Handle circular dependencies - #1858
Closed
Ryan Brandenburg (ryanbrandenburg) wants to merge 1 commit into
Closed
Conversation
Ryan Brandenburg (ryanbrandenburg)
requested a review
from a team
as a code owner
August 19, 2026 21:08
Ryan Brandenburg (ryanbrandenburg)
requested a review
from Brett V. Forsgren (brettfo)
August 19, 2026 21:08
|
👋 Hi! It looks like you modified some files in the
If none of the above scenarios apply, feel free to ignore this comment 🙂 |
Contributor
Author
|
Closing this in favor of #1857 (review) |
Copilot started reviewing on behalf of
Ryan Brandenburg (ryanbrandenburg)
August 19, 2026 21:10
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the Conda lock dependency graph construction against circular dependency chains (e.g., A→B→A) to prevent unbounded recursion and stack overflows during detection.
Changes:
- Add a visited set to stop recursive dependency traversal from looping indefinitely in
CondaDependencyResolver. - Add a unit test covering a minimal circular dependency case in a
conda-lock.ymlinput.
Show a summary per file
| File | Description |
|---|---|
| test/Microsoft.ComponentDetection.Detectors.Tests/CondaLockComponentDetectorTests.cs | Adds a regression test verifying circular dependencies are recorded without crashing. |
| src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs | Introduces visited-package tracking to prevent recursion loops while building the dependency graph. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+84
to
+87
| if (!visitedPackages.Add((package.Name, package.Version))) | ||
| { | ||
| return; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As-is it's possible to get stuck in a look when A->B->A (Or A->B->C->A, etc) which eventually causes a stack-overflow. This PR adds a set to keep track of visited packages so we can be sure we never end up in a loop. Before the fix the unit test I added would crash the test-host. I also checked the fix against the real-world report which alerted me to this issue.