release concurrent request semaphore before handling results

Otherwise, the orchestrating goroutine may get stuck while trying to hydrate
more vulns. When this happens, it cannot proceed to read from errChan,
resulting in deadlock.

Signed-off-by: Spencer Schrock <[email protected]>

pkg/osv/osv.go

@@ -288,13 +288,12 @@ func HydrateWithClient(resp *BatchedResponse, client *http.Client) (*HydratedBat
 
 			go func(id string, batchIdx int, resultIdx int) {
 				vuln, err := GetWithClient(id, client)
+				rateLimiter.Release(1)
 				if err != nil {
 					errChan <- err
 				} else {
 					hydrated.Results[batchIdx].Vulns[resultIdx] = *vuln
 				}
-
-				rateLimiter.Release(1)
 			}(vuln.ID, batchIdx, resultIdx)
 		}
 	}