# sklearn — CWE-407 deeper scan: no NEW defects (sklearn-0001 pre-existing)

Scanned: 2026-03-30

Pre-existing: sklearn-0001 (HistGradientBoosting `_check_categories` feature_names.index O(C×F))

## Deeper scan scope

- `sklearn/utils/graph.py` — `single_source_shortest_path_length`: uses `seen = {}` (dict), O(1). CLEAN.
- `sklearn/pipeline.py` — `transformer_names = set(...)`, O(1). CLEAN.
- `sklearn/feature_extraction/text.py` — `indices = set(vocabulary.values())`, O(1). CLEAN.
- `sklearn/feature_extraction/_dict_vectorizer.py` — `vocab` is a dict, O(1). CLEAN.
- `sklearn/externals/_arff.py` — `NominalConversor.values = set(values)`, O(1). CLEAN.
- `sklearn/compose/_column_transformer.py` — `transformer_names` is a set. CLEAN.
- `sklearn/metrics/_classification.py` — `present_labels` is numpy array; O(N) but bounded label set, not hot-path quadratic. CLEAN.
- `sklearn/feature_selection/` — no list-dedup patterns in hot paths. CLEAN.

No additional CWE-407 defects found beyond sklearn-0001.