# sqlalchemy diamond recursion scan — CLEAN

Scanned: 2026-03-29
Scope: diamond recursion / CWE-407 in topological sort

## Files checked

- `lib/sqlalchemy/util/topological.py:sort_as_subsets()` — Kahn's algorithm using
  `todo_set` (a `set`) and `edges` (a `defaultdict(set)`). `todo_set.isdisjoint(edges[node])`
  is O(min(|todo_set|, |edges[node]|)) using set intersection. Clean.
- `lib/sqlalchemy/util/topological.py:find_cycles()` — iterative DFS using a stack
  and `todo` set; no recursion, no unbounded revisits. Clean.
- `lib/sqlalchemy/orm/dependency.py` — delegates to topological module above. Clean.

## Verdict

CLEAN. Topological sort is iterative Kahn's algorithm with set-based membership
throughout. `find_cycles` is an iterative DFS with a proper todo set.