Skip to content

Python: FastAPI Depends() not tracked, causes false dead code positives #27

@RyanKim17920

Description

@RyanKim17920

Bug

Functions used via FastAPI's Depends() show in_degree=0 and appear as dead code, despite being called on every request.

Root Cause

async def endpoint(user: UserSchema = Depends(get_current_user)):
    ...

get_current_user is passed as a reference, not called directly. No CALLS or USAGE edge is created, so it looks uncalled.

Confirmed False Positives (FastAPI project)

  • get_current_user — used via Depends() in every protected route
  • get_current_user_optional — same, 4 routers
  • All dependencies.py factory functions (get_paper_action_service, get_user_service, etc.)

Suggested Fix

Detect Depends(func_ref) in parameter default values via tree-sitter and emit a USAGE edge from the handler to func_ref.

Impact

High — marks live auth functions as dead code, risking incorrect deletion.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions