Python: FastAPI Depends() not tracked, causes false dead code positives

[RyanKim17920]

Bug

Functions used via FastAPI's Depends() show in_degree=0 and appear as dead code, despite being called on every request.

Root Cause

async def endpoint(user: UserSchema = Depends(get_current_user)):
    ...

get_current_user is passed as a reference, not called directly. No CALLS or USAGE edge is created, so it looks uncalled.

Confirmed False Positives (FastAPI project)

• get_current_user — used via Depends() in every protected route
• get_current_user_optional — same, 4 routers
• All dependencies.py factory functions (get_paper_action_service, get_user_service, etc.)

Suggested Fix

Detect Depends(func_ref) in parameter default values via tree-sitter and emit a USAGE edge from the handler to func_ref.

Impact

High — marks live auth functions as dead code, risking incorrect deletion.

[DeusData]

Hey, thanks for the issue. Currently working on embedding semantic knowledge more accurately into the graph by emulating LSP logic. This will come soon also for python, I guess earliest beginning of next week. Hopefully you can wait until then :/

[kingchenc]

This also looks like it could be a focused fix.

When FastAPI uses Depends(get_current_user) in a function parameter default, the function get_current_user is passed as a reference, not called directly.

The current pipeline recognizes the call to Depends itself but does not create a USAGE edge for the function reference passed as its argument. This means get_current_user ends up with zero incoming connections and gets flagged as dead code.

A possible fix would be to add special handling in the pipeline (likely in usages.go or during the call extraction phase) that detects when a call node has the name Depends and then emits a USAGE edge for the first argument, linking it to the referenced function.

This is similar to how decorator detection already works in pipeline.go where frameworkDecoratorPrefixes are checked to prevent false dead code reports for route handlers.

Again, no guarantee this covers every edge case. There might be more complex patterns like Depends(partial(some_func, arg)) or nested dependencies that would need additional handling.

But for the common Depends(func_ref) pattern this should resolve the false dead code detection.

[kingchenc]

Fixed in PR #66.

Added extractPythonDependsEdges() in the call resolution pass. It scans Python function signatures for Depends(func_ref) patterns and emits CALLS edges with resolution_strategy: "fastapi_depends".

Also handles import aliases (from X import Y as Z) — if the initial resolve fails, the original function name is extracted from the import path and retried.

Tested on a real FastAPI project: 392 Depends edges across 39 router files. Functions like require_admin went from in_degree: 64 → 180, get_tenant_id similarly. No false dead-code positives for dependency-injected functions.