---
id: scan/minecraft-server
repo: Mojang/minecraft-java-edition
version: 26.1 (server-26.1.jar, extracted from server.jar bundler)
scanned: 2026-03-24
source: ~/Downloads/server.jar (bundler) → META-INF/versions/26.1/server-26.1.jar
method: CFR decompiler + bytecode string scan for List/contains patterns
---

## Summary

7,351 classes scanned. 2 confirmed defects. Core graph utilities are CLEAN.

## Confirmed defects

| ID | Class | Pattern | Severity |
|----|-------|---------|----------|
| minecraft-0001 | `util/DependencySorter.isCyclic` | Recursive DFS with no visited set — exponential on diamond dependency graphs | HIGH |
| minecraft-0002 | `world/level/block/piston/PistonStructureResolver` | `List<BlockPos>.contains()` in push chain loop | LOW (bounded at 12) |

## Confirmed CLEAN

| Class | Why clean |
|-------|-----------|
| `util/Graph.depthFirstSearch` | Uses `Set<T>` for both `discovered` and `currentlyVisiting` — O(1) contains |
| `util/FeatureSorter` | Uses `TreeSet` for visited/onStack — O(log n), deliberate for deterministic ordering |
| `util/DependencySorter.visitDependenciesAndElement` | Uses `HashSet alreadyVisited` — O(1) |
| `world/level/lighting/DynamicGraphMinFixedPoint` | No list containers in bytecode |
| `world/level/chunk/status/ChunkDependencies` | No list containers in bytecode |

## Notes

- Minecraft Java Edition is NOT open source. Analysis is from decompiled bytecode.
- CFR decompiler used (cfr-0.152.jar).
- Obfuscated field/method names are NOT remapped (no mappings applied). Class names
  are unobfuscated in recent versions (Mojang releases class name mappings).
- Disclosure path: bugs.mojang.com (public bug tracker).

## minecraft-0001 detail

`DependencySorter.isCyclic` performs a recursive DFS to check if adding an edge
would create a cycle. No `visited` set. For a diamond graph of depth D, node count
is 2^D. Called from `TagLoader` — runs on every world load and `/reload`.

Large modpacks (Create, Applied Energistics 2, Mekanism, Thermal Expansion) with
thousands of cross-mod tag dependencies hit this on every server start. The "tag
loading lag" reported by modpack server operators is consistent with this behavior.

## Broader scan note

34 classes had the `ArrayList + contains` bytecode signature. Most are either:
- Bounded inputs (piston: max 12, pack selection: tens of packs)
- Non-hot paths (advancement layout, crash report categories)
- Using `contains` on a `HolderSet` (Minecraft's own set wrapper, likely O(1))

The DependencySorter defect is the only site where unbounded graph traversal
occurs without visited tracking.