## Diamond Recursion Scan — CLEAN

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `src/main/java/com/google/devtools/build/lib/analysis/` — dependency graph construction
- `src/main/java/com/google/devtools/build/lib/packages/` — rule/target definitions
- `src/main/java/com/google/devtools/build/skyframe/SimpleCycleDetector.java` — Skyframe cycle detection
- `src/main/java/com/google/devtools/build/lib/bazel/bzlmod/modcommand/ModExecutor.java` — module dependency traversal

### Findings

All cycle/reachability checks in Bazel use proper visited-set patterns:

1. **Skyframe** — uses incremental evaluation with memoized SkyValues; graph traversal is work-queue-based, not recursive.

2. **ModExecutor.notCycle** — uses `parentStack` (HashSet), push/pop per DFS recursion level. This correctly tracks ancestors, preventing cycles and diamond re-visits via the ancestor set.

3. **SimpleCycleDetector** — iterative algorithm with explicit sets.

4. **ConfiguredRuleClassProvider.dependencyGraph** — uses `Digraph.getTopologicalOrder()` which is a proper topo-sort (no recursive cycle check).

### Verdict: CLEAN — no diamond recursion CWE-407 found