ([#&#8203;10826](aquasecurity/trivy#10826)) ([e68f3d2](aquasecurity/trivy@e68f3d2))

##### Bug Fixes

- correct format verbs in diagnostic messages ([#&#8203;10805](aquasecurity/trivy#10805)) ([859a933](aquasecurity/trivy@859a933))
- forward ospkg detector options through ospkg.NewScanner ([#&#8203;10811](aquasecurity/trivy#10811)) ([28d44d3](aquasecurity/trivy@28d44d3))
- **image:** deterministic OS package deduplication for images with embedded SBOMs ([#&#8203;10777](aquasecurity/trivy#10777)) ([888911b](aquasecurity/trivy@888911b))
- **image:** lookup origin layer for custom resources in merged layers ([#&#8203;10788](aquasecurity/trivy#10788)) ([dccb128](aquasecurity/trivy@dccb128))
- **misconf:** support github\_repository\_vulnerability\_alerts resource ([#&#8203;10680](aquasecurity/trivy#10680)) ([abb5174](aquasecurity/trivy@abb5174))
- **nodejs:** parse project dependencies from multi-document pnpm-lock.yaml ([#&#8203;10861](aquasecurity/trivy#10861)) ([a10291b](aquasecurity/trivy@a10291b))
- **server:** propagate package repository class in client/server mode ([#&#8203;10874](aquasecurity/trivy#10874)) ([a2777ae](aquasecurity/trivy@a2777ae))
- **spdx:** guard against nil root component in SPDX marshaler ([#&#8203;10771](aquasecurity/trivy#10771)) ([c0654e1](aquasecurity/trivy@c0654e1))
- surface the original analysis error instead of context cancellation ([#&#8203;10793](aquasecurity/trivy#10793)) ([3054b3b](aquasecurity/trivy@3054b3b))
- **terraform:** avoid data race on global getter.Getters in remote module resolver ([#&#8203;10843](aquasecurity/trivy#10843)) ([0aff3fd](aquasecurity/trivy@0aff3fd))
- use random suffix for process temp directory instead of PID ([#&#8203;10431](aquasecurity/trivy#10431)) ([c8d1d0d](aquasecurity/trivy@c8d1d0d))
- **vex:** load VEX documents from within the repository directory ([#&#8203;10820](aquasecurity/trivy#10820)) ([1f56a34](aquasecurity/trivy@1f56a34))
- **vuln:** fall back to UNKNOWN severity when vulnerability details are missing ([#&#8203;10795](aquasecurity/trivy#10795)) ([dfd53cf](aquasecurity/trivy@dfd53cf))

##### Continuous Integration

- migrate docker config to dockers\_v2 ([#&#8203;10783](aquasecurity/trivy#10783)) ([848d135](aquasecurity/trivy@848d135))

### [`v0.71.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.71.2)

[Compare Source](aquasecurity/trivy@v0.71.1...v0.71.2)

#### Changelog

- [`055a5c8`](aquasecurity/trivy@055a5c8) release: v0.71.2 \[release/v0.71] ([#&#8203;10871](aquasecurity/trivy#10871))
- [`875328a`](aquasecurity/trivy@875328a) fix(deps): bump alpine to 3.24.1 \[backport: release/v0.71] ([#&#8203;10870](aquasecurity/trivy#10870))
- [`998f7b3`](aquasecurity/trivy@998f7b3) chore(deps): bump the common group with 4 updates \[backport: release/v0.71] ([#&#8203;10867](aquasecurity/trivy#10867))

### [`v0.71.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.71.1)

[Compare Source](aquasecurity/trivy@v0.71.0...v0.71.1)

#### Changelog

- [`164b383`](aquasecurity/trivy@164b383) release: v0.71.1 \[release/v0.71] ([#&#8203;10818](aquasecurity/trivy#10818))
- [`a72d9a4`](aquasecurity/trivy@a72d9a4) fix(oci): validate artifact filename
- [`3dd9847`](aquasecurity/trivy@3dd9847) fix: forward ospkg detector options through ospkg.NewScanner \[backport: release/v0.71] ([#&#8203;10825](aquasecurity/trivy#10825))
- [`a62cbe4`](aquasecurity/trivy@a62cbe4) fix(vex): load VEX documents from within the repository directory \[backport: release/v0.71] ([#&#8203;10821](aquasecurity/trivy#10821))
- [`43d1d26`](aquasecurity/trivy@43d1d26) fix: surface the original analysis error instead of context cancellation \[backport: release/v0.71] ([#&#8203;10812](aquasecurity/trivy#10812))
- [`ac7696c`](aquasecurity/trivy@ac7696c) ci: expect GitHub App bot as backport PR author \[backport: release/v0.71] ([#&#8203;10815](aquasecurity/trivy#10815))

### [`v0.71.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0710-2026-06-01)

[Compare Source](aquasecurity/trivy@v0.70.0...v0.71.0)

##### Features

- add WithDriver and WithProvider options to ospkg detector ([#&#8203;10740](aquasecurity/trivy#10740)) ([f8a6ddb](aquasecurity/trivy@f8a6ddb))
- **java:** support \<mirrors> from settings.xml ([#&#8203;10692](aquasecurity/trivy#10692)) ([c080ce3](aquasecurity/trivy@c080ce3))
- **sbom:** support for CycloneDX 1.7 ([#&#8203;10715](aquasecurity/trivy#10715)) ([04f739e](aquasecurity/trivy@04f739e))
- **seal:** add vendor support for language file detection. ([#&#8203;10297](aquasecurity/trivy#10297)) ([b08bf6a](aquasecurity/trivy@b08bf6a))
- **secret:** add a way to customize skipped folders, files and exts ([#&#8203;10550](aquasecurity/trivy#10550)) ([e4325b1](aquasecurity/trivy@e4325b1))
- **secret:** add Azure secret detection rules ([#&#8203;10562](aquasecurity/trivy#10562)) ([69dcd18](aquasecurity/trivy@69dcd18))
- **secret:** add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files ([#&#8203;10704](aquasecurity/trivy#10704)) ([9ad901d](aquasecurity/trivy@9ad901d))
- **spdx:** add SHA-512 hash algorithm support to SPDX serializer ([#&#8203;10719](aquasecurity/trivy#10719)) ([f2a1237](aquasecurity/trivy@f2a1237))
- **ubuntu:** detect Ubuntu 26.04 LTS ([#&#8203;10592](aquasecurity/trivy#10592)) ([a61feac](aquasecurity/trivy@a61feac))

##### Bug Fixes

- **cloudformation:** propagate AWS::EC2::Instance MetadataOptions ([#&#8203;10731](aquasecurity/trivy#10731)) ([ac2f3d7](aquasecurity/trivy@ac2f3d7))
- **image:** correctly reconstruct RUN instructions built without BuildKit ([#&#8203;10714](aquasecurity/trivy#10714)) ([519eac9](aquasecurity/trivy@519eac9))
- **java:** surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files ([#&#8203;10693](aquasecurity/trivy#10693)) ([f8fdb93](aquasecurity/trivy@f8fdb93))
- **misconf:** fix rendering of nested values in terraform plan lists ([#&#8203;10746](aquasecurity/trivy#10746)) ([9c1cf65](aquasecurity/trivy@9c1cf65))
- **misconf:** make identifiers in ignore rules case-insensitive ([#&#8203;10375](aquasecurity/trivy#10375)) ([a75a468](aquasecurity/trivy@a75a468))
- **misconf:** prevent path traversal in Terraform filesystem functions ([#&#8203;10664](aquasecurity/trivy#10664)) ([9d91b88](aquasecurity/trivy@9d91b88))
- **misconf:** reject nil plays during playbook parsing ([#&#8203;10273](aquasecurity/trivy#10273)) ([0bc5c6d](aquasecurity/trivy@0bc5c6d))
- **misconf:** skip null cty values in AsMapValue to prevent panic ([#&#8203;10723](aquasecurity/trivy#10723)) ([f080e1e](aquasecurity/trivy@f080e1e))
- **misconf:** skip resources with no after changes ([#&#8203;10352](aquasecurity/trivy#10352)) ([f099dc4](aquasecurity/trivy@f099dc4))
- **nodejs:** handle legacy license formats in npm lockfile parser ([#&#8203;10684](aquasecurity/trivy#10684)) ([451fd99](aquasecurity/trivy@451fd99))
- **nodejs:** silently skip subdirectory package.json files with invalid names ([#&#8203;10609](aquasecurity/trivy#10609)) ([0e4dc66](aquasecurity/trivy@0e4dc66))
- overwrite OS packages PURLs after overwrite OS ([#&#8203;10298](aquasecurity/trivy#10298)) ([39a28ed](aquasecurity/trivy@39a28ed))
- pull instead of clone when test repo already exists ([#&#8203;10636](aquasecurity/trivy#10636)) ([3a2f7fb](aquasecurity/trivy@3a2f7fb))
- **report:** don't produce trailing comma in gitlab.tpl links array ([#&#8203;10728](aquasecurity/trivy#10728)) ([69e78e2](aquasecurity/trivy@69e78e2))
- **secret:** correctly skip secret-scanner config file from scanning ([#&#8203;10666](aquasecurity/trivy#10666)) ([fc1e46f](aquasecurity/trivy@fc1e46f))

### [`v0.70.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0700-2026-04-16)

[Compare Source](aquasecurity/trivy@v0.69.3...v0.70.0)

##### Features

- **go:** detect version from ELF symbol table for binaries built with -trimpath ([#&#8203;10197](aquasecurity/trivy#10197)) ([7acb5f6](aquasecurity/trivy@7acb5f6))
- **java:** add support for proxy configuration from Maven settings.xml ([#&#8203;10187](aquasecurity/trivy#10187)) ([350fe33](aquasecurity/trivy@350fe33))
- **misconf:** adapt ARM k8s clusters ([#&#8203;9696](aquasecurity/trivy#9696)) ([#&#8203;10125](aquasecurity/trivy#10125)) ([66bdec4](aquasecurity/trivy@66bdec4))
- **misconf:** resolve Azure resources via resource\_id ([#&#8203;10173](aquasecurity/trivy#10173)) ([823f363](aquasecurity/trivy@823f363))
- **misconf:** support for azurerm\_network\_interface\_security\_group\_association  ([#&#8203;10215](aquasecurity/trivy#10215)) ([da94d5f](aquasecurity/trivy@da94d5f))
- **python:** add pylock.toml (PEP 751) parser ([#&#8203;9632](aquasecurity/trivy#9632)) ([1a72b32](aquasecurity/trivy@1a72b32))
- **python:** add pylock.toml support ([#&#8203;10137](aquasecurity/trivy#10137)) ([d0a3f63](aquasecurity/trivy@d0a3f63))
- **server:** include server version info in JSON output for client/server mode ([#&#8203;10075](aquasecurity/trivy#10075)) ([4c46d41](aquasecurity/trivy@4c46d41))
- **ubuntu:** add eol data for 25.10 ([#&#8203;10181](aquasecurity/trivy#10181)) ([2c1f65b](aquasecurity/trivy@2c1f65b))
- **vuln:** skip third-party packages in common Detect function ([#&#8203;10129](aquasecurity/trivy#10129)) ([d6e6331](aquasecurity/trivy@d6e6331))

##### Bug Fixes

- **cyclonedx:** include CVSS v4 vulnerability ratings ([#&#8203;10313](aquasecurity/trivy#10313)) ([2a4dfbf](aquasecurity/trivy@2a4dfbf))
- detected vulnerability fields in azure and mariner detector ([#&#8203;10275](aquasecurity/trivy#10275)) ([77f5cb5](aquasecurity/trivy@77f5cb5))
- **flag:** validate template file extension ([#&#8203;10296](aquasecurity/trivy#10296)) ([20458b8](aquasecurity/trivy@20458b8))
- handle Go 1.26 GOEXPERIMENT version format change ([#&#8203;10351](aquasecurity/trivy#10351)) ([f207ec6](aquasecurity/trivy@f207ec6))
- **java:** Disable overwriting exclusions ([#&#8203;10088](aquasecurity/trivy#10088)) ([9a3e0a8](aquasecurity/trivy@9a3e0a8))
- **misconf:** apply check aliases when filtering results via .trivyignore ([#&#8203;10112](aquasecurity/trivy#10112)) ([b775a1b](aquasecurity/trivy@b775a1b))
- **misconf:** initialize custom annotation field if empty ([#&#8203;10123](aquasecurity/trivy#10123)) ([0f0d6db](aquasecurity/trivy@0f0d6db))
- **python:** handle multiple version specifiers in requirements.txt ([#&#8203;10361](aquasecurity/trivy#10361)) ([4cf4498](aquasecurity/trivy@4cf4498))
- **python:** nil pointer dereference with optional poetry groups without dependencies ([#&#8203;10359](aquasecurity/trivy#10359)) ([12ab3ce](aquasecurity/trivy@12ab3ce))
- remove os.Stdout from wazero module config ([#&#8203;10403](aquasecurity/trivy#10403)) ([bda9710](aquasecurity/trivy@bda9710))
- **report:** set correct sarif ROOTPATH uri when scanning a git repository ([#&#8203;10366](aquasecurity/trivy#10366)) ([e5da6de](aquasecurity/trivy@e5da6de))
- **sbom:** add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages ([#&#8203;10368](aquasecurity/trivy#10368)) ([33b9d8e](aquasecurity/trivy@33b9d8e))
- **sbom:** preserve Red Hat BuildInfo when scanning SBOMs without layer info ([#&#8203;10378](aquasecurity/trivy#10378)) ([e9e9e8c](aquasecurity/trivy@e9e9e8c))
- **server:** exclude JavaDB and CheckBundle from /version endpoint ([#&#8203;10100](aquasecurity/trivy#10100)) ([b9a8d2d](aquasecurity/trivy@b9a8d2d))
- update PhotonOS feed URL ([#&#8203;10122](aquasecurity/trivy#10122)) ([fa195b4](aquasecurity/trivy@fa195b4))
- use Development category for GoReleaser discussions ([#&#8203;10530](aquasecurity/trivy#10530)) ([7ee3e1e](aquasecurity/trivy@7ee3e1e))

##### Performance Improvements

- **plugin:** optimize directory traversal by replacing filepath.Walk with filepath.WalkDir ([#&#8203;10325](aquasecurity/trivy#10325)) ([d7fb355](aquasecurity/trivy@d7fb355))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://forgejo.r0fl.cc/hjmcnew/esphome-configs/pulls/13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants