Commit graph

52 commits

Author SHA1 Message Date
87099aaaac v8-0004 + jsc-0003: Maglev KnownMapsMerger O(P×R) std::find, IntegerRangeOpt liveAtHead O(50×B×R×L); 2+2 PASS; count 606→608 2026-03-27 23:00:07 -04:00
ae91f05bf3 curl-0002/0003 + libevent-0001: header lookup O(K×H), HSTS O(N²), route dispatch O(C); libuv CLEAN; count 603→606 2026-03-27 22:46:05 -04:00
212d313185 bazel-0003 + kicad-0002: build toolchain feature check + PCB zone filler O(Z²×L²); count 601→603 2026-03-27 22:38:32 -04:00
1d6a8b8ccd redis-0004 + dragonfly-0001: ACL channel O(C×P) + cluster migration O(M²); memcached CLEAN; count 599→601 2026-03-27 22:34:04 -04:00
ff7bd27654 bird-0003/0004 + frrouting-0003/0004: BGP community set ops O(N×M)/O(N²); OpenBGPD CLEAN; count 595→599 2026-03-27 22:30:39 -04:00
3f8c5e6d3e httpd-0003/0004 + varnish-0003: 3 new defects (12x/50x/25x); count 592→595 2026-03-27 22:26:26 -04:00
34e8d9212f openssl-0004 + uwsgi-0001: 2 new defects (500x/249x); all 10 missing whitepaper entries restored; count 590→592 2026-03-27 22:20:52 -04:00
2e4f7807d5 whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF 2026-03-27 22:18:31 -04:00
e4ee168b1e 578/240 — rustc-0004/vertx-0001/asterisk-0003/bitcoin-0001/actix-web-0003/hazelcast-0001+0002/rabbitmq-0005/nginx-0003/haproxy-0003/envoy-0003/istio-0003 2026-03-27 21:25:37 -04:00
dde5ec97fb wave17: 562/240 — vim/qemu/tcl/nodejs/bun/httpd-0002/systemd/emacs 2026-03-27 20:28:18 -04:00
cce7ec653a wave17 complete: systemd/emacs/vim/qemu/tcl/kafka-0007/spark-0004 + 559/240 2026-03-27 20:15:47 -04:00
4221966e66 wave17: openssh-0001/2, strongswan-0001, gradle-0002, groovy-0001/2, make-0001, clojure-CLEAN + whitepaper 549/240 2026-03-27 19:55:52 -04:00
0f275c44af whitepaper: add html-cwe407 and html-minecraft targets; update clean 2026-03-27 19:52:27 -04:00
d816d3c74c wave16: dart-0001/2/3 + octave-0002 + php-0003/4 + cassandra-0005 + erlang-0003 + chef-0001 — 542/240 2026-03-27 19:36:35 -04:00
31850d5ef6 wave15: sm-0003/0004 + threejs-0006 + varnish-0002 + mongodb-0008 — 533/240 2026-03-27 19:22:37 -04:00
7146714143 wave15: v8-0002/0003 Intl+revectorizer (125x/25x) + bullet/box2d ticket files — 528/240 2026-03-27 19:16:28 -04:00
c4026333ba wave14b: openbsd-0001/2 + 526/240 PDF 2026-03-27 18:14:55 -04:00
ac0e1e091e wave14a/c/d: 524/239 — rails-0018/grape-0001..3/django-0005..6/sqlalchemy-0003/go-stdlib-0001/vault-0001/tf-aws-0001 2026-03-27 18:11:25 -04:00
8f0bc73afa wave13: 514/239 — flink/nifi/artemis + K8s/cilium/linkerd2 + ES/OpenSearch/Solr + hadoop/hbase/spark 2026-03-27 17:50:40 -04:00
424a2a7787 wave12: 501/237 — ClickHouse/Druid/Pinot + Ansible/OpenTofu/Pulumi + Celery/Camel + VictoriaMetrics/Ceph 2026-03-27 17:34:59 -04:00
19333b378e wave11: 488/227 — ROS2/OpenCV/Open3D/metaflow/kubeflow/optuna/openssl/mbedtls/wolfssl + Kafka Streams/Pulsar 2026-03-27 17:31:52 -04:00
6276aea2e5 wave10 complete: 472/219 2026-03-27 17:14:32 -04:00
70702dff5c wave10b/c: 465/212 hudi/iceberg/scylladb/yugabyte/foundationdb 2026-03-27 17:12:25 -04:00
f7fa333977 wave10a: 462/209 hudi/iceberg/beam-clean/samza-clean 2026-03-27 17:10:09 -04:00
ab10b2f555 wave9 complete: 458/207 — airflow/argo/pytorch-0003/tf/jax/pyg/grpc/thrift + graphhopper/valhalla 2026-03-27 16:59:04 -04:00
81bc62b9cb wave9b: 455/204 — graphhopper-0001/0002 + valhalla-0001 + OSRM CLEAN 2026-03-27 16:54:46 -04:00
16cc7ecf1d wave8 complete + outreach: 452/202, 40 outreach briefs, buck2/ant CLEAN 2026-03-27 16:45:01 -04:00
3c0b3edc79 wave8c: 452/202 — envoy/cilium, graph-dbs, elixir/nim, k8s/maven + PDF 2026-03-27 16:38:25 -04:00
c4330be5b0 wave8b: 438/196 — rails-0017, hanami-0001, spark-0002 + PDF 2026-03-27 16:33:08 -04:00
2d3e3d603e wave8a: 436/195 — istio-0002, spark-0002, igraph-0001 + PDF 2026-03-27 16:31:34 -04:00
5fe6da7cc2 wave7: 433/194 — kafka/flink/pulsar, spring/micronaut/quarkus, nginx/haproxy/traefik, linux/nomad/consul, numpy/pandas/sklearn, ES/OS/pg/sqlite/rustc/cargo 2026-03-27 16:20:58 -04:00
3735145aa5 whitepaper: 398/185 — wave6d (rails-0012..16, jsc-0001/2, vtk, sm-0002, redis/valkey-0003, helm-0002/3, k8s-0003) 2026-03-27 15:57:50 -04:00
eb9612e4bf whitepaper: 383/183 — wave6 defect tables + PDF rebuild 2026-03-27 15:46:25 -04:00
3eebda37e1 wave6a/6b: elasticsearch/opensearch/solr/llvm-0004-5/linux-0005-6/gcc-0002/tokio/actix-web + love2d/raylib new defects 2026-03-27 15:45:14 -04:00
a4b0cf4edd whitepaper: 366/178 — wave5 defect tables + PDF rebuild 2026-03-27 15:37:42 -04:00
835ae73b0f whitepaper: 352/169 — wave4 MEDIUM (hadoop/hbase/nova/neutron/openstack) + fix odl-0002 dup 2026-03-27 15:33:17 -04:00
9934133dcf whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
2026-03-27 15:23:43 -04:00
b3842ab6b8 comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00
4d3fcc8e73 game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems 2026-03-27 14:14:49 -04:00
547a9f5738 ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems)
rails-0009: FilterAttributeHandler filter_parameters Array O(A×F) → Set (450×)
rails-0010: Encryption::AutoFilteredParameters two Array scans → Set (250×)
rails-0011: TimeZoneConversion skip_list Array O(M×C×S) → Set (20×)

exposed-0001: SchemaUtilityApi mapMissingColumnStatements O(N×M) → map (118×)
exposed-0002: IdentifierManagerApi isAKeyword O(K) linear → HashSet (144×)
exposed-0003: Table.clone consParams.map fresh List → hoisted HashSet (6×)

seaorm-0001: active_model establish_links leftover.any O(N²) → HashSet (501×)
seaorm-0002: rbac engine group_permissions .values().find() → HashMap by ID (502×)
seaorm-0003: schema builder sorted_tables Vec::contains → HashSet (500×)
seaorm-0004: TopologicalSort from_iter seen Vec O(N²) → BTreeSet (28×)

Unit tests: RailsTest 11/11, ExposedTest 3/3, SeaORMTest 4/4 PASS
Whitepaper: 157→167 sites, 62→64 ecosystems; §13.12 ORM Wave 2 added
2026-03-27 13:49:46 -04:00
d4ed2dff91 ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
  FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
  AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
  updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
  addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)

Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
  Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K
2026-03-27 13:34:26 -04:00
db2986ae44 django/rails/bottle/pyramid: web framework wave complete — 133 sites 52 ecosystems 2026-03-27 12:16:27 -04:00
08989870a6 rails: 8 defects (210x/51x/475x/151x/130x/251x/1000x) + 129 sites 51 ecosystems 2026-03-27 12:12:33 -04:00
9576d47645 bottle/flask/pyramid/sfml/angelscript/threejs/pygame: 22 defects + whitepaper 121 sites 50 ecosystems 2026-03-27 12:08:15 -04:00
8643225d7c pyramid: 5 defects patched + whitepaper (120 sites, 49 ecosystems) 2026-03-27 12:04:39 -04:00
6bafc7f5e9 sfml/angelscript/threejs/pygame: unit tests + patches + whitepaper (115 sites, 48 ecosystems)
SFML 5 defects: VideoMode dedup x3 (139x), allWindows erase (1001x), GL ext (149x)
AngelScript 3 defects: FindNewOwner (100x), CompileSwitch (250x)
Three.js 5 defects: WebGL binding (22x), StackNode filter (1875x), NodeBuilder (517x)
pygame 4 defects: remove_internal (3001x), spritecollide dokill (3001x), switch_layer (3001x)

Whitepaper: 98→115 sites, 44→48 ecosystems
All unit tests pass: 6/6 each
2026-03-27 11:57:12 -04:00
442a6156e3 undefect. CWE-407 — 98 sites, 44 ecosystems; game engines: godot, dry/urho3d; CLAUDE.md clone policy 2026-03-27 11:42:17 -04:00
083765d3c6 undefect. CWE-407 — 96 sites, 43 ecosystems; godot-0001..0004 game engine physics 2026-03-27 11:32:11 -04:00
4efa631089 disclosure: add security@undefect.com contact to whitepaper §16 and gumyum minecraft page 2026-03-27 10:57:50 -04:00
925a9ddde8 whitepaper: §19.4 browser SEW two-manifold demo — clock drift, friend temps, kcjones agent science 2026-03-27 10:54:56 -04:00