Perf/bundle parallelization

[apzuk3]

Description

Provide description of this PR and changes, if linked Jira ticket doesn't cover it in full.

Checklist

• Tests added and all succeed
• Linted
• README.md updated, if user-facing

🚨After having merged, please update the snyk-ls and CLI go.mod to pull in latest client.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 Security concerns Yes. The use of a personal fork (z4ce/go-application-framework) in go.mod as a replacement for a core Snyk framework is a high-risk security concern. It allows unverified code to be executed during the file scanning process, potentially leading to exfiltration or supply chain compromise if the fork is malicious or later compromised.

⚡ Recommended focus areas for review Systemic Risk 🔴 [critical] The replace directive points to a personal fork (github.com/z4ce/go-application-framework) rather than an official Snyk repository. This introduces a significant security and maintenance risk, as this fork is not subject to the same access controls and audit requirements as the main Snyk organization. This dependency is also used for the critical file filtering logic in native_workflow.go. replace github.com/snyk/go-application-framework => github.com/z4ce/go-application-framework v0.0.0-20260716054810-5ac64afcd596 Race Condition 🟠 [major] In the create method, the loop iterates createWorkerCount() times to spawn workers, but the setErr function (which calls cancel()) is invoked from goroutines. If an error occurs in one worker, it cancels the processCtx, but the main create function continues to spawn remaining workers in the loop if they haven't started yet. While not a crash, it wastes resources spawning workers that will immediately exit due to processCtx.Err() != nil. return } Lost Error Context 🟡 [minor] The refactored BundleFileFrom now swallows the error from util.ConvertToUTF8(content). It falls back to the original content but no longer returns the err to the caller, whereas the previous implementation explicitly returned the conversion error in the fileErr variable. This masks encoding issues from upstream logging or error reporting. utf8Content, err := util.ConvertToUTF8(content) if err != nil { utf8Content = content }

📚 Repository Context Analyzed This review considered 22 relevant code sections from 13 files (average relevance: 0.96) scan.go (2 segments, lines 1-244) bundle/mocks/bundle.go (lines 1-134) bundle/mocks/bundle_manager.go (lines 1-83) README.md (lines 1-152) CONTRIBUTING.md (lines 1-204) internal/deepcode/client.go (lines 1-269) internal/deepcode/pacts/code-client-go-snykcodeapi.json (lines 5-286) ... and 6 more file(s)

🤖 Repository instructions applied (from AGENTS.md)