undf: assign 778-785; stamp inkscape/blender patches

defects/hive/patch/CLEAN.md

@@ -0,0 +1,32 @@
+# Apache Hive — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** ql/src/java/org/apache/hadoop/hive/ql/ (optimizer, parse, exec, metadata, plan)
+         standalone-metastore/metastore-server/
+
+## Summary
+
+Apache Hive is clean of CWE-407 algorithmic complexity defects. The codebase
+consistently uses HashSet for visited tracking, membership tests, and dedup
+operations throughout the query optimizer, parser, compiler, and metastore.
+
+## Key observations
+
+- `OperatorGraph.Cluster.members`: HashSet<Operator<?>>
+- `TezCompiler.unionOps`: HashSet<Operator<?>>
+- `TezCompiler.connect()` (Tarjan SCC): uses `nodes` Set for stack membership
+- `ColumnPrunerProcFactory`: HashSet for colNames membership
+- `PipelineTranslation.viewTransforms`: HashSet<String>
+- `SharedCache.*DeletedDuringPrewarm`: HashSet<String>
+- `SessionHiveMetaStoreClient.partitionVals`: HashSet<List<String>> for partition dedup
+- `Hive.createdDeltaDirs`: HashSet<Path> for ACID delta dir dedup
+- `GreedyPipelineFuser`: acknowledged O(N²) in sibling grouping but this is inherent compatibility checking
+
+Minor findings (no defect):
+- `SemanticAnalyzer.leftAliases/rightAliases`: ArrayList with .contains(), but N is join alias count (2-3)
+- `WindowingSpec.fillInWindowSpec.visited`: ArrayList with .contains(), but N is window spec chain depth (2-3)
+- `QueryPlanTreeTransformation.childrenOfDemux`: List with .contains(), but N is demux children (2-3)
+- `HiveRelDecorrelator.newLocalOutputs`: ArrayList with .contains(), but per-input column offsets (small)
+
+No data-proportional linear scans inside loops found.