feat(scanner/depWalker): configure locker.concurrency with new maxConcurrency options

.changeset/orange-teeth-appear.md

@@ -0,0 +1,5 @@
+---
+"@nodesecure/scanner": minor
+---
+
+Implement a new maxConcurrency options to configure how much NPM tarballs we scan/limit in depWalker

README.md

@@ -99,7 +99,13 @@ interface Options {
    *
    * @default Infinity
    */
-  maxDepth?: number;
+  readonly maxDepth?: number;
+
+  /**
+   * Maximum concurrency to fetch and scan NPM tarballs
+   * @default 8
+   */
+  readonly maxConcurrency?: number;
 
   /**
    * Includes development dependencies in the walk.

workspaces/scanner/src/depWalker.ts

@@ -121,7 +121,8 @@ export async function depWalker(
     location,
     vulnerabilityStrategy = Vulnera.strategies.NONE,
     registry,
-    npmRcConfig
+    npmRcConfig,
+    maxConcurrency = 8
   } = options;
 
   const statsCollector = new StatsCollector({ logger }, { isVerbose });
@@ -205,7 +206,7 @@ export async function depWalker(
     const fetchedMetadataPackages = new Set<string>();
     const operationsQueue: Promise<void>[] = [];
 
-    const locker = new Mutex({ concurrency: 5 });
+    const locker = new Mutex({ concurrency: maxConcurrency });
     locker.on(
       MutexRelease,
       () => logger.tick(ScannerLoggerEvents.analysis.tarball)

workspaces/scanner/src/types.ts

@@ -282,6 +282,12 @@ export interface Options {
    */
   readonly maxDepth?: number;
 
+  /**
+   * Maximum concurrency to fetch and scan NPM tarballs
+   * @default 8
+   */
+  readonly maxConcurrency?: number;
+
   readonly registry?: string | URL;
 
   /**