whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K

defects/pip/patch/pip-0001-cache-support-index-min-precomputed-dict.patch

@@ -0,0 +1,24 @@
+--- a/src/pip/_internal/cache.py
++++ b/src/pip/_internal/cache.py
+@@ -130,6 +130,10 @@ class SimpleWheelCache(Cache):
+         wheels_dir = self.get_path_for_link(link)
+         if os.path.isdir(wheels_dir):
+             candidates = []
++            # CWE-407 fix: precompute tag->priority dict once, reuse for all wheel
++            # candidates.  Before this patch support_index_min() linearly enumerated
++            # supported_tags (200-600 entries) per candidate — O(C*T) per lookup.
++            tag_to_priority = {tag: idx for idx, tag in enumerate(supported_tags)}
+             for wheel_name in os.listdir(wheels_dir):
+                 try:
+                     wheel = Wheel(wheel_name)
+@@ -155,7 +159,7 @@ class SimpleWheelCache(Cache):
+                 if not wheel.supported(supported_tags):
+                     # Built for a different python/arch/etc
+                     continue
+                 candidates.append(
+                     (
+-                        wheel.support_index_min(supported_tags),
++                        wheel.find_most_preferred_tag(supported_tags, tag_to_priority),
+                         wheel_name,
+                         wheel_dir,
+                     )