crowdsecurity/crowdsec · error

circular dependency detected: %s depends on %s

Error message

circular dependency detected: %s depends on %s

What it means

When expanding an item's dependency tree (collectSubItems), the traversal detects that a sub-item's dependency chain loops back to the item being expanded. Since collections can include other collections, a cycle would recurse forever, so it's reported as an error naming the two items involved.

Source

Thrown at pkg/cwhub/item.go:351

// descendants returns a list of all (direct or indirect) dependencies of the item's current version.
func (i *Item) descendants() ([]*Item, error) {
	var collectSubItems func(item *Item, visited map[*Item]bool, result *[]*Item) error

	collectSubItems = func(item *Item, visited map[*Item]bool, result *[]*Item) error {
		if item == nil {
			return nil
		}

		if visited[item] {
			return nil
		}

		visited[item] = true

		for subItem := range item.CurrentDependencies().SubItems(item.hub) {
			if subItem == i {
				return fmt.Errorf("circular dependency detected: %s depends on %s", item.Name, i.Name)
			}

			*result = append(*result, subItem)

			err := collectSubItems(subItem, visited, result)
			if err != nil {
				return err
			}
		}

		return nil
	}

	ret := []*Item{}
	visited := map[*Item]bool{}

	err := collectSubItems(i, visited, &ret)
	if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Remove the self-referencing include from the collection YAML
2. Redesign the dependency so the cycle is broken (split into two collections)
3. Check `cscli hub list --all` / dependency output to trace which item re-includes which

Example fix

// before (collections/my-collection.yaml)
include:
  - my-collection   # circular
// after
include:
  - crowdsecurity/ssh-bf
  - crowdsecurity/http-cve

deps, err := item.SubItems() // or the collect API in use
if err != nil {
    if strings.Contains(err.Error(), "circular dependency") {
        return fmt.Errorf("fix collection YAML: %w", err)
    }
    return err
}

When it happens

Trigger: Creating a collection that (transitively) includes itself — e.g. collection A includes collection B which includes A; hit while computing dependencies/sub-items for install, taint, or upgrade operations.

Common situations: Authoring a custom collection YAML that re-includes its own name; editing a hub collection locally to reference itself; merging collection definitions incorrectly.

Related errors

• no appsec_config provided
• no hub configuration provided
• too many levels of symbolic links
• no parser found. Please install the appropriate parser and r
• ErrUserCanceled

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2f90828e16e5ce68. Report an issue: GitHub.