cfed6f1c5b
undf: stamp bullet3-0001/0002, assign UNDF-2026-000000001/000000288
2026-03-29 19:53:29 -04:00
805a596198
undf: stamp doctrine-orm-0001 (UNDF-2026-000000002) composer-0003 (UNDF-2026-000000045); registry 578 assigned
2026-03-29 19:52:08 -04:00
ac82cff865
php-cluster: doctrine-orm-0001 + composer-0003 CWE-407 defects; count 668→670
...
doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH
- src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list
- addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class
- Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000
composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM
- needles array grows during foreach($packages) loop, in_array scan 3 sites
- $packagesFoundSet already exists for cycle-detection but needles is separate
- Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000
cayley: CLEAN (confirmed -- map-based seen/pathMap throughout)
tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)
2026-03-29 19:51:31 -04:00
7491349edc
game-engines: allegro5/bullet3/box2d/dry CWE-407 scan
...
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
2026-03-29 19:50:49 -04:00
72e37e6142
messaging-rpc: kylin/pulsar/beam/samza/thrift/grpc/tinkerpop CWE-407 scan
...
3 new defects:
- kylin-0001: NDataflowManager.updateDataflowDetailsLayouts ArrayList.contains O(L²) MEDIUM
- kylin-0002: AclPermissionUtil.transformAuthorities dedup ArrayList O(A²) MEDIUM
- pulsar-0006: PartialRoundRobinMessageRouterImpl CopyOnWriteArrayList.contains O(P²) MEDIUM
5 CLEAN markers: beam, samza, thrift, grpc, tinkerpop
2026-03-29 19:50:43 -04:00
e074f18ac7
python-ruby wave: cpython/mastodon defects + 8 CLEAN markers; count 668→671
...
cpython-0001: unittest.mock.reset_mock visited=[] O(N²) diamond traversal
mastodon-0001: OStatus Creation processed_account_ids Array#include? O(N²)
mastodon-0002: ActivityPub process_hashtag status.tags.include? O(N²) AR queries
CLEAN: dask, bottle, pyramid, alembic, dgl, synapse, dendrite, zulip
2026-03-29 19:50:42 -04:00
0ca0eed9f9
undf: assign UNDF-2026-000000055 to solang-0001, stamp patch
2026-03-29 19:50:40 -04:00
a7b08c7e05
blockchain-p2p: solang/tor/bitcoin/transmission/libtorrent/solc CWE-407 scan
...
solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM
src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan
for each event per function; fix: IndexSet (already a dependency) for O(1) dedup
tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan
Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue
Bitcoin: TxGraph/sets throughout, no linear scan in hot paths
Transmission: bitfields for piece tracking, sorted binary search for string table
libtorrent: sorted vectors with lower_bound, DHT uses binary search on results
solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph
2026-03-29 19:49:57 -04:00
a17b91d5c4
undf: stamp traefik-0001 (UNDF-2026-000000557) nats-server-0001 (UNDF-2026-000000179)
2026-03-29 19:47:48 -04:00
3bfe10d197
go-cluster: traefik-0001/nats-server-0001 CWE-407; grafana/consul/containerd/buildkit/helm/cayley CLEAN
...
traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)
2026-03-29 19:47:27 -04:00
339f2245ba
ktor/undertow: CLEAN markers (no CWE-407 defects found)
2026-03-29 19:34:44 -04:00
1a527783ae
undf: stamp tomcat-0001/0002 (UNDF-315/556); registry 600 assigned
2026-03-29 19:31:50 -04:00
cedcc9d5ee
tomcat-0001/0002: BeanSupportFull/Standalone populateFromInterfaces diamond O(2^D); count 666→668
2026-03-29 19:30:55 -04:00
8b8f7ee951
undf: stamp hazelcast-0002/0003 (UNDF-416/601); registry 601 assigned
2026-03-29 19:26:36 -04:00
1b0b3223b3
hazelcast-0002/0003: ClassLoaderUtil + ProbeUtils diamond O(2^D); count 664→666
2026-03-29 19:25:47 -04:00
db463c1b4e
undf: stamp hazelcast-0001 (UNDF-415); registry 600 assigned
2026-03-29 19:22:50 -04:00
4a6878e383
hazelcast-0001: SerializationUtil.getInterfaces diamond O(2^D) 52428x; count 663→664
2026-03-29 19:22:02 -04:00
8c4b291108
undf: stamp graal-0001/0002 (UNDF-599/600); registry 600 assigned
2026-03-29 19:18:05 -04:00
b5384cea54
graal-0001/0002: RegisterVerifier workList O(B²) + resolveMethod diamond O(2^D); count 661→663
2026-03-29 19:17:29 -04:00
52328b5720
undf: stamp eclipse-jdt-0001/0002 (UNDF-384/598); registry 598 assigned
2026-03-29 19:10:44 -04:00
565831bba0
eclipse-jdt-0001/0002: Scope typesToVisit O(N²) + TypeHierarchy missing superclass guard; count 659→661
2026-03-29 19:09:54 -04:00
55df582f19
undf: stamp dagger-0001/jackson-0001/0002 (UNDF-580/596/597); registry 597 assigned
2026-03-29 19:04:09 -04:00
e610b42a21
dagger-0001 + jackson-0001/0002: Deque.contains O(N×D) + two O(N²) type-hierarchy scans; count 656→659
2026-03-29 19:03:31 -04:00
7cb8abc236
undf: stamp hv-0001/0002 + typescript-0004 (UNDF-592–594); registry 594 assigned
2026-03-29 18:51:38 -04:00
347cb57f09
hv-0001/0002: DefaultValidationOrder groupList O(N²) 50x + addInheritedGroups diamond O(2^D) 52428x; count 654→656
2026-03-29 18:50:56 -04:00
31db695abc
typescript-0004: seenResolvedRefs Array O(N²) linear scan in project reference traversal; count 653→654
2026-03-29 18:43:59 -04:00
d4bb900583
claude: UNDF 591; 653 confirmed sites
2026-03-29 18:35:13 -04:00
651aaa7e7b
cleanup: remove duplicate hibernate-0007/quarkus-0003 patches; correct camel/rabbitmq UNDF stamps
2026-03-29 18:34:26 -04:00
919d3f2a57
crystal-0001: collect_ancestors O(2^D) diamond traversal; clojure/elixir/nim/lua CLEAN; count 621→622
2026-03-29 18:28:41 -04:00
bca10f42a3
liquibase-0001: fix patch correctness + add unit test (4/4 PASS)
...
- Corrected fix in patch: use persistent `seen` set (no backtrack remove)
so diamond shared-nodes are visited once, not 2^D times
- Previous patch used DFS path-stack (cycle guard) which did not prevent
the 2^D blowup for convergent diamonds
- Add unit test: chained-diamond D=12 shows 334× visit reduction (16381→49)
- Performance test: ArrayList→HashSet for evaluatedNodes gives 51× speedup at N=500
2026-03-29 18:25:38 -04:00
52a8d535a2
dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623
...
dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)
cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)
Struts, RabbitMQ, Camel: CLEAN
2026-03-29 18:23:19 -04:00
8cdb7bad0e
claude: UNDF 593; 650 confirmed sites
2026-03-29 18:19:20 -04:00
13b449d431
liquibase-0001: DependencyGraph.recursiveSizeDepth diamond O(2^D) + evaluatedNodes O(N²); count 649→650
2026-03-29 18:19:06 -04:00
78c77fc5fa
claude: UNDF count 588→592; MOAD 649 confirmed sites
2026-03-29 18:14:43 -04:00
9ef437a348
poetry-0001: show --tree packages_in_tree list O(N²) membership; UNDF-2026-000000575
...
ShowCommand._display_tree() uses a list for packages_in_tree, making every
`dep.name in current_tree` check O(N). For a project with 500 packages the
total membership-test cost is O(N²) ≈ 250,000 ops vs O(N) = 500 with a set.
Also fixes shared-state correctness bug: list is passed by reference causing
sibling branches to falsely report diamond dependencies as cycles.
Fix: set + per-branch set-union copy; 16-31x speedup measured.
CLEAN markers added for setuptools and celery (diamond recursion).
pip, django, poetry solver already CLEAN (prior or current scan).
2026-03-29 18:09:57 -04:00
6220414bb9
go-0002: cmd/compile expand1 O(2^D) diamond struct embedding; rustc diamond CLEAN; count 622→623
2026-03-29 18:07:11 -04:00
77242c9120
nestjs-0003: introspectDepsAttribute lookupRegistry string[] O(D²) includes+concat; count 645→646
2026-03-29 18:07:01 -04:00
ef603b54c4
weld-0003: MergedStereotypes.merge() O(2^D) diamond meta-stereotype; count 621→622
2026-03-29 18:04:32 -04:00
3ff514bbf3
claude: update UNDF count to 588
2026-03-29 18:03:09 -04:00
8de4c6f252
weld-0001/0002: CDI Beans.recursiveStereotypeSearch + addInheritedInterceptorBindings diamond O(2^D); count 643→645
2026-03-29 18:02:38 -04:00
bbb8ad5552
erlang-0004: edlin_type_suggestion print_type Visited list O(D²); count 642→643
2026-03-29 17:56:37 -04:00
36b07aa1f4
diamond-recursion deeper scan: CLEAN for pytorch/tensorflow/sklearn/ray/prefect/luigi/numpy
2026-03-29 17:53:36 -04:00
60cd7aa41c
claude: update UNDF count to 585
2026-03-29 17:52:28 -04:00
ca1eba749c
substrate-0003: npos-elections Node::root visited Vec O(D²); 436x speedup at D=300
2026-03-29 17:50:40 -04:00
00ac16dc1a
CLAUDE.md: UNDF count 578→584
2026-03-29 17:41:04 -04:00
5aebe2b542
starrocks-0002 + diamond tests: hibernate-0007/threejs-0007 unit tests PASS; starrocks-0002 LockManager O(D²) onStack scan; count 639→640
2026-03-29 17:26:27 -04:00
96b84c7a34
undf: assign UNDF-2026-000000484 to micronaut-0004, update registry
2026-03-29 17:22:04 -04:00
8a85da480d
micronaut-0004 + diamond-recursion CLEAN sweep: camel/hazelcast/tomcat/undertow/vertx/quarkus-0003 unit tests
...
micronaut-0004: AbstractAnnotationMetadataBuilder.processAnnotation O(2^D) diamond recursion
in meta-annotation stereotype traversal. isProcessed() guard tracks only current-path ancestors,
not globally visited nodes — diamond meta-annotation hierarchies cause exponential re-visits
of shared base annotations (e.g. @Transactional + @Retryable both extend @InterceptorBinding).
13x at D=8, 41x at D=10. 10/10 unit tests PASS.
quarkus-0003 unit tests: added to QuarkusTest.java for the existing quarkus-0003
BeanDeployment.recursiveBuild diamond defect. 9/9 PASS.
CLEAN markers: camel, hazelcast, tomcat, undertow, vertx — no diamond recursion pattern found.
Hazelcast uses proper Tarjan algorithm. Tomcat uses iterative constraint propagation.
2026-03-29 17:21:51 -04:00
29308bfe00
quarkus-0003: BeanDeployment.recursiveBuild transitive bindings diamond O(2^D); count 638→639
2026-03-29 17:14:17 -04:00
7af6b9c89f
threejs-0007: Node.traverse() diamond recursion O(2^D); CLEAN for webpack/valhalla/traefik/wasmer/wasmtime; count 621->622
...
UNDF-2026-000000468: three.js src/nodes/core/Node.js:351 traverse() recurses
without a visited set; on shared-node (diamond) TSL shader graphs yields 2^D
callback invocations. D=10 gives 4093× overhead. Fix: add optional visited Set
parameter, default new Set() at root call.
Unit test: 10/10 PASS (ThreeJSNodeTraverseTest.java)
CLEAN markers written for: webpack (visitedModules WeakSet throughout),
valhalla (Dijkstra+BFS, no recursive DAG traversal), traefik (traverse() has
proper visited map), wasmer (petgraph+BTreeMap), wasmtime (SCC algorithms).
2026-03-29 17:07:25 -04:00
