java-topology/defects/sklearn/patch/CLEAN.md

sklearn — CWE-407 deeper scan: no NEW defects (sklearn-0001 pre-existing)

Scanned: 2026-03-30

Pre-existing: sklearn-0001 (HistGradientBoosting _check_categories feature_names.index O(C×F))

Deeper scan scope

• sklearn/utils/graph.py — single_source_shortest_path_length: uses seen = {} (dict), O(1). CLEAN.
• sklearn/pipeline.py — transformer_names = set(...), O(1). CLEAN.
• sklearn/feature_extraction/text.py — indices = set(vocabulary.values()), O(1). CLEAN.
• sklearn/feature_extraction/_dict_vectorizer.py — vocab is a dict, O(1). CLEAN.
• sklearn/externals/_arff.py — NominalConversor.values = set(values), O(1). CLEAN.
• sklearn/compose/_column_transformer.py — transformer_names is a set. CLEAN.
• sklearn/metrics/_classification.py — present_labels is numpy array; O(N) but bounded label set, not hot-path quadratic. CLEAN.
• sklearn/feature_selection/ — no list-dedup patterns in hot paths. CLEAN.

No additional CWE-407 defects found beyond sklearn-0001.