sklearn — CWE-407 scan result: CLEAN

Scanned: 2026-03-30

Scope

sklearn/utils/graph.py — single_source_shortest_path_length: uses seen = {} (dict), O(1) membership. CLEAN.
sklearn/pipeline.py — transformer_names = set(...), O(1) membership. CLEAN.
sklearn/feature_extraction/text.py — indices = set(vocabulary.values()), O(1). CLEAN.
sklearn/feature_extraction/_dict_vectorizer.py — vocab is a dict, O(1). CLEAN.
sklearn/externals/_arff.py — NominalConversor.values = set(values), O(1). CLEAN.
sklearn/compose/_column_transformer.py — transformer_names is a set. CLEAN.
sklearn/metrics/_classification.py — present_labels is numpy array; in on numpy is expected O(N) scan for small label sets, not a hot-path quadratic. CLEAN.

No CWE-407 defects found in scikit-learn 1.x.