russell@unturf.com
db29a08762
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
1.2 KiB
1.2 KiB
| id | repo | severity | status | created |
|---|---|---|---|---|
| distlib-0001 | distlib | MEDIUM | PATCHED | 2026-03-23 |
Defect
File: distlib/util.py:1180,1204
Pattern: stack = [] then successor in stack in Tarjan SCC strong_connections property
Complexity: O(V²)
Language: Python
Description
distlib's strong_connections property implements Tarjan's SCC algorithm but uses a plain Python list as the DFS stack and tests membership with successor in stack. This linear membership test is performed for every edge explored during the SCC traversal. Since distlib is bundled with pip (version 0.3.8) and available standalone (0.4.0), this defect affects pip's dependency resolution in all current Python installations.
Fix
Replace: successor in stack
With: successor in on_stack
Data structure change: stack: list → stack: list + on_stack: set
Work required
- Patch in
defects/distlib/patch/distlib-0001-stack-set.patch` - Unit test — asserts exact operation counts before/after (in
defects/distlib/unit/) - Integration test (in
defects/distlib/integration/) - Benchmark — before/after on V=100,200,400,800 (in
defects/distlib/bench/) - White paper section