Properly handle recursive dependencies in conda lockfiles

[Jason Paulos (jasonpaulos)]

Fixes a bug where circular dependencies in a conda lockfile would cause a stack overflow, since there were no guards against indefinite recursion.

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[Copilot]

Pull request overview

This PR fixes a conda-lock detector bug where cyclic (circular) dependencies could trigger unbounded recursion and ultimately a stack overflow. It does this by adding cycle detection to the conda dependency traversal while preserving cyclic edges in the recorded dependency graph.

Changes:

• Add a recursion-path guard (HashSet<string> currentPath) to stop re-traversing cycles during dependency registration.
• Add a unit test that validates circular dependencies complete successfully and that both dependency edges are retained in the graph.

Show a summary per file

File	Description
test/Microsoft.ComponentDetection.Detectors.Tests/CondaLockComponentDetectorTests.cs	Adds a regression test covering a simple python ↔ pip cycle and asserts the resulting graph contains both edges without overflowing.
src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs	Introduces a per-traversal path set to prevent infinite recursion when conda-lock packages form cycles.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite