Skip to content

Guard against pathologically connected dependency graphs #13424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

iamsrp-deshaw
Copy link

When determining the install order for dependencies the code does a DFS of the dependency graph, if it finds dependency cycle.

However, should the graph be pathologically connected, then this walk can take a log time, being exponential in nature. To mitigate this we limit the number of times any particular node may be visited during the walk. This should have little or no impact for well behaved graphs, while still yielding a fair approximation of a good installation order for densely connected graphs.

This is a less invasive version of #13416.

iamsrp-deshaw and others added 2 commits June 9, 2025 20:57
Since the DFS of the dependency graph is brute force it is exponential in the
number of children. If a graph is pathological in nature (i.e. many
cross-dependencies) then this will not complete in "reasonable" time. To address
this we limit the number of visits to any node in the graph, thus capping the
complexity to be linear in nature.
@notatallshaw
Copy link
Member

Again, thanks for contributing, as before, please bear in mind it might take some time for a maintainer to review this as we are all volunteers. But once I do get a chance I was going to test a few real world scenarios from simple to massive.

If you need any assistance passing the pre-commit or CI let me know.

Minor formatting fix.
Added changelog entry.
@iamsrp-deshaw
Copy link
Author

Sure thing. I fixed the pre-merge checks, very simple.

And in your own time. I am not blocked on this or anything so you can handle it as and when you deem fit. I have a day-job too, and also maintain some OSS, so I know the score.

And, since I don't know if folks say this enough: Thanks for being a pip maintainer!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants