# CLEAN — Hibernate ORM
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

## Scope
hibernate-core/src/main/java — SqmUtil, ActionQueue, BulkOperationCleanupAction,
LoadQueryInfluencers, StatefulPersistenceContext, ToOneAttributeMapping,
ManyToManyCollectionPart, BaseSqmToSqlAstConverter, GeneratedValuesProcessor.

## Findings

### ActionQueue — tableSpaces.contains()
Parameter `Set<? extends Serializable> tableSpaces` — O(1). Clean.

### BulkOperationCleanupAction — affectedTableSpaces.contains()
Parameter is `Set<?>` — O(1). Clean.

### LoadQueryInfluencers — enabledFetchProfileNames.contains()
`enabledFetchProfileNames` is `HashSet<String>` — O(1). Clean.

### ToOneAttributeMapping — targetKeyPropertyNames.contains()
`targetKeyPropertyNames` is `Set<String>` backed by `HashSet` — O(1). Clean.

### StatefulPersistenceContext — nullAssociations.contains(), insertedEntityIds.contains()
Both backed by `HashSet` implementations — O(1). Clean.

### BaseSqmToSqlAstConverter — visitedAssociationKeys.contains(), excludedEntityNames.contains()
Both are `Set` or `HashSet` fields — O(1). Clean.

## Result
**CLEAN. No actionable CWE-407 defects found in Hibernate ORM.**