Fixes #8924

Problem

sbt 1.12.6+ (and sbt 2.x with Coursier 2.1.25-M24) hangs indefinitely on update for projects using addSbtPlugin("com.typesafe.sbt" % "sbt-site" % "1.4.1"). The JVM stays in a tight loop; Ctrl+C often does not stop it (see #8917).

Root Cause

After resolution succeeds, SbtUpdateReport calls coursier.graph.Conflict(resolution), which builds DependencyTree nodes. Each node’s relocation helper follows Maven/Gradle relocation metadata with tail recursion but no cycle detection. For sbt-site’s graph, relocation chains revisit the same coordinates, so relocation never terminates (coursier#3578).

Solution

Add RelocationCycleDetector, which performs the same single relocation step as Coursier’s DependencyTree.Node.relocation and walks the implied graph. If any relocation chain would revisit a node, we skip coursier.graph.Conflict for affected configurations (resolution and artifacts are unchanged). One warning per update lists affected configuration names.

Alternatives considered: (1) bump Coursier to an unreleased fixed version — not available on Maven Central; (2) timeout around Conflict — nondeterministic and hides real errors; (3) vendor patched DependencyTree — would not affect Conflict in the coursier JAR (same-artifact linkage).

Testing

• RelocationCycleDetectorSpec: incomplete resolution is not flagged as cyclic.
• ResolutionSpec property resolve sbt-site 1.4.1 (sbt sbt 1.12.6 gets stuck trying to resolve sbt-site 1.4.1 #8917): same resolution path as the reported bug; completes in bounded time with a non-empty classpath.

Verify:

./sbt "lmCoursier/testOnly lmcoursier.ResolutionSpec -- -z \"sbt-site\""
./sbt lmCoursier/test

Before / After

• Before: update on sbt-site never finishes (infinite relocation expansion inside Conflict).
• After: Update completes; classpath is correct; users may see one warning and slightly less eviction detail for configs with cyclic relocations.

Edge Cases Handled

• Gradle + Maven relocation: same branches as Coursier’s relocation.
• Only when resolution is done and clean: same guard as Coursier before applying relocations in DependencyTree.
• Per-configuration: only configs whose graph contains a relocation cycle skip conflict extraction.
• missingOk: existing try/catch unchanged.