engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/tools/tickets/defects/maven-0003.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.3 KiB
Raw Permalink Blame History

id repo severity status created
maven-0003 maven LOW PATCHED 2026-03-23

Defect

File: maven-core/src/main/java/org/apache/maven/project/Graph.java:102 Pattern: LinkedList.lastIndexOf in cycle reporter Complexity: O(n) in error path only Language: Java

Description

The cycle reporter in Maven's project graph uses LinkedList.lastIndexOf to locate the start of a detected cycle for error message construction. lastIndexOf performs a full reverse linear scan. This code is only executed when a dependency cycle is actually detected, which is an error condition — not the normal build path. The O(n) scan has no impact on successful builds and only affects error reporting performance, which is not latency-sensitive.

Fix

Replace: cycleList.lastIndexOf(artifact) With: index lookup via an artifactIndexMap Data structure change: LinkedList<Artifact> cycle → LinkedList<Artifact> cycle + HashMap<Artifact, Integer> lastIndex

Work required

  • Patch in defects/maven/patch/
  • Unit test — asserts exact operation counts before/after (in defects/maven/unit/)
  • Integration test (in defects/maven/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/maven/bench/)
  • White paper section