whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K

defects/flink/patch/flink-0001.patch

@@ -0,0 +1,46 @@
+--- a/flink-runtime/src/main/java/org/apache/flink/runtime/jobgraph/JobGraph.java
++++ b/flink-runtime/src/main/java/org/apache/flink/runtime/jobgraph/JobGraph.java
+@@ -117,8 +117,8 @@
+-    /** Set of JAR files required to run this job. */
+-    private final List<Path> userJars = new ArrayList<Path>();
++    /** Set of JAR files required to run this job (LinkedHashSet for O(1) dedup). */
++    private final LinkedHashSet<Path> userJars = new LinkedHashSet<>();
+
+-    /** Set of blob keys identifying the JAR files required to run this job. */
+-    private final List<PermanentBlobKey> userJarBlobKeys = new ArrayList<>();
++    /** Set of blob keys identifying the JAR files required to run this job (LinkedHashSet for O(1) dedup). */
++    private final LinkedHashSet<PermanentBlobKey> userJarBlobKeys = new LinkedHashSet<>();
+
+@@ -563,9 +563,7 @@
+     public void addJar(Path jar) {
+         if (jar == null) {
+             throw new IllegalArgumentException();
+         }
+-        if (!userJars.contains(jar)) {
+-            userJars.add(jar);
+-        }
++        userJars.add(jar);
+     }
+
+@@ -631,9 +629,7 @@
+     public void addUserJarBlobKey(PermanentBlobKey key) {
+         if (key == null) {
+             throw new IllegalArgumentException();
+         }
+-        if (!userJarBlobKeys.contains(key)) {
+-            userJarBlobKeys.add(key);
+-        }
++        userJarBlobKeys.add(key);
+     }
+
+@@ -596,3 +594,3 @@
+     public List<Path> getUserJars() {
+-        return userJars;
++        return new ArrayList<>(userJars);
+     }
+
+@@ -656,3 +654,3 @@
+     public List<PermanentBlobKey> getUserJarBlobKeys() {
+-        return this.userJarBlobKeys;
++        return new ArrayList<>(userJarBlobKeys);
+     }

defects/flink/unit/FlinkJobGraphJarDedupTest.java

@@ -0,0 +1,78 @@
+package unit;
+
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+
+/**
+ * flink-0001: JobGraph user-jar dedup — List.contains() O(n²) vs LinkedHashSet O(n).
+ *
+ * Standalone unit test — no JUnit required.
+ * Compile: javac -d . FlinkJobGraphJarDedupTest.java
+ * Run:     java unit.FlinkJobGraphJarDedupTest
+ */
+public class FlinkJobGraphJarDedupTest {
+
+    static long slowOps;
+    static long fastOps;
+
+    /** Simulates JobGraph.addJar() with ArrayList — O(n) contains per add. */
+    static List<String> slowAddJars(List<String> jars) {
+        slowOps = 0;
+        List<String> userJars = new ArrayList<>();
+        for (String jar : jars) {
+            slowOps++;                          // entry into addJar()
+            for (String existing : userJars) {  // ArrayList.contains() scan
+                slowOps++;
+                if (existing.equals(jar)) break;
+            }
+            if (!userJars.contains(jar)) {
+                userJars.add(jar);
+            }
+        }
+        return userJars;
+    }
+
+    /** Patched: LinkedHashSet.add() is O(1) amortised — no scan needed. */
+    static List<String> fastAddJars(List<String> jars) {
+        fastOps = 0;
+        LinkedHashSet<String> userJars = new LinkedHashSet<>();
+        for (String jar : jars) {
+            fastOps++;          // O(1) hash add — single op per entry
+            userJars.add(jar);
+        }
+        return new ArrayList<>(userJars);
+    }
+
+    static void run(int n, int expectedNx) {
+        List<String> jars = new ArrayList<>();
+        for (int i = 0; i < n; i++) jars.add("jar-" + i + ".jar");
+        // add duplicates at the end to stress the dedup path
+        for (int i = 0; i < n; i++) jars.add("jar-" + i + ".jar");
+
+        List<String> slowResult = slowAddJars(jars);
+        List<String> fastResult = fastAddJars(jars);
+
+        boolean resultsMatch = slowResult.equals(fastResult);
+        boolean quadraticWorse = slowOps > fastOps * expectedNx;
+
+        System.out.printf("n=%-4d  slow=%6d  fast=%4d  ratio=%5.1fx  match=%b  PASS=%b%n",
+            n, slowOps, fastOps, (double) slowOps / fastOps, resultsMatch,
+            resultsMatch && quadraticWorse);
+
+        if (!resultsMatch || !quadraticWorse) {
+            throw new AssertionError(
+                "FAIL n=" + n + " resultsMatch=" + resultsMatch +
+                " slowOps=" + slowOps + " fastOps=" + fastOps +
+                " needed ratio>" + expectedNx);
+        }
+    }
+
+    public static void main(String[] args) {
+        System.out.println("=== flink-0001: JobGraph jar dedup O(n^2) vs O(n) ===");
+        run(50,  5);
+        run(200, 10);
+        run(500, 20);
+        System.out.println("3/3 PASS");
+    }
+}