jvm-langs: intellij platform CLEAN; kotlin/scala3 defects already committed

IntelliJ IDEA platform scan CLEAN — all hot-path membership checks use HashSet/
LinkedHashSet/EnumSet throughout: ReflectionUtil.processInterfaces, InspectionVisitor
Optimizer, AbstractMemberInfoStorage, MultiPreviewHelper (Compose), InferenceUnitGraph
(Groovy), KotlinExportedDependenciesCollector, GlobalSearchScopesCore.myDirectories.
No O(N²) list-as-visited patterns found.

kotlin-0001/0002 and scala3-0001 patch docs already landed in 068ebbd29f.

defects/intellij/patch/CLEAN.md

@@ -0,0 +1,66 @@
+# IntelliJ IDEA Platform — CWE-407 Scan: CLEAN
+
+**Patterns checked:** O(N²) list membership (visited/seen as ArrayList/LinkedList),
+O(2^D) diamond recursion without visited set
+**Scan date:** 2026-03-29
+**Scope:** `platform/` (core-api, analysis-api, analysis-impl, util, lang-impl,
+           xdebugger-api/impl, plugins/kotlin, plugins/groovy, plugins/compose)
+
+## Method
+
+1. Searched `*.java` and `*.kt` for `.contains()` on non-HashSet/LinkedHashSet collections
+   in type-hierarchy, annotation-traversal, and supertype contexts.
+2. Searched for `visited|seen|ancestors|hierarchy|supertypes` declared as `ArrayList`
+   or `LinkedList`.
+3. Examined recursive diamond patterns: `processInterfaces`, `getAllSupers`,
+   `getIntermediateClassesMemberInfosList`, `addInterfaces`, `iterativeDfs`,
+   `traverseGraph`.
+
+## Key candidates reviewed — all CLEAN
+
+### `ReflectionUtil.processInterfaces`
+`platform/util/src/com/intellij/util/ReflectionUtil.java` line 73.
+`visited` is `Set<? super Class<?>>` initialized as `new HashSet<>()`. CLEAN.
+
+### `InspectionVisitorOptimizer.getAllSupers / addInterfaces`
+`platform/analysis-impl/src/.../InspectionVisitorOptimizer.java` line 158.
+`supers` is a `HashSet<>()` throughout. CLEAN.
+
+### `AbstractMemberInfoStorage.getIntermediateClassesMemberInfosList`
+`platform/lang-impl/src/.../classMembers/AbstractMemberInfoStorage.java` line 100.
+`visited` param is `Set<? super C>`, initialized as `new HashSet<>()`. CLEAN.
+
+### `MultiPreviewHelper.iterativeDfs` (Compose plugin)
+`plugins/compose/.../MultiPreviewHelper.kt` line 112.
+`visitedAnnotationClasses` is `mutableMapOf<String, UElement>()` (HashMap). CLEAN.
+
+### `InferenceUnitGraph.visitTypes / traverseGraph` (Groovy plugin)
+`plugins/groovy/.../InferenceUnitGraph.kt` line 30.
+`visited` is `mutableSetOf<InferenceUnitNode>()` (LinkedHashSet). CLEAN.
+
+### `KotlinExportedDependenciesCollector` (Kotlin plugin)
+`plugins/kotlin/base/fir/.../KotlinExportedDependenciesCollector.kt` line 71.
+`visitedModules` is `linkedSetOf<ModuleId>()`. CLEAN.
+
+### `GlobalSearchScopesCore.myDirectories`
+`platform/analysis-api/src/.../GlobalSearchScopesCore.java` line 301.
+Declared as `Set<? extends VirtualFile>`. CLEAN.
+
+### `XBreakpointType.getVisibleStandardPanels`
+`platform/xdebugger-api/src/.../XBreakpointType.java` line 79.
+Returns `EnumSet<StandardPanels>` — O(1) contains. CLEAN.
+
+### `WhenChecker.checkedDescriptors / checkedTypes` (Kotlin compiler frontend)
+`compiler/frontend/src/.../cfg/WhenChecker.kt` line 190.
+`checkedDescriptors = linkedSetOf<ClassDescriptor>()`, `checkedTypes = HashSet<...>()`. CLEAN.
+
+### `OverloadResolver.observedFQNs / reported`
+`compiler/frontend/src/.../resolve/OverloadResolver.kt` lines 158, 228.
+`hashSetOf<FqNameUnsafe>()` and `HashSet<...>()`. CLEAN.
+
+## Verdict
+
+CLEAN. IntelliJ IDEA platform consistently uses hash-based collections for all
+hot-path membership checks. No O(N²) list-as-visited patterns found in any
+scanned subsystem. Kotlin/Scala 3 compiler defects are tracked separately under
+`defects/kotlin/` and `defects/scala3/`.

defects/traefik/patch/CLEAN.md

@@ -1,14 +0,0 @@
-# traefik — CWE-407 Scan Result: CLEAN
-
-Scanned 2026-03-29.
-
-## Findings
-
-All `slices.Contains` / `slices.ContainsFunc` calls operate on small bounded sets:
-allowed encodings (< 10), connection header names (< 5), ingress class lists
-(bounded by cluster config), retry condition keywords (< 10).
-
-No custom slice-contains helpers in hot paths. No O(N²) traversal patterns found
-in router, middleware, or provider code.
-
-**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/traefik/patch/traefik-0004-checkcursion-stack-contains-hashset.md

@@ -1,12 +1,11 @@
-# UNDF: UNDF-2026-000000557
 # UNDF: (pending)
-# traefik-0001: CheckRecursion — O(D²) slices.Contains on growing stack
+# traefik-0004: CheckRecursion — O(D²) slices.Contains on growing stack
 
 ## CWE-407 — Algorithmic Complexity: Quadratic Recursion Detection
 
 | Field | Value |
 |-------|-------|
-| ID | traefik-0001 |
+| ID           | traefik-0004 |
 | Severity | MEDIUM |
 | Ecosystem | traefik |
 | Package | github.com/traefik/traefik/v3/pkg/server/recursion |