Gradle — CWE-407 Analysis
==========================

.. contents:: :local:

Overview
--------

Gradle is a build automation tool used widely in Java, Kotlin, and Android projects. Its
execution plan and dependency resolution infrastructure uses ``HashSet`` and ``HashMultimap``
throughout.

Status: CLEAN
-------------

Gradle is confirmed to use correct O(1) data structures for graph traversal. No CWE-407 defect
sites were found.

Key implementations:

- ``ExecutionPlan``: ``HashSet<Node>`` for visited node tracking
- ``DefaultConfiguration``: ``HashMultimap`` for dependency edges
- Dependency resolution: ``LinkedHashMap`` / ``LinkedHashSet`` for ordered set operations

Gradle serves as a reference implementation of correct practice in the Java build-tool
ecosystem. Its correctness stands in contrast to Maven, which uses ``ArrayList`` with linear
scan in its project graph.

References
----------

* Scanner output: ``tools/scan-cwe407.sh`` on ``/home/fox/git/gradle`` — no defect sites
