engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/tools/tickets/defects/cargo-0001.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.3 KiB
Raw Permalink Blame History

id repo severity status created patched patch
cargo-0001 cargo MEDIUM PATCHED 2026-03-23 2026-03-23 defects/cargo/patch/cargo-0001-print-stack-hashset.patch

Defect

File: src/cargo/ops/tree/mod.rs:343 Pattern: Vec::contains in cargo tree display output Complexity: O(n) per node (display only) Language: Rust

Description

The cargo tree command tracks which packages have already been displayed using Vec::contains to avoid duplicate output. Each call scans the entire vector of previously-displayed packages linearly. While this is display-only code and does not affect build correctness, for large dependency trees the O(n) per-node check makes cargo tree noticeably slow, with total display cost growing as O(n²) in the number of packages.

Fix

Replace: displayed.contains(&pkg_id) With: displayed_set.contains(&pkg_id) Data structure change: displayed: Vec<PackageId> → displayed_set: HashSet<PackageId>

Work required

  • Patch in defects/cargo/patch/
  • Unit test — asserts exact operation counts before/after (in defects/cargo/unit/)
  • Integration test (in defects/cargo/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/cargo/bench/)
  • White paper section