[saquibsaifee]

Description

Optimizes Bom.validate() from $O(N^2)$ to $O(N \log N)$ by eliminating redundant linear scans over self.dependencies when ensuring dependable elements are registered, directly adding missing entries while tracking seen references in $O(1)$.

Changes:

• Track existing dependency references dynamically to skip redundant registration for already-registered components and services.
• Directly add missing dependable entries to _dependencies with active set tracking, eliminating repeated linear filter scans over the dependency collection.
• Clean up collection comprehensions in dependency graph validation.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[saquibsaifee]

During the generation of large SBOMs, validation times were high due to generator evaluation.
With this change, the Bom.validate() running time on an SBOM with 2500 nested components and 2500 services executed 10 times drops from 49.4 seconds down to 5.1 seconds. This yields a 10x execution speedup in terms of validation execution alone.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 7 complexity · 0 duplication

Metric	Results
Complexity	7
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #35711380 | 📁 Comparing 1bc318d against latest (52cb3c9)

  🔍 Preview build  

8 files changed · ± 8 modified

± Modified

• changelog.html
• genindex.html
• autoapi/cyclonedx/spdx/index.html
• autoapi/cyclonedx/builder/this/index.html
• autoapi/cyclonedx/model/component/index.html
• autoapi/cyclonedx/model/vulnerability/index.html
• autoapi/cyclonedx/contrib/this/builders/index.html
• autoapi/cyclonedx/contrib/vulnerability/cvss/index.html

[saquibsaifee]

@jkowalleck can you take a look at this PR to boost SBOM generation turn around

[saquibsaifee]

Need to look into this again, might not be adding any performance improvement at all

[saquibsaifee]

@jkowalleck, this PR is ready for review.

[kmlyz]

Heads up that this overlaps with #1006 and open PR #1007, which addresses the same Bom.validate() -> register_dependency() linear scan.

I tested both branches locally against current main (Python 3.13, test_model_bom and JSON/XML v1.6 serialization). Both produce identical serialized output and reduce BomRef.__eq__ calls during validate() at N = 4000 from 8,051,885 to 49,884.

One code note if this branch moves forward: reading self._dependencies directly in Step 0 avoids going through the property getter, and keeping Step 1's set(chain(...)) avoids the extra per-iteration .add() / .update() overhead of the Python for loop (162 ms vs 176 ms in validate() at N = 4000). test_validate_registers_dependencies_for_components_and_services here is a nice addition though, since it explicitly covers shared bom_ref deduplication across Component and Service.

Disclosure: Local container test runs and benchmark comparisons were assisted by Google Antigravity (Gemini 4 Carbon); commands and outputs were verified locally.