java-topology/defects/beam/patch/beam-CLEAN.md

UNDF: UNDF-2026-000000353

beam — CLEAN

Scanned:

• sdks/java/core — transforms, values, construction graph, PipelineValidator
• runners/core-java — SimplePushbackSideInputDoFnRunner, SideInputHandler, WatermarkManager, TimerUpdate
• runners/direct-java — KeyedPValueTrackingVisitor, EvaluationContext, SideInputContainer, DirectRunner
• runners/flink — FlinkRunner, SideInputInitializer, FlinkStateInternals
• runners/spark — SparkSideInputReader, CachedSideInputReader
• runners/google-cloud-dataflow-java — DataflowRunner (experiments List.contains — but O(4) fixed-length, not a loop)
• sdks/python/apache_beam/transforms/ — Python transforms

All contains() calls in hot paths use HashSet, ImmutableSet, or operate on trivially small fixed-length lists (experiment flags, ~4 items). No CWE-407 defects found.