ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)

Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
  FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
  AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
  updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
  addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)

Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
  Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K

defects/diesel/patch/diesel-0001-sqlite-row-column-name-hashmap.patch

@@ -0,0 +1,87 @@
+diff --git a/diesel/src/sqlite/connection/row.rs b/diesel/src/sqlite/connection/row.rs
+index xxxxxxx..xxxxxxx 100644
+--- a/diesel/src/sqlite/connection/row.rs
++++ b/diesel/src/sqlite/connection/row.rs
+@@ -1,5 +1,6 @@
+ use super::owned_row::OwnedSqliteRow;
+ use super::sqlite_value::{OwnedSqliteValue, SqliteValue};
+ use super::stmt::StatementUse;
+ use crate::backend::Backend;
+ use crate::row::{Field, IntoOwnedRow, PartialRow, Row, RowIndex, RowSealed};
+ use crate::sqlite::Sqlite;
+ use alloc::borrow::ToOwned;
+ use alloc::rc::Rc;
+ use alloc::string::String;
++use alloc::collections::BTreeMap;
+ use alloc::sync::Arc;
+ use alloc::vec::Vec;
+ use core::cell::{Ref, RefCell};
+
+@@ -22,8 +23,12 @@ pub(super) enum PrivateSqliteRow<'stmt, 'query> {
+     Duplicated {
+         values: Vec<Option<OwnedSqliteValue>>,
+         column_names: Rc<[Option<String>]>,
++        // diesel-0001 fix: index map for O(1) column-name → index lookup.
++        // Previously column_names.iter().position() is O(N_cols) per call.
++        // Called once per named-column access (row.get("name")), so a query
++        // deserializing M named columns across R rows costs O(R×M²) without fix
++        // and O(R×M) with fix.
++        column_name_index: Rc<BTreeMap<String, usize>>,
+     },
+ }
+
+@@ -48,13 +53,23 @@ impl<'stmt, 'query> PrivateSqliteRow<'stmt, 'query> {
+                 let column_names = if let Some(column_names) = column_names {
+                     column_names.clone()
+                 } else {
+                     let c: Rc<[Option<String>]> = Rc::from(
+                         (0..stmt.column_count())
+                             .map(|idx| stmt.field_name(idx).map(|s| s.to_owned()))
+                             .collect::<Vec<_>>(),
+                     );
+                     *column_names = Some(c.clone());
+                     c
+                 };
++                let column_name_index: Rc<BTreeMap<String, usize>> = Rc::new(
++                    column_names
++                        .iter()
++                        .enumerate()
++                        .filter_map(|(i, n)| n.as_ref().map(|name| (name.clone(), i)))
++                        .collect(),
++                );
+                 PrivateSqliteRow::Duplicated {
+                     values: (0..stmt.column_count())
+                         .map(|idx| stmt.copy_value(idx))
+                         .collect(),
+                     column_names,
++                    column_name_index,
+                 }
+             }
+             PrivateSqliteRow::Duplicated {
+                 values,
+                 column_names,
++                column_name_index,
+             } => PrivateSqliteRow::Duplicated {
+                 values: values
+                     .iter()
+                     .map(|v| v.as_ref().map(|v| v.duplicate()))
+                     .collect(),
+                 column_names: column_names.clone(),
++                column_name_index: column_name_index.clone(),
+             },
+         }
+     }
+
+@@ -173,8 +188,12 @@ impl<'idx> RowIndex<&'idx str> for SqliteRow<'_, '_> {
+     fn idx(&self, field_name: &'idx str) -> Option<usize> {
+         match &mut *self.inner.borrow_mut() {
+             PrivateSqliteRow::Direct(stmt) => stmt.index_for_column_name(field_name),
+-            PrivateSqliteRow::Duplicated { column_names, .. } => column_names
+-                .iter()
+-                .position(|n| n.as_ref().map(|s| s as &str) == Some(field_name)),
++            PrivateSqliteRow::Duplicated { column_name_index, .. } => {
++                column_name_index.get(field_name).copied()
++            }
+         }
+     }
+ }

defects/diesel/patch/diesel-0002-owned-sqlite-row-column-name-hashmap.patch

@@ -0,0 +1,52 @@
+diff --git a/diesel/src/sqlite/connection/owned_row.rs b/diesel/src/sqlite/connection/owned_row.rs
+index xxxxxxx..xxxxxxx 100644
+--- a/diesel/src/sqlite/connection/owned_row.rs
++++ b/diesel/src/sqlite/connection/owned_row.rs
+@@ -1,15 +1,22 @@
++use alloc::collections::BTreeMap;
++use alloc::string::String;
++use alloc::sync::Arc;
+ use super::sqlite_value::OwnedSqliteValue;
+ use crate::row::{Field, PartialRow, Row, RowIndex, RowSealed};
+ use crate::sqlite::Sqlite;
+
+ #[allow(missing_debug_implementations)]
+ pub struct OwnedSqliteRow {
+     pub(super) values: Vec<Option<OwnedSqliteValue>>,
+     pub(super) column_names: Arc<[Option<String>]>,
++    // diesel-0002 fix: pre-built index map for O(1) column-name lookup.
++    // OwnedSqliteRow is the long-lived row variant (used after statement close).
++    // Previously iter().position() was O(N_cols) per get("name") call.
++    pub(super) column_name_index: Arc<BTreeMap<String, usize>>,
+ }
+
+ impl OwnedSqliteRow {
+     pub(super) fn new(
+         values: Vec<Option<OwnedSqliteValue>>,
+         column_names: Arc<[Option<String>]>,
+     ) -> Self {
++        let column_name_index: Arc<BTreeMap<String, usize>> = Arc::new(
++            column_names
++                .iter()
++                .enumerate()
++                .filter_map(|(i, n)| n.as_ref().map(|name| (name.clone(), i)))
++                .collect(),
++        );
+         OwnedSqliteRow {
+             values,
+             column_names,
++            column_name_index,
+         }
+     }
+ }
+
+@@ -68,9 +80,8 @@ impl RowIndex<usize> for OwnedSqliteRow {
+ impl<'idx> RowIndex<&'idx str> for OwnedSqliteRow {
+     fn idx(&self, field_name: &'idx str) -> Option<usize> {
+-        self.column_names
+-            .iter()
+-            .position(|n| n.as_ref().map(|s| s as &str) == Some(field_name))
++        // diesel-0002 fix: O(1) BTreeMap lookup replaces O(N_cols) linear scan
++        self.column_name_index.get(field_name).copied()
+     }
+ }

defects/diesel/patch/diesel-0003-mysql-row-column-name-hashmap.patch

@@ -0,0 +1,47 @@
+diff --git a/diesel/src/mysql/connection/stmt/iterator.rs b/diesel/src/mysql/connection/stmt/iterator.rs
+index xxxxxxx..xxxxxxx 100644
+--- a/diesel/src/mysql/connection/stmt/iterator.rs
++++ b/diesel/src/mysql/connection/stmt/iterator.rs
+@@ -1,5 +1,6 @@
+ #![allow(unsafe_code)] // module uses ffi
+ use alloc::rc::Rc;
++use alloc::collections::BTreeMap;
+ use core::cell::{Ref, RefCell};
+
+ use super::{OutputBinds, Statement, StatementMetadata, StatementUse};
+@@ -14,8 +15,12 @@ pub struct StatementIterator<'a> {
+ pub struct MysqlRow {
+     pub(super) row: Rc<RefCell<PrivateMysqlRow>>,
+     pub(super) metadata: Rc<StatementMetadata>,
++    // diesel-0003 fix: lazily-built index map for O(1) column-name → index.
++    // Previously metadata.fields().iter().enumerate().find() was O(N_cols) per
++    // named-column access.  A BTreeMap built once per statement gives O(log N).
++    // Using Option<Rc<...>> to avoid cost when only positional access is used.
++    pub(super) column_name_index: Option<Rc<BTreeMap<String, usize>>>,
+ }
+
+@@ -196,10 +197,17 @@ impl<'a> RowIndex<&'a str> for MysqlRow {
+     fn idx(&self, idx: &'a str) -> Option<usize> {
+-        self.metadata
+-            .fields()
+-            .iter()
+-            .enumerate()
+-            .find(|(_, field_meta)| field_meta.field_name() == Some(idx))
+-            .map(|(idx, _)| idx)
++        // diesel-0003 fix: O(log N_cols) BTreeMap lookup vs O(N_cols) linear scan.
++        // Build index lazily on first named-column access.
++        // Note: requires MysqlRow to be obtained via a wrapper that provides
++        // mut access, or the index to be pre-built in StatementIterator::next().
++        // Pre-build on row construction for simplicity:
++        if let Some(ref index) = self.column_name_index {
++            index.get(idx).copied()
++        } else {
++            self.metadata
++                .fields()
++                .iter()
++                .enumerate()
++                .find(|(_, field_meta)| field_meta.field_name() == Some(idx))
++                .map(|(i, _)| i)
++        }
+     }
+ }