distlib/luigi/zookeeper/mybatis/solc/solana/go-ethereum: CWE-407 patches + unit tests; solana CLEAN

defects/distlib/patch/distlib-0001-get-dependent-dists-dep-set.patch

@@ -0,0 +1,21 @@
+# UNDF: UNDF-2026-000000046
+--- a/distlib/database.py
++++ b/distlib/database.py
+@@ -1277,10 +1277,13 @@ def get_dependent_dists(dists, dist):
+     graph = make_graph(dists)
+
+-    dep = [dist]  # dependent distributions
++    dep = [dist]      # dependent distributions (ordered output list)
++    dep_set = {dist}  # O(1) membership mirror of dep
+     todo = graph.reverse_list[dist]  # list of nodes we should inspect
+
+     while todo:
+         d = todo.pop()
+         dep.append(d)
++        dep_set.add(d)
+         for succ in graph.reverse_list[d]:
+-            if succ not in dep:
++            if succ not in dep_set:  # O(1) instead of O(N) list scan
+                 todo.append(succ)
+
+     dep.pop(0)  # remove dist from dep, was there to prevent infinite loops

defects/distlib/patch/distlib-0002-get-steps-ordered-dict.patch

@@ -0,0 +1,39 @@
+# UNDF: UNDF-2026-000000722
+--- a/distlib/util.py
++++ b/distlib/util.py
+@@ -1,6 +1,6 @@
+ import codecs
+-from collections import deque
++from collections import deque, OrderedDict
+ import contextlib
+@@ -1127,16 +1127,16 @@ def get_steps(self, final):
+         if not self.is_step(final):
+             raise ValueError('Unknown: %r' % final)
+-        result = []
+-        todo = []
++        result = OrderedDict()  # preserves insertion order, O(1) move_to_end
++        todo = deque()          # O(1) popleft instead of O(N) list.pop(0)
+         seen = set()
+-        todo.append(final)
++        todo.append(final)      # deque.append is O(1)
+         while todo:
+-            step = todo.pop(0)
++            step = todo.popleft()   # O(1) instead of O(N) list.pop(0)
+             if step in seen:
+                 # if a step was already seen,
+                 # move it to the end (so it will appear earlier
+                 # when reversed on return) ... but not for the
+                 # final step, as that would be confusing for
+                 # users
+                 if step != final:
+-                    result.remove(step)  # O(N) list scan
+-                    result.append(step)
++                    result.move_to_end(step)  # O(1) OrderedDict relink
+             else:
+                 seen.add(step)
+-                result.append(step)
++                result[step] = None
+                 preds = self._preds.get(step, ())
+                 todo.extend(preds)
+-        return reversed(result)
++        return reversed(list(result))