java-topology/defects/prefect/prefect-diamond-recursion-CLEAN.md

Diamond Recursion Scan (prefect) — CLEAN (deeper scan)

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

• src/prefect/cli/transfer/_dag.py:TransferDAG — proper Kahn's algorithm, visited: set[uuid.UUID] — CLEAN
• src/prefect/cli/transfer/_dag.py:has_cycles — three-color DFS with color dict — CLEAN
• src/prefect/utilities/collections.py:visit_collection — tree-walker, not DAG — CLEAN

Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing pre-0001..0002