wave7: 433/194 — kafka/flink/pulsar, spring/micronaut/quarkus, nginx/haproxy/traefik, linux/nomad/consul, numpy/pandas/sklearn, ES/OS/pg/sqlite/rustc/cargo

defects/consul/patch/consul-0001-checks-exclude.md

@@ -0,0 +1,35 @@
+# consul-0001: ExcludeBasedOnChecks — O(checks × ignoreIDs)
+
+## CWE
+CWE-407: Inefficient Algorithmic Complexity
+
+## Severity
+MEDIUM
+
+## Location
+`agent/structs/structs.go:2244-2252`
+
+## Description
+`ExcludeBasedOnChecks` iterates over all checks for a service node and for
+each calls `slices.Contains(opts.IgnoreCheckIDs, check.CheckID)` — a linear
+scan over the ignore list.
+
+```go
+for _, check := range csn.Checks {
+    if slices.Contains(opts.IgnoreCheckIDs, check.CheckID) {   // O(|IgnoreCheckIDs|)
+        continue
+    }
+    ...
+}
+```
+
+This function is called in health query hot paths (service discovery). With
+C checks per node and I ignore IDs: O(C × I) per node, compounded over all
+nodes returned in a health query.
+
+## Fix
+Build a `map[types.CheckID]struct{}` from `opts.IgnoreCheckIDs` once
+(either in the caller or at the start of the function).
+
+## Speedup
+~Ix where I = len(IgnoreCheckIDs).