⚡️ Avoid flattening dependencies for OpenAPI

[tiangolo]

What changed

• Traverse each route dependency graph directly while collecting OpenAPI parameters and security dependencies.
• Preserve dependency order, duplicate skipping, and inherited OAuth scopes without constructing synthetic Dependant trees.
• Remove the now-unused get_flat_dependant() and _get_security_dependencies() helpers.
• Make the changed OpenAPI security helper private.

Why

OpenAPI generation only needs selected parameter and security data, but it previously created a complete flattened Dependant tree for every route. Those temporary trees added allocations and traversal overhead without being used for dependency solving.

This builds on the OpenAPI performance and memory baselines added in #16075.

Validation

• uv run pytest tests -q — 3,288 passed, 17 skipped, 5 xfailed
• uv run pytest tests/test_dependency_models.py tests/test_security_oauth2_authorization_code_bearer_scopes_openapi.py tests/test_security_oauth2_authorization_code_bearer_scopes_openapi_simple.py tests/test_top_level_security_scheme_in_openapi.py tests/test_repeated_dependency_schema.py tests/test_security_scopes_dont_propagate.py -q
• uv run pytest tests/benchmarks/test_openapi.py tests/memory_benchmarks/test_openapi.py --codspeed -q
• uv run prek run --files fastapi/dependencies/models.py fastapi/dependencies/utils.py fastapi/openapi/utils.py tests/test_dependency_models.py

Local uncached OpenAPI generation improved from approximately 156 ms to 149–154 ms. CodSpeed CI will provide the instrumented performance and memory comparison.

AI Disclaimer

This PR was created with the help of OpenAI Codex, powered by GPT-5.6-sol. Reviewed by hand.

[codspeed-hq]

Merging this PR will not alter performance

✅ 24 untouched benchmarks

---

_{Comparing agent/openapi-dependency-traversal (b8fe0f9) with master (3d3c691)¹}

Footnotes

1. No successful run was found on master (87095aa) during the generation of this report, so 3d3c691 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[borlafu]

This PR removes get_flat_dependant which is not marked as private (e.g. _ prefix). See some linked issues.

[YuriiMotov]

This PR removes get_flat_dependant which is not marked as private (e.g. _ prefix). See some linked issues.

Sebastian mentioned several times that anything that is not documented should be considered internal.
If you'd like to see some internal functionality as public API for integrations, please open feature request discussion