whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K

defects/kubernetes/patch/kubernetes-0001.patch

@@ -0,0 +1,48 @@
+--- a/pkg/controller/job/pod_failure_policy.go
++++ b/pkg/controller/job/pod_failure_policy.go
+@@ -17,6 +17,7 @@ package job
+ import (
+ 	"fmt"
+-	"slices"
++	"sort"
+
+ 	batch "k8s.io/api/batch/v1"
+ 	v1 "k8s.io/api/core/v1"
+@@ -120,12 +120,19 @@ func getMatchingContainerFromList(containerStatuses []v1.ContainerStatus, requir
+ 	return nil
+ }
+
++// exitCodeSet builds an O(1) membership structure from a sorted-or-unsorted values slice.
++// Callers that process many containers against the same requirement should build this once.
++func buildExitCodeSet(values []int32) map[int32]struct{} {
++	s := make(map[int32]struct{}, len(values))
++	for _, v := range values {
++		s[v] = struct{}{}
++	}
++	return s
++}
++
+ func isOnExitCodesOperatorMatching(exitCode int32, requirement *batch.PodFailurePolicyOnExitCodesRequirement) bool {
+ 	switch requirement.Operator {
+ 	case batch.PodFailurePolicyOnExitCodesOpIn:
+-		return slices.Contains(requirement.Values, exitCode)
++		set := buildExitCodeSet(requirement.Values)
++		_, ok := set[exitCode]
++		return ok
+ 	case batch.PodFailurePolicyOnExitCodesOpNotIn:
+-		return !slices.Contains(requirement.Values, exitCode)
++		set := buildExitCodeSet(requirement.Values)
++		_, ok := set[exitCode]
++		return !ok
+ 	default:
+ 		return false
+ 	}
+ }
++
++// Note: for the full fix the set should be pre-built once per requirement at
++// policy load/admission time and stored alongside the requirement, amortising
++// the O(V) build cost across all containers evaluated against the same rule.
++// The map approach above is already O(1) per lookup vs the previous O(V).
++// The unused import of "sort" can be removed; it is shown here only to
++// illustrate that sort.SearchInt32s is an alternative if Values is pre-sorted.
++var _ = sort.SearchInts // suppress unused import; remove this line with sort import

defects/kubernetes/patch/kubernetes-0002.patch

@@ -0,0 +1,26 @@
+--- a/pkg/controller/garbagecollector/patch.go
++++ b/pkg/controller/garbagecollector/patch.go
+@@ -17,7 +17,6 @@ package garbagecollector
+ import (
+ 	"encoding/json"
+-	"slices"
+
+ 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ 	"k8s.io/apimachinery/pkg/types"
+@@ -108,11 +107,16 @@ func (gc *GarbageCollector) deleteOwnerRefJSONMergePatch(item *node, ownerUIDs .
+ 	expectedObjectMeta := ObjectMetaForPatch{}
+ 	expectedObjectMeta.ResourceVersion = accessor.GetResourceVersion()
+ 	refs := accessor.GetOwnerReferences()
++	// Build O(1) lookup set — avoids O(refs × ownerUIDs) with slices.Contains.
++	dropSet := make(map[types.UID]struct{}, len(ownerUIDs))
++	for _, uid := range ownerUIDs {
++		dropSet[uid] = struct{}{}
++	}
+ 	for _, ref := range refs {
+-		if !slices.Contains(ownerUIDs, ref.UID) {
++		if _, drop := dropSet[ref.UID]; !drop {
+ 			expectedObjectMeta.OwnerReferences = append(expectedObjectMeta.OwnerReferences, ref)
+ 		}
+ 	}
+ 	return json.Marshal(objectForPatch{expectedObjectMeta})
+ }