Crash when scanning large repository

[scott-boost]

Steps

1. run the follow steps

cd /tmp
git clone https://github.com/openvinotoolkit/openvino.git
osv-scanner scan source --recursive --call-analysis=all --format json openvino

expected

• results are printed as JSON

actual

Killed with exit code 137

...
Scanned /openvino/tests/llm/requirements.txt file and found 95 packages
failed to parse metadata for file google-pasta-0.2.0.tar.gz: sdist: dependencies in setup.py, not in PKG-INFO
Scanned /openvino/tests/model_hub_tests/performance_tests/requirements.txt file and found 49 packages
failed to parse metadata for file google-pasta-0.2.0.tar.gz: sdist: dependencies in setup.py, not in PKG-INFO
Killed
~ # echo $?
137

version

ghcr.io/google/osv-scanner:latest (pulled on November 18 2025)

/osv-scanner --version
osv-scanner version: 2.2.4
osv-scalibr version: 0.3.6
commit: 8b6727b2c439cdea8bc3a033bf7c76d76cbaee08
built at: 2025-10-29T05:12:57

notes

• this crash does not occur on 2.0.1

[another-rex]

I'm guessing this is caused by python transitive dependency resolution we recently added. Can you try with --no-resolve flag to see if it successfully scans just to confirm?

[cuixq]

I tried locally with no-resolve and the scan finished without any error. This is probably due to the PyPI client caches all responses in memory. For these responses, we only need requirements for dependency resolution, so most of them are not necessarily needed. I will try to refactor the client to see if we can just cache the things we need. Longer term, using deps.dev API for requirements will be helpful.