Handle conda cyclical deps and pip components, improve test coverage#1850
Open
ryanbrandenburg wants to merge 3 commits into
Open
Handle conda cyclical deps and pip components, improve test coverage#1850ryanbrandenburg wants to merge 3 commits into
ryanbrandenburg wants to merge 3 commits into
Conversation
ryanbrandenburg
commented
Jul 15, 2026
ryanbrandenburg
commented
Contributor
- Handle cyclical dependencies in Conda to prevent infinite recursion.
- Check the manager of a package to determin pip or conda rather than using heuristics.
- Improve test coverage for the CondaComponentDetector.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Conda lockfile detector and resolver to better handle real-world Conda environments by preventing infinite recursion on cyclical dependency graphs, classifying components as Pip vs Conda based on the lockfile’s manager field, and adding broader unit test coverage for these scenarios.
Changes:
- Add cycle protection and null-safe dependency enumeration in
CondaDependencyResolver. - Switch Pip-vs-Conda classification to depend solely on
package.manager(rather than python-dependency heuristics). - Expand
CondaLockComponentDetectortests to cover cycles, missing dependencies, mixed managers, dependency graph edges, malformed YAML, etc.
Show a summary per file
| File | Description |
|---|---|
| test/Microsoft.ComponentDetection.Detectors.Tests/CondaLockComponentDetectorTests.cs | Adds focused tests for cycles, manager-based typing, null dependencies, graph edges, malformed YAML, and file pattern matching. |
| src/Microsoft.ComponentDetection.Detectors/conda/CondaLockComponentDetector.cs | Bumps detector version to reflect updated behavior. |
| src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs | Adds visited-set cycle protection, handles missing dependencies, and changes Pip/Conda component determination logic. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 3
- Review effort level: Low
|
👋 Hi! It looks like you modified some files in the
If none of the above scenarios apply, feel free to ignore this comment 🙂 |
Comment on lines
139
to
+143
| private static TypedComponent CreateComponent(CondaPackage package) | ||
| => IsPythonPackage(package) | ||
| ? new PipComponent(package.Name, package.Version) | ||
| : new CondaComponent(package.Name, package.Version, null, package.Category, null, null, null, null); | ||
|
|
||
| /// <summary> | ||
| /// Checks if a package is a python package. | ||
| /// | ||
| /// If the package is either managed by pip, or if it depends on python | ||
| /// it is considered a python package. | ||
| /// </summary> | ||
| /// <param name="package">The CondaPackage.</param> | ||
| /// <returns>True if the package is a python package.</returns> | ||
| private static bool IsPythonPackage(CondaPackage package) | ||
| => package.Manager.Equals("pip", StringComparison.OrdinalIgnoreCase) || | ||
| package.Dependencies.Keys.Any(dependency => dependency.Equals("python", StringComparison.OrdinalIgnoreCase)); | ||
| { | ||
| return package.Manager.Equals("pip", StringComparison.OrdinalIgnoreCase) | ||
| ? new PipComponent(package.Name, package.Version) | ||
| : new CondaComponent(package.Name, package.Version, null, package.Category, null, null, null, null); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.