dagger-0001 + jackson-0001/0002: Deque.contains O(N×D) + two O(N²) type-hierarchy scans; count 656→659

defects/commons-lang/patch/CLEAN.md

@@ -0,0 +1,14 @@
+# CLEAN — Apache Commons Lang
+
+Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
+
+## Findings
+
+- `ClassUtils.getAllInterfaces()` — CLEAN: uses `LinkedHashSet` with `if (interfacesFound.add(i))` guard; O(N+E) correct
+- `ClassUtils.getAllSuperclasses()` — CLEAN: simple linear superclass chain, no diamond issue
+- `TypeUtils.getClosestParentType()` / mutual recursion with `isAssignable()` — CLEAN: each recursive call reduces `cls` to ONE closest parent type; linear O(depth) not O(2^D)
+- `TypeUtils.determineTypeArguments()` `typeVarList.contains()` — N is bounded by generic arity (typically 1–3); negligible
+- `InheritanceUtils.distance()` — CLEAN: simple linear recursion
+- `AnnotationUtils` — CLEAN: no hierarchy traversal
+
+**Result: No actionable CWE-407 defects.**