sbt — CWE-407 Analysis
=======================

**Status: CLEAN — 0 confirmed defects**

sbt (Scala Build Tool) was scanned across its main task engine, dependency resolver,
and transitive build URI collector. 50+ candidates were returned; all are false
positives on Scala ``Set[T]`` (immutable hash set) containers.

Key findings:

- ``Resolvers.scala:260`` — ``visited.contains(ref)`` inside
  ``collectTransitiveRemoteBuildURIs`` BFS loop.
  ``visited`` is declared ``Set[ProjectRef]`` — Scala immutable ``HashSet``, O(1). FALSE POSITIVE.

- ``TreeView.scala:49`` — ``parents.contains(module.id)`` inside
  ``processSubtree`` recursive dependency tree renderer.
  ``parents: Set[GraphModuleId]`` — Scala ``Set``, O(1). FALSE POSITIVE.

- ``Execute.scala:336-363`` — Multiple ``.contains()`` calls inside ``addedInv`` /
  ``dependencyCheck``. These are all inside ``assert(...)`` contract-checking
  methods that only execute in debug mode (``checkPreAndPostConditions = true``).
  Even if the collections were O(n), these are not production hot paths.

- ``Execute.scala:397`` — ``all.contains(target)`` in ``cycleCheck``.
  ``all`` is ``IDSet.create[TaskId]`` — sbt's custom identity hash set. O(1). FALSE POSITIVE.

sbt's task engine and dependency graph machinery use Scala's ``Set[T]`` idiomatically
throughout. The functional Scala style naturally produces correct O(1) visited sets.

* Scanner: ``tools/scans/sbt.sh``
* Scan result: ``tools/scan-results/sbt.txt`` — 50+ candidates, all false positives
