java-topology/defects/sklearn/sklearn-diamond-recursion-CLEAN.md

Diamond Recursion Scan (scikit-learn) — CLEAN

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

• sklearn/utils/graph.py:single_source_shortest_path_length — BFS with seen dict — CLEAN
• sklearn/pipeline.py — linear pipeline (no DAG) — CLEAN
• sklearn/tree/_reingold_tilford.py — tree (not DAG, no diamond possible) — CLEAN
• sklearn/cluster/_agglomerative.py:ward_tree — uses not_visited numpy array — CLEAN

Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing sklearn-0001