Handling Dependencies Used Indirectly via Frameworks

[ben-sandham]

I’m trying out Deptry to find unused, missing and transitive dependencies in a project for a FastAPI app. Deptry flags uvicorn with DEP002:

pyproject.toml: DEP002 'uvicorn' defined as a dependency but not used in the codebase

I invoke uvicorn in my application with subprocess.run(), so while there is not a direct import of the library it is certainly required by fastapi as evidenced by part of the poetry show --tree output.

poetry show --tree

uvicorn listed in the dependency tree for the fastapi dependency specified in my pyproject.toml.

fastapi 0.100.1 FastAPI framework, high performance, easy to learn, fast to code, ready for production
├── email-validator >=2.0.0
│   ├── dnspython >=2.0.0
│   └── idna >=2.0.0
├── httpx >=0.23.0
│   ├── anyio *
│   │   ├── idna >=2.8
│   │   └── sniffio >=1.1
│   ├── certifi *
│   ├── httpcore ==1.*
│   │   ├── certifi * (circular dependency aborted here)
│   │   └── h11 >=0.13,<0.15
│   ├── idna * (circular dependency aborted here)
│   └── sniffio * (circular dependency aborted here)
├── itsdangerous >=1.1.0
├── jinja2 >=2.11.2
│   └── markupsafe >=2.0
├── orjson >=3.2.1
├── pydantic >=1.7.4,<1.8 || >1.8,<1.8.1 || >1.8.1,<2.0.0 || >2.0.0,<2.0.1 || >2.0.1,<3.0.0
│   ├── annotated-types >=0.4.0
│   ├── pydantic-core 2.16.2
│   │   └── typing-extensions >=4.6.0,<4.7.0 || >4.7.0
│   └── typing-extensions >=4.6.1 (circular dependency aborted here)
├── pydantic-extra-types >=2.0.0
│   └── pydantic >=2.5.2
│       ├── annotated-types >=0.4.0
│       ├── pydantic-core 2.16.2
│       │   └── typing-extensions >=4.6.0,<4.7.0 || >4.7.0
│       └── typing-extensions >=4.6.1 (circular dependency aborted here)
├── pydantic-settings >=2.0.0
│   ├── pydantic >=2.3.0
│   │   ├── annotated-types >=0.4.0
│   │   ├── pydantic-core 2.16.2
│   │   │   └── typing-extensions >=4.6.0,<4.7.0 || >4.7.0
│   │   └── typing-extensions >=4.6.1 (circular dependency aborted here)
│   └── python-dotenv >=0.21.0
├── python-multipart >=0.0.5
├── pyyaml >=5.3.1
├── starlette >=0.27.0,<0.28.0
│   └── anyio >=3.4.0,<5
│       ├── idna >=2.8
│       └── sniffio >=1.1
├── typing-extensions >=4.5.0
├── ujson >=4.0.1,<4.0.2 || >4.0.2,<4.1.0 || >4.1.0,<4.2.0 || >4.2.0,<4.3.0 || >4.3.0,<5.0.0 || >5.0.0,<5.1.0 || >5.1.0
└── uvicorn >=0.12.0
    ├── click >=7.0
    │   └── colorama *
    ├── colorama >=0.4 (circular dependency aborted here)
    ├── h11 >=0.8
    ├── httptools >=0.5.0
    ├── python-dotenv >=0.13
    ├── pyyaml >=5.1
    ├── uvloop >=0.14.0,<0.15.0 || >0.15.0,<0.15.1 || >0.15.1
    ├── watchfiles >=0.13
    │   └── anyio >=3.0.0
    │       ├── idna >=2.8
    │       └── sniffio >=1.1
    └── websockets >=10.4

Some solutions to this would be:

1. Import uvicorn in my entrypoint.py module. This will fail ruff linting check unless adding # noqa: F401.
2. Ignore DEP002 in [tool.deptry] configs.
3. Change my entrypoint.py module to directly use uvicorn module and its commands.

Is deptry not parsing the poetry dependency tree at all in order to consider project dependencies?

[fpgmaas]

Thanks for raising this, it is an interesting point. deptry looks for imports in your codebase to determine which libraries are actually used. In this case, as you correctly notice deptry considers uvicorn as not used since it is not imported.

Scanning the dependency tree would not solve this; If my project has A as a transitive dependency because it is required by B, that does not imply that I should have A also in my list of dependencies. Only when I actively use A should I also list it in my project's dependencies. In your situation the latter is the case, but since for deptry 'actively use' is synonymous to 'import' it fails to pick this up.

In this case, I think the most sensible solution would be either to remove uvicorn from your list of dependencies (which is not ideal; what if fastapi drops the dependency on uvicorn?) or to add the following to your pyproject.toml:

[tool.deptry.per_rule_ignores]
DEP002 = ["uvicorn"]

Hope this helps. Let me know if you have any other thoughts!