perf(advisory): share AnySecurityAdvisory via Rc

PHP's SecurityAdvisoryPoolFilter stores advisory *object references* in
$securityRemovedVersions, and PoolOptimizer::applyRemovalsToPool hands
that array to the new Pool by copy-on-write. Porting AnySecurityAdvisory
as a value type turned both of those into deep copies.

Measured on `require laravel/framework` (offline, warm cache): 113
distinct advisories were duplicated into 314,309 copies of ~1.08 KiB,
retaining 331.9 MiB in the filter loop and another 331.9 MiB when
apply_removals_to_pool cloned the whole map.

3.54s -> 2.62s (-26%), peak RSS 975 MB -> 343 MB, which matches the upper
bound measured by ablation. Composer runs the same workload in 1.49s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

4 files changed, 21 insertions, 18 deletions

diff --git a/crates/shirabe/src/repository/advisory_provider_interface.rs b/crates/shirabe/src/repository/advisory_provider_interface.rs
index f1e639a1..466093c1 100644
--- a/crates/shirabe/src/repository/advisory_provider_interface.rs
+++ b/crates/shirabe/src/repository/advisory_provider_interface.rs
@@ -7,7 +7,7 @@ use shirabe_semver::constraint::AnyConstraint;
 #[derive(Debug)]
 pub struct SecurityAdvisoryResult {
     pub names_found: Vec<String>,
-    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
 }
 
 pub trait AdvisoryProviderInterface {
diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 876ba3b8..558d7e00 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -920,7 +920,7 @@ impl ComposerRepository {
             });
         }
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories = IndexMap::new();
         let mut names_found: IndexMap<String, bool> = IndexMap::new();
 
         let api_url = self
@@ -943,7 +943,7 @@ impl ComposerRepository {
         let create = |data: &IndexMap<String, PhpMixed>,
                       name: &str,
                       package_constraint_map: &IndexMap<String, AnyConstraint>|
-         -> anyhow::Result<Option<AnySecurityAdvisory>> {
+         -> anyhow::Result<Option<std::rc::Rc<AnySecurityAdvisory>>> {
             let advisory = PartialSecurityAdvisory::create(name, data, &parser)?;
             let is_full = matches!(advisory, AnySecurityAdvisory::Full(_));
             if !allow_partial_advisories && !is_full {
@@ -971,7 +971,7 @@ impl ComposerRepository {
                 return Ok(None);
             }
 
-            Ok(Some(advisory))
+            Ok(Some(std::rc::Rc::new(advisory)))
         };
 
         if self
@@ -1030,7 +1030,7 @@ impl ComposerRepository {
 
                 names_found.insert(name.clone(), true);
                 if !sec_advs_arr.is_empty() {
-                    let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
+                    let mut entries: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
                     for data_mixed in sec_advs_arr.into_iter() {
                         if let PhpMixed::Array(data_map) = data_mixed
                             && let Some(adv) = create(&data_map, &name, &package_constraint_map)?
@@ -1112,7 +1112,7 @@ impl ComposerRepository {
                     None => continue,
                 };
                 if !list.is_empty() {
-                    let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
+                    let mut entries: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
                     for data_mixed in list.iter() {
                         if let Some(data) = data_mixed.as_array() {
                             let data_map: IndexMap<String, PhpMixed> =
@@ -1128,10 +1128,11 @@ impl ComposerRepository {
             }
         }
 
-        let advisories_filtered: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
-            .into_iter()
-            .filter(|(_, adv)| !adv.is_empty())
-            .collect();
+        let advisories_filtered: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> =
+            advisories
+                .into_iter()
+                .filter(|(_, adv)| !adv.is_empty())
+                .collect();
 
         Ok(SecurityAdvisoryResult {
             names_found: names_found.keys().cloned().collect(),
diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs
index 7f61bc9e..3397f071 100644
--- a/crates/shirabe/src/repository/package_repository.rs
+++ b/crates/shirabe/src/repository/package_repository.rs
@@ -211,7 +211,7 @@ impl AdvisoryProviderInterface for PackageRepository {
     ) -> anyhow::Result<SecurityAdvisoryResult> {
         let parser = VersionParser::new();
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories = IndexMap::new();
         for (package_name, package_advisories) in &self.security_advisories {
             let Some(package_constraint) = package_constraint_map.get(package_name) else {
                 continue;
@@ -221,7 +221,7 @@ impl AdvisoryProviderInterface for PackageRepository {
                 PhpMixed::List(list) => list,
                 _ => continue,
             };
-            let mut items: Vec<AnySecurityAdvisory> = Vec::new();
+            let mut items: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
             for data in list {
                 let data_map: IndexMap<String, PhpMixed> = match data {
                     PhpMixed::Array(m) => m.clone(),
@@ -249,13 +249,13 @@ impl AdvisoryProviderInterface for PackageRepository {
                     continue;
                 }
 
-                items.push(advisory);
+                items.push(std::rc::Rc::new(advisory));
             }
             advisories.insert(package_name.clone(), items);
         }
 
         let names_found: Vec<String> = advisories.keys().cloned().collect();
-        let advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
+        let advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> = advisories
             .into_iter()
             .filter(|(_, adv)| !adv.is_empty())
             .collect();
diff --git a/crates/shirabe/src/repository/repository_set.rs b/crates/shirabe/src/repository/repository_set.rs
index c407a1ce..8443400f 100644
--- a/crates/shirabe/src/repository/repository_set.rs
+++ b/crates/shirabe/src/repository/repository_set.rs
@@ -363,8 +363,9 @@ impl RepositorySet {
         allow_partial_advisories: bool,
         ignore_unreachable: bool,
         unreachable_repos: &mut Vec<String>,
-    ) -> anyhow::Result<IndexMap<String, Vec<AnySecurityAdvisory>>> {
-        let mut repo_advisories: Vec<IndexMap<String, Vec<AnySecurityAdvisory>>> = vec![];
+    ) -> anyhow::Result<IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> {
+        let mut repo_advisories: Vec<IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> =
+            vec![];
         for repository in &self.repositories {
             let attempt: anyhow::Result<()> = (|| -> anyhow::Result<()> {
                 let mut repo_ref = repository.borrow_mut();
@@ -403,7 +404,8 @@ impl RepositorySet {
             }
         }
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> =
+            IndexMap::new();
         for repo in repo_advisories {
             for (name, list) in repo {
                 advisories.entry(name).or_default().extend(list);
@@ -672,6 +674,6 @@ impl RepositorySetInterface for RepositorySet {
 
 #[derive(Debug)]
 pub struct SecurityAdvisoriesResult {
-    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     pub unreachable_repos: Vec<String>,
 }