whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K

defects/prometheus/patch/prometheus-0001.patch

@@ -0,0 +1,61 @@
+--- a/model/labels/labels_slicelabels.go
++++ b/model/labels/labels_slicelabels.go
+@@ -415,14 +415,22 @@ func NewBuilder(base Labels) *Builder {
+ // Labels returns the labels from the builder.
+ // If no modifications were made, the original labels are returned.
+ func (b *Builder) Labels() Labels {
+ 	if len(b.del) == 0 && len(b.add) == 0 {
+ 		return b.base
+ 	}
+
++	// Build O(1) lookup sets once rather than calling slices.Contains (O(D)) and
++	// contains (O(A)) inside the O(L) base loop — avoids O(L×D) and O(L×A).
++	delSet := make(map[string]struct{}, len(b.del))
++	for _, n := range b.del {
++		delSet[n] = struct{}{}
++	}
++	addSet := make(map[string]struct{}, len(b.add))
++	for _, a := range b.add {
++		addSet[a.Name] = struct{}{}
++	}
++
+ 	expectedSize := max(len(b.base)+len(b.add)-len(b.del), 1)
+ 	res := make(Labels, 0, expectedSize)
+ 	for _, l := range b.base {
+-		if slices.Contains(b.del, l.Name) || contains(b.add, l.Name) {
++		if _, inDel := delSet[l.Name]; inDel {
++			continue
++		}
++		if _, inAdd := addSet[l.Name]; inAdd {
+ 			continue
+ 		}
+ 		res = append(res, l)
+--- a/model/labels/labels_common.go
++++ b/model/labels/labels_common.go
+@@ -204,12 +204,16 @@ func (b *Builder) Set(n, v string) *Builder {
+ // Get returns the current value of label n from the builder. It checks the
+ // pending-add slice first, then falls back to the base label set.
+ func (b *Builder) Get(n string) string {
+-	// Del() removes entries from .add but Set() does not remove from .del, so check .add first.
+-	for _, a := range b.add {
+-		if a.Name == n {
+-			return a.Value
+-		}
++	// Del() removes entries from .add but Set() does not remove from .del, so
++	// check .add first.  Linear scan over b.add is acceptable: the add slice is
++	// bounded to the number of labels set in a single relabel rule (typically ≤5).
++	// For callers that repeatedly call Get on a large add slice, build a map once.
++	for i := range b.add {
++		if b.add[i].Name == n {
++			return b.add[i].Value
+ 		}
+-	if slices.Contains(b.del, n) {
+-		return ""
+ 	}
++	for _, d := range b.del {
++		if d == n {
++			return ""
++		}
++	}
+ 	return b.base.Get(n)
+ }