undf: assign 847-849; stamp freecad/retroarch patches

defects/nextcloud-server/patch/CLEAN.md

@@ -0,0 +1,24 @@
+# Nextcloud Server — CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-30
+Target: https://github.com/nextcloud/server (PHP)
+Focus: lib/private/, apps/ — sharing, file operations, CalDAV, contacts, app management, encryption, LDAP
+
+## Summary
+
+No CWE-407 defects found. Nextcloud uses PHP associative arrays (hash maps) for most
+hot-path membership tests. The `in_array()` calls found (386 total, 62 inside foreach
+loops) all operate on:
+
+- Constant-size field/property arrays (< 15 elements)
+- Config-level lists bounded by application count (< 100)
+- Early-exit search patterns with small search spaces
+- Error/logging paths not on hot execution path
+
+## Notable non-defects reviewed
+
+- `lib/private/AppConfig.php` strictnessApplied dedup — logging path only
+- `lib/private/Collaboration/Collaborators/GroupPlugin.php` — bounded by $limit parameter
+- `lib/private/Log/ExceptionSerializer.php` removeValuesFromArgs — error path only
+- `apps/files_external/lib/Lib/ApplicableHelper.php` diffApplicable — config-level groups/users
+- `lib/private/Files/Cache/Cache.php` normalizeData — constant-size field arrays