ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x) FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x) EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x), AddPrincipals HashSet (250x), FK discovery HashSet (6x) Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x) SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x) Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x) Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x) TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x), updatedColumns Set (100x) Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x), addSubClass (250x), SqlWalker partial (130x) GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x) SQLite: SqliteTest unit proof 4/4 PASS (101x) Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/ Sequelize/TypeORM/Doctrine/GORM Whitepaper: 157 sites, 62 ecosystems; PDF 752K
This commit is contained in:
parent
db2986ae44
commit
d4ed2dff91
49 changed files with 4025 additions and 7 deletions
|
|
@ -1 +1,10 @@
|
|||
4b4f71f71db2addc387779105142a220 undefect-cwe407-2026-03-27.pdf
|
||||
247fe2afd56be7dabda54875bc60d77f undefect-minecraft-enterprise-java-2026-03-27.pdf
|
||||
33dc45d94dcb2b6cec4f7036497571d7 executive-summary.pdf
|
||||
3fda5736a004c621f52701c92a7ca7f5 undefect-cwe407-2026-03-24.pdf
|
||||
5da33a4087fdca81f70cce84656afc7f undefect-cwe407-2026-03-26.pdf
|
||||
5f1d37a0ff64d8ea3b9efeee09c7cda1 undefect-cwe407-2026-03-27.pdf
|
||||
818d29731df88333d29cfdd3eefeb3a2 undefect-minecraft-enterprise-java-2026-03-26.pdf
|
||||
ba0de5d1546aa2971492f74616f13f47 full-paper.pdf
|
||||
c7fe499eb004271b384a31ac01b38852 undefect-minecraft-enterprise-java-2026-03-25.pdf
|
||||
f076f22e9e70a94f51884562aad6fdc5 undefect-cwe407-2026-03-25.pdf
|
||||
ff52abf9f47a7e6bb25e4519b1325090 undefect-minecraft-enterprise-java-2026-03-24.pdf
|
||||
|
|
|
|||
|
|
@ -39,8 +39,8 @@ A single well-crafted implementation serves as the genetic blueprint.
|
|||
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
|
||||
|
||||
Code propagates according to its kind — clean architecture begets clean implementations,
|
||||
elegant solutions inspire elegant variations. The process of generating 120 validated
|
||||
defect patches across 52 ecosystems in a single research wave demonstrates how truth,
|
||||
elegant solutions inspire elegant variations. The process of generating 157 validated
|
||||
defect patches across 62 ecosystems in a single research wave demonstrates how truth,
|
||||
properly seeded, multiplies. Each tested patch validates the correctness of the original
|
||||
diagnosis & extends light into new programming paradigms.
|
||||
|
||||
|
|
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
|
|||
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
|
||||
query optimizer, and browser runtime.
|
||||
|
||||
**133 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
|
||||
**157 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
|
||||
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
|
||||
3 unpatched (Minecraft, Create mod). No language left behind.
|
||||
|
||||
|
|
@ -292,6 +292,21 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| rails-0002 | Rails | `activesupport/.../callbacks.rb:803` — `chain.index(callback)` O(C) inside skip_callback filters.each across descendants; O(D×F×C²) | **PATCHED** |
|
||||
| django-0001 | Django | `db/models/base.py:622` — `f.attname in field_names` list O(F) in concrete_fields loop per row; O(N×F²) on every `.defer()`/`.only()` queryset | **PATCHED** |
|
||||
| django-0002 | Django | `core/serializers/base.py:130,136,143` — `field.attname in self.selected_fields` list × 3 per field per object; O(N×F×S) in serialize() | **PATCHED** |
|
||||
| hibernate-0001 | Hibernate ORM | `mapping/Constraint.java` — `ArrayList<Column>.contains()` in `addColumn()` dedup; O(C²) during schema mapping | **PATCHED** |
|
||||
| hibernate-0002 | Hibernate ORM | `mapping/ForeignKey.java` — `ArrayList.contains()` in `addReferencedColumn()` dedup; O(C²) | **PATCHED** |
|
||||
| hibernate-0003 | Hibernate ORM | `mapping/Index.java` — `ArrayList.contains()` in `addColumn()` dedup; O(C²) | **PATCHED** |
|
||||
| hibernate-0004 | Hibernate ORM | `boot/model/process/spi/InFlightMetadataCollectorImpl.java` — `ArrayList.contains()+add(0,…)` in `buildRecursiveOrderedFkSecondPasses()`; O(D²) inheritance chain | **PATCHED** |
|
||||
| hibernate-0005 | Hibernate ORM | `engine/internal/StatisticalLoggingSessionEventListener.java` — `ArrayList.contains()` in `orderHierarchy()` recursive sort; O(T²) hierarchy | **PATCHED** |
|
||||
| efcore-0001 | EF Core | `Metadata/Internal/PropertyExtensions.cs:72` — `List<IProperty>.Contains()` in `FindGenerationProperty()` BFS FK traversal; O(D²) per `SaveChanges()` call (250×) | **PATCHED** |
|
||||
| efcore-0002 | EF Core | `Metadata/IReadOnlyProperty.cs:248` — `List<T>.Contains()` in `AddPrincipals()` recursive traversal; O(P²) principal chain (250×) | **PATCHED** |
|
||||
| sqlalchemy-0001 | SQLAlchemy | `sql/compiler.py:1392` — `_values_bindparam: List[str]` in `_process_numeric()`; `name not in _values_bindparam` O(B) per bind param; O(B²) for large UPDATE/INSERT | **PATCHED** |
|
||||
| sqlalchemy-0002 | SQLAlchemy | `orm/bulk_persistence.py:1873` — `evaluated_keys = list(…)` in `BulkORMUpdate`; list membership in set comprehension O(K) per prefetch col; O(P×K) | **PATCHED** |
|
||||
| sequelize-0001 | Sequelize | `abstract-dialect/query-generator.js:354` — `allAttributes.includes(key)` O(C) in `bulkInsertQuery()` double loop (rows × cols); O(rows×cols²) | **PATCHED** |
|
||||
| sequelize-0002 | Sequelize | `model.js:515` — `all.includes(type_)` O(T) in `_expandIncludeAll()` for-of loop; O(T²) on association type expansion | **PATCHED** |
|
||||
| typeorm-0001 | TypeORM | `src/util/OrmUtils.ts:66` — `OrmUtils.uniq()` reduce+find/indexOf O(N²); called 6× per `loadTables()` schema sync per driver (500×) | **PATCHED** |
|
||||
| typeorm-0002 | TypeORM | `src/persistence/SubjectChangedColumnsComputer.ts:216` — `diffColumns.includes(column)` O(C) inside forEach over all columns; O(cols²) per entity save (125×) | **PATCHED** |
|
||||
| typeorm-0003 | TypeORM | `src/query-builder/UpdateQueryBuilder.ts:534` — `updatedColumns.includes(column)` in nested property×column loop; O(P×C²) per UPDATE query (100×) | **PATCHED** |
|
||||
| doctrine-0001 | Doctrine ORM | `Internal/Hydration/AbstractHydrator.php:328` — `in_array($disc, $discriminatorValues)` O(S) per row per col in inheritance hydration; O(N×C×S) (26×) | **PATCHED** |
|
||||
| rustc-0001 | rustc | `inhabited_predicate.rs:109,127` — `SmallVec::contains` | **PATCHED** |
|
||||
| erlang-0001 | Erlang OTP | `digraph.erl:578` — `lists:member(V, Xs)` in `one_path/8` | **PATCHED** |
|
||||
| swipl-0001 | SWI-Prolog | `ugraphs.pl:510` — `graph_memberchk` O(|V|) scan in `top_sort` | **PATCHED** |
|
||||
|
|
@ -332,6 +347,15 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| rails-0008 | Rails | `activerecord/.../enum.rb:273,419` — value_method_names Array; include? in pairs.each loop O(E²); detect_negative_enum_conditions! O(E²) | **PATCHED** |
|
||||
| django-0003 | Django | `db/models/base.py:2081` — `used_column_names` list in `_check_column_name_clashes()`; O(F²) at startup/check time | **PATCHED** |
|
||||
| django-0004 | Django | `db/models/query.py:2381,2389` — `column_name in self.columns` + `self.columns.index()` list O(C) × 2 in RawQuerySet.resolve_model_init_order() | **PATCHED** |
|
||||
| mybatis-0001 | MyBatis | `builder/ResultMappingConstructorResolver.java:270` — `ArrayList.indexOf()` in sort comparator O(P) × O(N log N) comparisons; O(N×P×log N) | **PATCHED** |
|
||||
| efcore-0003 | EF Core | `Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs:505,746` — `IReadOnlyList.Contains()` in key subset check; O(K×Kp×Fp) model-build | **PATCHED** |
|
||||
| diesel-0001 | Diesel | `sqlite/connection/row.rs` — `column_names.iter().position()` O(C) per named-column access on `Duplicated` row; O(R×M²) per query | **PATCHED** |
|
||||
| diesel-0002 | Diesel | `sqlite/connection/owned_row.rs` — same `position()` pattern on `OwnedSqliteRow` | **PATCHED** |
|
||||
| diesel-0003 | Diesel | `mysql/connection/row.rs` — `metadata.fields().iter().find()` O(C) per named-column access | **PATCHED** |
|
||||
| peewee-0001 | Peewee | `peewee.py:6126` — `_SortedFieldList._keys.index(field._sort_key)` O(N) linear scan; fix: `bisect_left` O(log N) | **PATCHED** |
|
||||
| doctrine-0002 | Doctrine ORM | `Mapping/ClassMetadata.php:2313` — `in_array($className, $subClasses)` O(S) in `addSubClass()`; called in loops in ClassMetadataFactory; O(H×S) startup (250×) | **PATCHED** |
|
||||
| doctrine-0003 | Doctrine ORM | `Query/SqlWalker.php:1405,1445` — `in_array($fieldName, $partialFieldSet)` O(P) per fieldMapping in `walkObjectExpression()`; O(F×P) per PARTIAL DQL query (130×) | **PATCHED** |
|
||||
| gorm-0001 | GORM | `callbacks.go:252` — `getRIndex()` O(N) linear scan called 13× per callback per `sortCallbacks()`; O(N²) per `Register()`; O(N³) at init (194×) | **PATCHED** |
|
||||
| create-0001 | Create mod | `TrackGraph.findDisconnectedGraphs` — `ArrayList.remove(0)` O(n) shift in BFS frontier | Unpatched |
|
||||
| hive-0001 | Apache Hive | `optimizer/GenMRProcContext.java:248` — `ArrayList<Operator>.contains()` in `isSeenOp()` during MapReduce plan gen | **PATCHED** |
|
||||
| hive-0002 | Apache Hive | `optimizer/GenMRProcContext.java:142` — `List<FileSinkOperator>.contains()` in file sink dedup | **PATCHED** |
|
||||
|
|
@ -410,7 +434,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
|
|||
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
|
||||
chains with depths in this range.
|
||||
|
||||
**133 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
|
||||
**157 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -816,6 +840,11 @@ But SQLite is used as an embedded database in Python (`sqlite3` module), Ruby, P
|
|||
Node.js — all of which are receiving faster runtimes from our patches. Faster host
|
||||
runtimes reduce the overhead of the glue layer between application code and SQLite.
|
||||
|
||||
**sqlite-0001 unit test** (`SqliteTest.java` 4/4 PASS): `checkColumnOverlap()` in
|
||||
`trigger.c:792` calls `sqlite3IdListIndex()` — an O(I) list scan — for each expression
|
||||
in the SET clause, producing O(E×I) total. Fix: build a case-insensitive hash set of
|
||||
watched-column names once, reducing to O(I+E). Speedup: **101×** at E=I=200.
|
||||
|
||||
**MySQL / MariaDB**
|
||||
|
||||
The cmake-0001 patch directly applies to MySQL's build. MySQL's optimizer handles join
|
||||
|
|
@ -2025,6 +2054,115 @@ All four: **PATCHED.** Patches at `defects/django/patch/`. Unit proof: `DjangoTe
|
|||
|
||||
---
|
||||
|
||||
### 13.12 ORM Wave — Hibernate, MyBatis, EF Core, Diesel, SQLAlchemy, Peewee, Sequelize
|
||||
|
||||
The second scan wave targeted ORM frameworks across every major language ecosystem.
|
||||
17 new CWE-407 defects confirmed across 7 ORMs.
|
||||
|
||||
**Hibernate ORM — hibernate-0001 through hibernate-0005 (HIGH)**
|
||||
|
||||
Five defects in the mapping layer, all sharing the same root cause: `ArrayList` used as a
|
||||
dedup-tracking container, with `contains()` called before `add()` in loops over schema
|
||||
columns, index columns, and FK second-pass queues. O(C²) cost during `SessionFactory`
|
||||
build time. Fix: `LinkedHashSet` throughout (preserves insertion order). Unit proof:
|
||||
`HibernateConstraintColumnTest` — **19× speedup at N=5,000**.
|
||||
|
||||
**MyBatis — mybatis-0001 (MEDIUM)**
|
||||
|
||||
`ResultMappingConstructorResolver.sortConstructorMappings()` uses `ArrayList.indexOf()`
|
||||
twice inside the sort comparator — O(P) per comparison, O(N×P×log N) total. Fix: pre-build
|
||||
`Map<String,Integer>` index before sort, reducing comparator to O(1). Unit proof:
|
||||
`MyBatisConstructorSortTest` — **12× speedup at N=P=500**.
|
||||
|
||||
**Entity Framework Core — efcore-0001 through efcore-0003**
|
||||
|
||||
- **efcore-0001 (HIGH)**: `PropertyExtensions.FindGenerationProperty()` uses BFS with
|
||||
`List<IProperty>.Contains()` for the visited check — O(D²) where D is FK chain depth.
|
||||
Called from `KeyPropagator.PropagateValue()` on every `SaveChanges()`. Fix: shadow
|
||||
`HashSet<IProperty>`. **250× op reduction.**
|
||||
|
||||
- **efcore-0002 (HIGH)**: `IReadOnlyProperty.AddPrincipals()` uses recursive traversal with
|
||||
`List<T>.Contains()` — O(P²) principal chain. Fix: pass `HashSet<T>` down the recursion.
|
||||
**250× op reduction.**
|
||||
|
||||
- **efcore-0003 (MEDIUM)**: `ForeignKeyPropertyDiscoveryConvention` calls
|
||||
`foreignKeyProperties.Contains()` (on `IReadOnlyList`) inside key-property nested loops
|
||||
at model-build time. Fix: build `HashSet` once per FK. **6× op reduction.**
|
||||
|
||||
Unit proof: `EfCoreTest` 3/3 PASS.
|
||||
|
||||
**Diesel (Rust ORM) — diesel-0001 through diesel-0003 (MEDIUM)**
|
||||
|
||||
Named-column row access (`row.get("column_name")`) calls `column_names.iter().position()`
|
||||
— an O(C) linear scan through the result-set column list — for every named field access on
|
||||
every row. Affects SQLite `Duplicated` rows (diesel-0001), `OwnedSqliteRow` (diesel-0002),
|
||||
and MySQL rows (diesel-0003). Fix: build `BTreeMap<String,usize>` index once per statement.
|
||||
**51× speedup at 500 rows × 100 columns × 100 accesses.** Unit proof: `DieselTest` 2/2 PASS.
|
||||
|
||||
**SQLAlchemy — sqlalchemy-0001 through sqlalchemy-0002 (HIGH)**
|
||||
|
||||
- **sqlalchemy-0001**: `SQLCompiler._values_bindparam: Optional[List[str]]` in
|
||||
`_process_numeric()`. Each new bind param checks `name not in _values_bindparam` — O(B)
|
||||
scan — making accumulation O(B²). Fix: convert to `set`. **500× op reduction.**
|
||||
|
||||
- **sqlalchemy-0002**: `BulkORMUpdate` creates `evaluated_keys = list(…)` then uses it in
|
||||
a set comprehension `{c for c in prefetch_cols if c.key not in evaluated_keys}` — O(P×K).
|
||||
Fix: `evaluated_keys = set(…)`. **500× op reduction.**
|
||||
|
||||
Unit proof: `SQLAlchemyTest` 2/2 PASS.
|
||||
|
||||
**Peewee ORM — peewee-0001 (MEDIUM)**
|
||||
|
||||
`_SortedFieldList.index(field)` calls `self._keys.index(field._sort_key)` — Python `list.index()`
|
||||
is O(N). The list is already sorted (maintained by the class). Fix: `bisect_left` for O(log N).
|
||||
**42× speedup at N=500 fields, 1,000 accesses.** Unit proof: `PeeweeTest` 1/1 PASS.
|
||||
|
||||
**Sequelize — sequelize-0001 through sequelize-0002 (HIGH)**
|
||||
|
||||
- **sequelize-0001**: `bulkInsertQuery()` builds `allAttributes` via `allAttributes.includes(key)`
|
||||
O(C) inside a double loop (rows × cols). O(rows×cols²) total. Fix: shadow `Set` for O(1).
|
||||
**50× speedup at 500 rows × 100 cols.**
|
||||
|
||||
- **sequelize-0002**: `_expandIncludeAll()` calls `all.includes(type_)` O(T) inside a
|
||||
for-of loop over expansion types. O(T²) total. Fix: `const allSet = new Set(all)` before
|
||||
the loop. **250× speedup at T=500.**
|
||||
|
||||
Unit proof: `SequelizeTest` 2/2 PASS.
|
||||
|
||||
**TypeORM — typeorm-0001 through typeorm-0003 (HIGH)**
|
||||
|
||||
- **typeorm-0001**: `OrmUtils.uniq()` reduce+find/indexOf O(N²). Called 6× per driver's
|
||||
`loadTables()` schema sync. Fix: Map keyed accumulator. **500× op reduction.**
|
||||
- **typeorm-0002**: `SubjectChangedColumnsComputer.computeDiffColumns()` — `diffColumns.includes(column)`
|
||||
inside `forEach(columns)`, O(cols²). Fix: shadow `Set`. **125× speedup.**
|
||||
- **typeorm-0003**: `UpdateQueryBuilder` — `updatedColumns.includes(column)` in nested
|
||||
propertyPaths×columns loop O(P×C²). Fix: shadow `Set`. **100× speedup.**
|
||||
|
||||
Unit proof: `TypeORMTest` 3/3 PASS.
|
||||
|
||||
**Doctrine ORM — doctrine-0001 through doctrine-0003**
|
||||
|
||||
- **doctrine-0001 (HIGH)**: `AbstractHydrator.gatherRowData()` — `in_array($disc, $discriminatorValues)`
|
||||
O(S) per row per inheritance col. Fix: `array_flip()` + `isset()`. **26× at 2k rows × 50 subclasses.**
|
||||
- **doctrine-0002 (MEDIUM)**: `ClassMetadata::addSubClass()` — `in_array` O(S) per call in
|
||||
ClassMetadataFactory loops. Fix: parallel `$subClassesSet`. **250× at N=500.**
|
||||
- **doctrine-0003 (MEDIUM)**: `SqlWalker::walkObjectExpression()` — `in_array($field, $partialFieldSet)`
|
||||
O(P) per fieldMapping in `SELECT PARTIAL` DQL. Fix: `array_flip()` before loops. **130× at F=500.**
|
||||
|
||||
Unit proof: `DoctrineTest` 3/3 PASS.
|
||||
|
||||
**GORM — gorm-0001 (MEDIUM)**
|
||||
|
||||
`callbacks.go:252` — `getRIndex()` O(N) scan called 13× per callback per `sortCallbacks()`.
|
||||
Triggered on every `Register()`/`Remove()`/`Replace()`. Fix: pre-build `map[string]int`.
|
||||
**194× speedup at N=200 callbacks.**
|
||||
|
||||
Unit proof: `GORMTest` 1/1 PASS.
|
||||
|
||||
All 24 ORM defects: **PATCHED.** Patches at `defects/{hibernate,mybatis,efcore,diesel,sqlalchemy,peewee,sequelize,typeorm,doctrine,gorm}/patch/`.
|
||||
|
||||
---
|
||||
|
||||
## 14. Confirmed Clean Systems
|
||||
|
||||
The following systems were scanned and confirmed free of CWE-407:
|
||||
|
|
@ -2045,6 +2183,8 @@ The following systems were scanned and confirmed free of CWE-407:
|
|||
|
||||
**Web frameworks:** Pyramid — 5 defects PATCHED: route replacement pyramid-0001 (2,000×), static view dedup pyramid-0002 (1,000×), action resolution pyramid-0003 (738×), topological sort pyramid-0004 (176×), introspectable registry pyramid-0005 (6×). Bottle — bottle-0001 PATCHED: skiplist list scan ×4 per plugin (75×). Flask — CLEAN. Rails — 8 defects PATCHED: preloader eager-load rails-0001 (210×), callback skip rails-0002 (51×), Enumerable#excluding rails-0003 (475×), in_order_of rails-0004 (151×), SchemaDumper rails-0005/6 (130×), lazy_load_hooks rails-0007 (251×), enum boot rails-0008 (1,000×). Django — 4 defects PATCHED: from_db deferred load django-0001 (21×), serializer selected_fields django-0002 (10×), column clash check django-0003 (125×), RawQuerySet django-0004 (101×).
|
||||
|
||||
**ORM layer:** Hibernate — 5 defects PATCHED: schema-mapping addColumn/addReferencedColumn/addIndex LinkedHashSet hibernate-0001/2/3 (19×), FK second-pass hibernate-0004, orderHierarchy hibernate-0005. MyBatis — mybatis-0001 PATCHED: sort comparator HashMap (12×). Entity Framework Core — 3 defects PATCHED: FindGenerationProperty HashSet efcore-0001 (250×), AddPrincipals HashSet efcore-0002 (250×), FK discovery efcore-0003 (6×). Diesel — 3 defects PATCHED: SQLite/MySQL row BTreeMap index diesel-0001/2/3 (51×). SQLAlchemy — 2 defects PATCHED: _values_bindparam Set sqlalchemy-0001 (500×), evaluated_keys Set sqlalchemy-0002 (500×). Peewee — peewee-0001 PATCHED: _SortedFieldList bisect (42×). Sequelize — 2 defects PATCHED: bulkInsert Set sequelize-0001 (50×), expandIncludeAll Set sequelize-0002 (250×). TypeORM — 3 defects PATCHED: OrmUtils.uniq typeorm-0001 (500×), diffColumns typeorm-0002 (125×), updatedColumns typeorm-0003 (100×). Doctrine ORM — 3 defects PATCHED: hydrator discriminator doctrine-0001 (26×), addSubClass doctrine-0002 (250×), SqlWalker partial doctrine-0003 (130×). GORM — gorm-0001 PATCHED: sortCallbacks getRIndex (194×). Active Record, Exposed, SeaORM — scan pending.
|
||||
|
||||
**P2P networks:** I2P Java router, libtorrent, Transmission, Kubo (IPFS), Deluge — all
|
||||
confirmed clean.
|
||||
|
||||
|
|
@ -2884,4 +3024,4 @@ foundational tools — compilers, package managers, database query planners, cry
|
|||
toolchains, routing daemons, event streaming platforms, web frameworks, query optimizers,
|
||||
and browser runtimes — the fix is a one-line data structure substitution with no
|
||||
behavioral change, and we have patched, tested, and benchmarked every confirmed site
|
||||
across 52 ecosystems.
|
||||
across 62 ecosystems.
|
||||
|
|
|
|||
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue