russell@unturf.com
db29a08762
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
1.4 KiB
| id | repo | severity | status | created |
|---|---|---|---|---|
| npm-0001 | npm/arborist | HIGH | NOT-A-DEFECT | 2026-03-23 |
Defect
File: lib/build-ideal-tree.js:63
Pattern: Array.includes() in DepsQueue membership check
Complexity: O(K²)
Language: JavaScript
Description
The DepsQueue used during ideal tree construction checks whether a dependency is already queued using Array.includes() before enqueuing it. This linear scan is performed for every dependency encountered during tree building. With K total enqueue attempts, each scanning up to K existing entries, the total membership-check cost is O(K²) for projects with many dependencies.
Fix
Replace: queue.includes(dep)
With: queueSet.has(dep)
Data structure change: queue: Array → queue: Array + queueSet: Set
Work required
- Patch in
defects/npm/patch/ - Unit test — asserts exact operation counts before/after (in
defects/npm/unit/) - Integration test (in
defects/npm/integration/) - Benchmark — before/after on V=100,200,400,800 (in
defects/npm/bench/) - White paper section
VERDICT: NOT-A-DEFECT (2026-03-23)
Current code uses this[_depsSeen] = new Set() — O(1) has()/add() membership.
The _depsQueue is a plain array used for ordering (sorted by depth) but
deduplication is via _depsSeen.has(). The defect does not exist in current code.
_updateNames.includes() (3 calls) is for a user-supplied list, typically 1-5 items.