java-topology/defects/dask/CLEAN.md

Dask — CWE-407 Scan: CLEAN

Date: 2026-03-27 Target: dask/dask Files scanned:

• dask/order.py — task ordering algorithm
• dask/optimization.py — graph fusion, visited nodes
• dask/base.py — tokenization, key deduplication
• dask/_task_spec.py — task specification graph traversal
• dask/local.py — local scheduler

Verdict: CLEAN

All not in membership tests in hot graph traversal paths are against set, dict, or frozenset containers providing O(1) average membership:

• order.py:118 — k not in dependencies — dict
• order.py:246 — item not in external_keys — set
• order.py:374 — path[-2] not in result — dict
• optimization.py:62 — d not in seen — set
• optimization.py:156 — child not in unfusible — set
• optimization.py:215 — key not in fused — set
• optimization.py:349 — key not in output — set/dict
• optimization.py:577 — v not in rdeps — dict
• base.py:490 — tok not in repack_dsk — dict

No CWE-407 defects found.