engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/tools/tickets/defects/npm-0002.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.1 KiB
Raw Blame History

id repo severity status created
npm-0002 npm/arborist MEDIUM PATCHED 2026-03-23

Defect

File: lib/can-place-dep.js:370 Pattern: peerPath.includes() array in peer dependency placement Complexity: O(depth²) Language: JavaScript

Description

Peer dependency placement validation uses peerPath.includes() to check whether a package is already in the current peer dependency resolution path. Array.includes performs a linear scan. The check is performed at each level of recursive peer resolution, and with resolution depth growing proportionally to the dependency tree depth, the total cost across all checks is O(depth²).

Fix

Replace: peerPath.includes(dep) With: peerPathSet.has(dep) Data structure change: peerPath: Array → peerPath: Array + peerPathSet: Set

Work required

  • Patch in defects/npm/patch/
  • Unit test — asserts exact operation counts before/after (in defects/npm/unit/)
  • Integration test (in defects/npm/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/npm/bench/)
  • White paper section