engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/haystack/CLEAN.md
russell@unturf.com 95008feda5 llm-infra scan: litellm-0001 _delete_deployment combined_id_list O(R*C); haystack CLEAN 
litellm-0001: ProxyConfig._delete_deployment() checks model_id not in
combined_id_list (a plain Python list) for each router model ID during
config refresh. O(R*C) where R=router models, C=combined list. Fix:
convert to set before loop. MEDIUM severity, 6.5x at N=500. 1/1 PASS.

Haystack: no CWE-407 defects found. Uses dicts and sets throughout
for membership checks (scheduled_components set, storage dict, etc.).
2026-03-30 16:44:06 -04:00

840 B
Raw Blame History

Haystack - CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Target: https://github.com/deepset-ai/haystack (depth=1) Focus: pipeline component dedup, document store dedup, retriever result dedup, node connection membership

Findings

No CWE-407 defects found. The codebase uses appropriate data structures throughout:

  • Pipeline scheduler uses set() for scheduled_components (async_pipeline.py:214)
  • Breakpoint validation uses set() for component validation (breakpoint.py:97,100)
  • Document store uses dict for ID lookups (in_memory/document_store.py)
  • Embedding dedup uses dict for doc_ids_to_embeddings
  • Graph nodes/edges use NetworkX dict-based adjacency
  • model_names equivalent lookups use dict views

The deepset team has made good data structure choices. No linear-scan-in-loop patterns found on any hot path.