FastAPI dependency injection being detected as typing.Union, python:S6546

Rules and Languages Report False-positive / False-negative...
, ,
1

Version: Developer Edition v2026.1.6 (131977)

Annotated type hinting for FastAPI dependency injection is being flagged as a typing.Union:


AuthDep = Depends(some_auth_func)


def update_event(
    event_data: EventUpdate,
    current_user: Annotated[UserClass, AuthDep],  # This passes
    current_event: Annotated[EventA | EventB, Depends(get_event_by_id)],  # triggers S6546
):
    ...

The current_user type hint passes the check, even though AuthDep uses Depends(). It only appears to trigger on lines with an in-line call to Depends(...) in the annotation.

3

Hi @gmilway, welcome to the Community!

Thank you for such a clear first report. Your comparison of the two Depends(...) forms helped us understand the issue. You’re right: this is a false positive, tracked in https://sonarsource.atlassian.net/browse/SONARPY-3030.

The fix is available in SonarQube Server Developer Edition 2026.3.0 and later. Your 2026.1.6 version does not include it, so please upgrade when you can.

Sorry for the trouble, and thanks again for helping us improve the Python analyzer!
-Francois