Bundler — CWE-407 Analysis
===========================

**Status: CLEAN — 0 candidates**

Bundler (Ruby gem manager) and its Molinillo solver were scanned. Zero candidates
returned from either codebase.

Bundler uses Molinillo for dependency resolution (a generic constraint solver also
used by CocoaPods). Molinillo uses Ruby's ``Set`` class (backed by ``Hash``) for all
visited-state tracking in its DFS-based conflict resolution. Ruby's ``Set#include?``
is O(1) via hash lookup.

The ``bundler/lib/bundler/`` dependency graph traversal uses ``Hash``-keyed structures
throughout. No array-backed visited sets were found.

Note: Ruby's ``tsort.rb`` (which Bundler uses indirectly for Gemfile.lock ordering)
is already confirmed clean — it uses ``Hash#include?`` for cycle detection (O(1)).

* Scanner: ``tools/scans/bundler.sh``
* Scan result: ``tools/scan-results/bundler.txt`` — 0 candidates
