perf: optimize get_all_nested_components with stack iteration

[saquibsaifee]

Description

💡 What: Replaced the recursive function with an iterative stack-based approach.
🎯 Why: To avoid intermediate set allocations and recursive call overhead which was impacting performance for deep component trees.
📊 Measured Improvement: Improved execution time from ~123 seconds to ~55 seconds for 100 iterations of a 6-deep, 4-broad component tree (a >50% improvement).

AI Tool Disclosure

• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Gemini Jules
  • LLMs and versions: Gemini 3.1 Pro

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[saquibsaifee]

The old recursive get_all_nested_components implementation suffered from performance and memory issues on deep/broad component trees because every step of the recursion would allocate a new set and call set.update() to merge sets from all child nodes upwards. These multiple allocations and merging operations cause high overhead.

By replacing the recursion with an iterative stack-based approach, we entirely avoid function call overhead and recursion limits (which protects against RecursionError in deeply nested graphs). We also avoid creating intermediate sets—everything is added directly to one single final set. Additionally, checking if current not in components: adds protection against cycles in the component graph (which would have caused infinite recursion in the old code).

As verified by tests, this retains the exact same functionality while delivering a significant (55% measured) performance boost and better safety guarantees.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #34341812 | 📁 Comparing c758f7e against latest (52cb3c9)

  🔍 Preview build  

2 files changed

± autoapi/cyclonedx/model/vulnerability/index.html
± autoapi/cyclonedx/contrib/vulnerability/cvss/index.html

[jkowalleck]

i see, the performance of the function is just bad, mostly due to the costly __hash__ implementation we cannot change right now (backwards compatibility, ...).

maybe this is even more performant:

def iter_all_nested_components(self, include_self: bool = False) -> Iterator['Component']:
    """
    Iterate over this component and all its nested components (assemblies), recursively.

    Components are deduplicated by object identity — NOT by equality.
    This never calls the (costly) ``Component.__hash__``/``__eq__``,
    which makes it dramatically faster than :func:`get_all_nested_components`
    for large component trees. Safe against cyclic component graphs.

    Order of iteration is not guaranteed.
    """
    seen: dict[int, 'Component'] = {}
    stack: list['Component'] = [self] if include_self else list(self.components)
    while stack:
        current = stack.pop()
        current_id = id(current)
        if current_id not in seen:
            seen[current_id] = current
            stack.extend(current.components)
    return iter(seen.values())

def get_all_nested_components(self, include_self: bool = False) -> set['Component']:
    return set(self.iter_all_nested_components(include_self=include_self))

and then, lets replace all aplicable internal calls on get_all_nested_components() with iter_all_nested_components()

What do you think, @saquibsaifee ?

[jkowalleck]

see #1039 (comment)