[stairlane]

We analyze firmware and binaries, amongst other things at my day job.

Reconstructing dependency graphs is a necessary part of our day to day.

Assuming dependency graphs cant have cycles has shot us in the foot. There are absolutely real circular dependencies in assets in the wild.

[LarsDu88]

Original author here... wait, what?

I believe pip (or at least older versions of pip) makes it possible to have cycles. Are you analyzing dep graphs made with older versions of pip?

[stairlane]

Not pip, but we ran into an older version of glibc that had real circular deps. Sorry I don’t remember off the top of my head which one.