undf: assign 721-726; salt-0001/0002/0003 CWE-407 list→set patches

defects/salt/patch/salt-0001-cloud-cycle-detection-set.patch

@@ -0,0 +1,33 @@
+# UNDF: UNDF-2026-000000658
+--- a/salt/cloud/__init__.py
++++ b/salt/cloud/__init__.py
+@@ -1830,18 +1830,18 @@ class Map(Cloud):
+     def _has_loop(self, dmap, seen=None, val=None):
+         if seen is None:
+             for values in dmap["create"].values():
+-                seen = []
++                seen = set()
+                 try:
+                     machines = values["requires"]
+                 except KeyError:
+                     machines = []
+                 for machine in machines:
+-                    if self._has_loop(dmap, seen=list(seen), val=machine):
++                    if self._has_loop(dmap, seen=set(seen), val=machine):
+                         return True
+         else:
+             if val in seen:
+                 return True
+
+-            seen.append(val)
++            seen.add(val)
+             try:
+                 machines = dmap["create"][val]["requires"]
+             except KeyError:
+                 machines = []
+
+             for machine in machines:
+-                if self._has_loop(dmap, seen=list(seen), val=machine):
++                if self._has_loop(dmap, seen=set(seen), val=machine):
+                     return True
+         return False

defects/salt/patch/salt-0002-thin-tops-set-dedup.patch

@@ -0,0 +1,13 @@
+# UNDF: UNDF-2026-000000725
+--- a/salt/utils/thin.py
++++ b/salt/utils/thin.py
+@@ -840,7 +840,9 @@ def gen_thin(cachedir, extra_mods="", so_mods="", ...):
+             mods, saltext_dists = _discover_saltexts(
+                 allowlist=saltext_allowlist, blocklist=saltext_blocklist
+             )
+-            # Deduplicate in case some saltexts were passed in thin_extra_modules
+-            tops.extend(mod for mod in mods if mod not in tops)
++            # Deduplicate in case some saltexts were passed in thin_extra_modules.
++            # Use a set for O(1) membership checks instead of O(N) list scans.
++            tops_set = set(tops)
++            tops.extend(mod for mod in mods if mod not in tops_set)

defects/salt/patch/salt-0003-saltclass-seen-set.patch

@@ -0,0 +1,26 @@
+# UNDF: UNDF-2026-000000726
+--- a/salt/utils/saltclass.py
++++ b/salt/utils/saltclass.py
+@@ -368,7 +368,7 @@ def get_pillars(minion_id, salt_data):
+     ...
+     expanded_classes = expand_classes_in_order(node_dict[minion_id], salt_data, [], [])
++    expanded_classes = expand_classes_in_order(node_dict[minion_id], salt_data, set(), [])
+
+--- a/salt/utils/saltclass.py
++++ b/salt/utils/saltclass.py
+@@ -282,7 +282,7 @@ def expand_classes_in_order(minion_dict, salt_data, seen_classes, classes_to_exp
+     """
+     Expand the list of `classes_to_expand` and return them in the order found
+
+-    :param iterable(str) seen_classes: classes already processed
++    :param set seen_classes: classes already processed (set for O(1) membership)
+     ...
+     """
+
+@@ -309,7 +309,7 @@ def expand_classes_in_order(minion_dict, salt_data, seen_classes, classes_to_exp
+     # Now loop on list to recursively expand them
+     for klass in classes_to_expand:
+         if klass not in seen_classes:
+-            seen_classes.append(klass)
++            seen_classes.add(klass)
+             klass_dict = OrderedDict({klass: get_class(klass, salt_data)})