📣 New Release: codeanalyzer-python 1.0.0

[rahlk]

codeanalyzer-python (canpy) v1.0.0

TL;DR — canpy 1.0.0 is a major, breaking release: the analyzer now emits the canonical CLDK schema v2 (schema_version 2.0.0) — one additive Code Property Graph tree — across four gated analysis levels (-a 1|2|3|4), in both analysis.json and the Neo4j projection. The 1.0 version marks the emitted contract as stable: it is key-for-key identical to the cross-language CLDK keystone, so one SDK model set parses every analyzer's output.

⚠️ Breaking changes (migration steps included)

1. The payload root is now an Analysis envelope. The flat top-level symbol_table/call_graph (and the separate program_graphs section) are gone. Migrate: read analysis.application.symbol_table and analysis.application.call_graph; dataflow graphs are inline on each callable (body/cfg/cdg/ddg/summary).
2. Containment keys renamed to the canonical vocabulary. Modules nest types/functions; classes and callables nest callables/types. Migrate: classes → types, methods → callables, inner_classes/inner_callables → types/callables.
3. Call-graph edges are {src, dst, prov, weight}. The type: "CALL_DEP" field and the source/target/provenance keys are gone; endpoints are can:// node ids and always join the id space — imported/builtin targets are homed in application.external_symbols under can://…/@external/<module>/<name> ids. Migrate: rename the keys; join dst against the tree or external_symbols.
4. Per-node code is dropped. Each module stores its source once; every node carries a byte-offset span. Migrate: slice module.source[span.bytes[0]:span.bytes[1]].
5. Neo4j contract is 2.0.0. Nodes merge on can:// ids (:PyExternal included); the L3/L4 CPG overlay ships as PyCFGNode + PY_CFG_NEXT/PY_CDG/PY_DDG (with prov), plus PY_PARAM_IN/PY_PARAM_OUT/PY_SUMMARY; PY_CALLS carries prov. Migrate: re-run canpy --emit schema for the machine-readable contract and rebuild graphs from scratch.

Highlights

• Four analysis levels, one growing tree — L1 symbol table + Jedi call graph; L2 adds PyCG-resolved edges (coupling-aware sharding for large apps); L3 adds per-callable exceptional CFG plus control- and data-dependence graphs; L4 stitches a whole-program interprocedural SDG (parameter vertices, param_in/param_out/summary, alias-aware DDG via the optional Scalpel points-to oracle with an automatic type-based fallback). Each level is a strict superset of the one below.
• Durable identity — can://python/<app>/<file>/<type>/<callable-sig> ids on every callable and above; ordinal ids below; both projections share one identity.
• Snapshot provenance — the envelope carries analyzer{name, version, config}, and the application records repository{uri, revision, dirty} (credentials stripped from remote URIs).
• Validated at scale — a full-Odoo -a 4 run (6,086 modules; 44,840 call edges; 3.28M dependence edges; 490 MB) passes every conformance gate with zero dangling edge endpoints and round-trips the schema models.
• Also folds in everything from v0.3.1 (correct method-call callees, structured call-site arguments, class-attribute initializers, internal import resolution).

Known limitation: the L2+ call graph can vary slightly between runs — PyCG's capped fixpoint is order-sensitive (tracked in #99).

SDK users: the CLDK python-sdk consumes this release via its schema-v2 uptake epic (python-sdk#238); until that ships, pin codeanalyzer-python<1.0 if you consume analysis.json through the SDK's current models.

Upgrade

pip install -U "codeanalyzer-python==1.0.0"
# optional extras:
pip install -U "codeanalyzer-python[scalpel]==1.0.0"   # Scalpel points-to oracle (L4)
pip install -U "codeanalyzer-python[neo4j]==1.0.0"     # live Bolt push

Or the shell installer:

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-python/releases/latest/download/canpy-installer.sh | sh

Links

• GitHub release
• CHANGELOG.md
• Schema hand-off bundle (per-level reference outputs + Neo4j contract)