perf(advisory): share AnySecurityAdvisory via Rc

PHP's SecurityAdvisoryPoolFilter stores advisory *object references* in
$securityRemovedVersions, and PoolOptimizer::applyRemovalsToPool hands
that array to the new Pool by copy-on-write. Porting AnySecurityAdvisory
as a value type turned both of those into deep copies.

Measured on `require laravel/framework` (offline, warm cache): 113
distinct advisories were duplicated into 314,309 copies of ~1.08 KiB,
retaining 331.9 MiB in the filter loop and another 331.9 MiB when
apply_removals_to_pool cloned the whole map.

3.54s -> 2.62s (-26%), peak RSS 975 MB -> 343 MB, which matches the upper
bound measured by ablation. Composer runs the same workload in 1.49s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

7 files changed, 58 insertions, 48 deletions

diff --git a/crates/shirabe/src/advisory/auditor.rs b/crates/shirabe/src/advisory/auditor.rs
index ff93268a..41cef838 100644
--- a/crates/shirabe/src/advisory/auditor.rs
+++ b/crates/shirabe/src/advisory/auditor.rs
@@ -23,9 +23,9 @@ use shirabe_php_shim::{
 #[derive(serde::Serialize)]
 struct AuditJsonReport<'a> {
     #[serde(serialize_with = "serialize_advisories_field")]
-    advisories: &'a IndexMap<String, Vec<AnySecurityAdvisory>>,
+    advisories: &'a IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     #[serde(rename = "ignored-advisories", skip_serializing_if = "Option::is_none")]
-    ignored_advisories: Option<&'a IndexMap<String, Vec<AnySecurityAdvisory>>>,
+    ignored_advisories: Option<&'a IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>>,
     #[serde(
         rename = "unreachable-repositories",
         skip_serializing_if = "Option::is_none"
@@ -55,7 +55,7 @@ where
 }
 
 fn serialize_advisories_field<S>(
-    map: &&IndexMap<String, Vec<AnySecurityAdvisory>>,
+    map: &&IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     serializer: S,
 ) -> anyhow::Result<S::Ok, S::Error>
 where
@@ -197,7 +197,7 @@ impl Auditor {
         let error_or_warn = if warning_only { "warning" } else { "error" };
         if affected_packages_count > 0 || !ignored_advisories.is_empty() {
             let passes: Vec<(
-                &IndexMap<String, Vec<AnySecurityAdvisory>>,
+                &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
                 String,
             )> = vec![
                 (
@@ -263,7 +263,7 @@ impl Auditor {
     /// @return bool
     pub fn needs_complete_advisory_load(
         &self,
-        advisories: &IndexMap<String, Vec<AnySecurityAdvisory>>,
+        advisories: &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
         ignore_list: &IndexMap<String, Option<String>>,
     ) -> bool {
         if advisories.is_empty() {
@@ -271,15 +271,15 @@ impl Auditor {
         }
 
         // no partial advisories present
-        let advisories_values: Vec<&Vec<AnySecurityAdvisory>> = advisories.values().collect();
-        if array_all(
-            &advisories_values,
-            |pkg_advisories: &&Vec<AnySecurityAdvisory>| {
-                array_all(pkg_advisories, |advisory: &AnySecurityAdvisory| {
+        let advisories_values: Vec<_> = advisories.values().collect();
+        if array_all(&advisories_values, |pkg_advisories| {
+            array_all(
+                pkg_advisories,
+                |advisory: &std::rc::Rc<AnySecurityAdvisory>| {
                     advisory.as_security_advisory().is_some()
-                })
-            },
-        ) {
+                },
+            )
+        }) {
             return false;
         }
 
@@ -321,7 +321,7 @@ impl Auditor {
 
     pub fn process_advisories(
         &self,
-        all_advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+        all_advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
         ignore_list: &IndexMap<String, Option<String>>,
         ignored_severities: &IndexMap<String, Option<String>>,
     ) -> ProcessAdvisoriesResult {
@@ -332,8 +332,9 @@ impl Auditor {
             };
         }
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
-        let mut ignored: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> =
+            IndexMap::new();
+        let mut ignored: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> = IndexMap::new();
         let mut ignore_reason: Option<String> = None;
 
         for (package, pkg_advisories) in all_advisories {
@@ -394,7 +395,9 @@ impl Auditor {
                 // and in that case we do not need to cast the object.
                 let advisory = if advisory.as_security_advisory().is_some() {
                     let full = advisory.as_security_advisory().unwrap();
-                    AnySecurityAdvisory::Ignored(full.to_ignored_advisory(ignore_reason.clone()))
+                    std::rc::Rc::new(AnySecurityAdvisory::Ignored(
+                        full.to_ignored_advisory(ignore_reason.clone()),
+                    ))
                 } else {
                     advisory
                 };
@@ -412,7 +415,7 @@ impl Auditor {
     /// @return array{int, int} Count of affected packages and total count of advisories
     fn count_advisories(
         &self,
-        advisories: &IndexMap<String, Vec<AnySecurityAdvisory>>,
+        advisories: &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     ) -> (i64, i64) {
         let mut count: i64 = 0;
         for package_advisories in advisories.values() {
@@ -427,7 +430,7 @@ impl Auditor {
     fn output_advisories(
         &self,
         io: &std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
-        advisories: &IndexMap<String, Vec<AnySecurityAdvisory>>,
+        advisories: &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
         format: &str,
     ) -> anyhow::Result<()> {
         match format {
@@ -473,7 +476,7 @@ impl Auditor {
     fn output_advisories_table(
         &self,
         io: &ConsoleIO,
-        advisories: &IndexMap<String, Vec<AnySecurityAdvisory>>,
+        advisories: &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     ) -> anyhow::Result<()> {
         for package_advisories in advisories.values() {
             for advisory in package_advisories {
@@ -534,7 +537,7 @@ impl Auditor {
     fn output_advisories_plain(
         &self,
         io: &std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
-        advisories: &IndexMap<String, Vec<AnySecurityAdvisory>>,
+        advisories: &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     ) -> anyhow::Result<()> {
         let mut error: Vec<String> = vec![];
         let mut first_advisory = true;
@@ -745,6 +748,6 @@ impl Auditor {
 
 #[derive(Debug)]
 pub struct ProcessAdvisoriesResult {
-    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
-    pub ignored_advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
+    pub ignored_advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
 }
diff --git a/crates/shirabe/src/dependency_resolver/pool.rs b/crates/shirabe/src/dependency_resolver/pool.rs
index adf42f54..a9dffe71 100644
--- a/crates/shirabe/src/dependency_resolver/pool.rs
+++ b/crates/shirabe/src/dependency_resolver/pool.rs
@@ -28,7 +28,8 @@ pub struct Pool {
     /// @var array<string, array<string, string>> Map of package object hash => removed normalized versions => removed pretty version
     pub(crate) removed_versions_by_package: IndexMap<String, IndexMap<String, String>>,
     /// @var array<string, array<string, array<SecurityAdvisory|PartialSecurityAdvisory>>> Map of package name => normalized version => security advisories
-    security_removed_versions: IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>>,
+    security_removed_versions:
+        IndexMap<String, IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>>,
     /// @var array<string, array<string, string>> Map of package name => normalized version => pretty version
     abandoned_removed_versions: IndexMap<String, IndexMap<String, String>>,
 }
@@ -45,7 +46,10 @@ impl Pool {
         unacceptable_fixed_or_locked_packages: Vec<BasePackageHandle>,
         removed_versions: IndexMap<String, IndexMap<String, String>>,
         removed_versions_by_package: IndexMap<String, IndexMap<String, String>>,
-        security_removed_versions: IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>>,
+        security_removed_versions: IndexMap<
+            String,
+            IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
+        >,
         abandoned_removed_versions: IndexMap<String, IndexMap<String, String>>,
     ) -> Self {
         let mut this = Self {
@@ -182,7 +186,7 @@ impl Pool {
     /// @return array<string, array<string, array<SecurityAdvisory|PartialSecurityAdvisory>>>
     pub fn get_all_security_removed_package_versions(
         &self,
-    ) -> &IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>> {
+    ) -> &IndexMap<String, IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> {
         &self.security_removed_versions
     }
 
diff --git a/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs b/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
index 59acad89..c2b95bd7 100644
--- a/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
+++ b/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
@@ -87,7 +87,7 @@ impl SecurityAdvisoryPoolFilter {
         let mut packages: Vec<BasePackageHandle> = vec![];
         let mut security_removed_versions: IndexMap<
             String,
-            IndexMap<String, Vec<AnySecurityAdvisory>>,
+            IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
         > = IndexMap::new();
         let mut abandoned_removed_versions: IndexMap<String, IndexMap<String, String>> =
             IndexMap::new();
@@ -144,13 +144,13 @@ impl SecurityAdvisoryPoolFilter {
     fn get_matching_advisories(
         &self,
         package: BasePackageHandle,
-        advisory_map: &IndexMap<String, Vec<AnySecurityAdvisory>>,
-    ) -> Vec<AnySecurityAdvisory> {
+        advisory_map: &IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
+    ) -> Vec<std::rc::Rc<AnySecurityAdvisory>> {
         if package.is_dev() {
             return vec![];
         }
 
-        let mut matching_advisories: Vec<AnySecurityAdvisory> = vec![];
+        let mut matching_advisories = vec![];
         for package_name in package.get_names(false) {
             if !advisory_map.contains_key(&package_name) {
                 continue;
diff --git a/crates/shirabe/src/repository/advisory_provider_interface.rs b/crates/shirabe/src/repository/advisory_provider_interface.rs
index f1e639a1..466093c1 100644
--- a/crates/shirabe/src/repository/advisory_provider_interface.rs
+++ b/crates/shirabe/src/repository/advisory_provider_interface.rs
@@ -7,7 +7,7 @@ use shirabe_semver::constraint::AnyConstraint;
 #[derive(Debug)]
 pub struct SecurityAdvisoryResult {
     pub names_found: Vec<String>,
-    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
 }
 
 pub trait AdvisoryProviderInterface {
diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 876ba3b8..558d7e00 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -920,7 +920,7 @@ impl ComposerRepository {
             });
         }
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories = IndexMap::new();
         let mut names_found: IndexMap<String, bool> = IndexMap::new();
 
         let api_url = self
@@ -943,7 +943,7 @@ impl ComposerRepository {
         let create = |data: &IndexMap<String, PhpMixed>,
                       name: &str,
                       package_constraint_map: &IndexMap<String, AnyConstraint>|
-         -> anyhow::Result<Option<AnySecurityAdvisory>> {
+         -> anyhow::Result<Option<std::rc::Rc<AnySecurityAdvisory>>> {
             let advisory = PartialSecurityAdvisory::create(name, data, &parser)?;
             let is_full = matches!(advisory, AnySecurityAdvisory::Full(_));
             if !allow_partial_advisories && !is_full {
@@ -971,7 +971,7 @@ impl ComposerRepository {
                 return Ok(None);
             }
 
-            Ok(Some(advisory))
+            Ok(Some(std::rc::Rc::new(advisory)))
         };
 
         if self
@@ -1030,7 +1030,7 @@ impl ComposerRepository {
 
                 names_found.insert(name.clone(), true);
                 if !sec_advs_arr.is_empty() {
-                    let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
+                    let mut entries: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
                     for data_mixed in sec_advs_arr.into_iter() {
                         if let PhpMixed::Array(data_map) = data_mixed
                             && let Some(adv) = create(&data_map, &name, &package_constraint_map)?
@@ -1112,7 +1112,7 @@ impl ComposerRepository {
                     None => continue,
                 };
                 if !list.is_empty() {
-                    let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
+                    let mut entries: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
                     for data_mixed in list.iter() {
                         if let Some(data) = data_mixed.as_array() {
                             let data_map: IndexMap<String, PhpMixed> =
@@ -1128,10 +1128,11 @@ impl ComposerRepository {
             }
         }
 
-        let advisories_filtered: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
-            .into_iter()
-            .filter(|(_, adv)| !adv.is_empty())
-            .collect();
+        let advisories_filtered: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> =
+            advisories
+                .into_iter()
+                .filter(|(_, adv)| !adv.is_empty())
+                .collect();
 
         Ok(SecurityAdvisoryResult {
             names_found: names_found.keys().cloned().collect(),
diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs
index 7f61bc9e..3397f071 100644
--- a/crates/shirabe/src/repository/package_repository.rs
+++ b/crates/shirabe/src/repository/package_repository.rs
@@ -211,7 +211,7 @@ impl AdvisoryProviderInterface for PackageRepository {
     ) -> anyhow::Result<SecurityAdvisoryResult> {
         let parser = VersionParser::new();
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories = IndexMap::new();
         for (package_name, package_advisories) in &self.security_advisories {
             let Some(package_constraint) = package_constraint_map.get(package_name) else {
                 continue;
@@ -221,7 +221,7 @@ impl AdvisoryProviderInterface for PackageRepository {
                 PhpMixed::List(list) => list,
                 _ => continue,
             };
-            let mut items: Vec<AnySecurityAdvisory> = Vec::new();
+            let mut items: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
             for data in list {
                 let data_map: IndexMap<String, PhpMixed> = match data {
                     PhpMixed::Array(m) => m.clone(),
@@ -249,13 +249,13 @@ impl AdvisoryProviderInterface for PackageRepository {
                     continue;
                 }
 
-                items.push(advisory);
+                items.push(std::rc::Rc::new(advisory));
             }
             advisories.insert(package_name.clone(), items);
         }
 
         let names_found: Vec<String> = advisories.keys().cloned().collect();
-        let advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
+        let advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> = advisories
             .into_iter()
             .filter(|(_, adv)| !adv.is_empty())
             .collect();
diff --git a/crates/shirabe/src/repository/repository_set.rs b/crates/shirabe/src/repository/repository_set.rs
index c407a1ce..8443400f 100644
--- a/crates/shirabe/src/repository/repository_set.rs
+++ b/crates/shirabe/src/repository/repository_set.rs
@@ -363,8 +363,9 @@ impl RepositorySet {
         allow_partial_advisories: bool,
         ignore_unreachable: bool,
         unreachable_repos: &mut Vec<String>,
-    ) -> anyhow::Result<IndexMap<String, Vec<AnySecurityAdvisory>>> {
-        let mut repo_advisories: Vec<IndexMap<String, Vec<AnySecurityAdvisory>>> = vec![];
+    ) -> anyhow::Result<IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> {
+        let mut repo_advisories: Vec<IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> =
+            vec![];
         for repository in &self.repositories {
             let attempt: anyhow::Result<()> = (|| -> anyhow::Result<()> {
                 let mut repo_ref = repository.borrow_mut();
@@ -403,7 +404,8 @@ impl RepositorySet {
             }
         }
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> =
+            IndexMap::new();
         for repo in repo_advisories {
             for (name, list) in repo {
                 advisories.entry(name).or_default().extend(list);
@@ -672,6 +674,6 @@ impl RepositorySetInterface for RepositorySet {
 
 #[derive(Debug)]
 pub struct SecurityAdvisoriesResult {
-    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     pub unreachable_repos: Vec<String>,
 }