📣 New Release: codeanalyzer-python 1.1.0

[github-actions[bot]]

codeanalyzer-python (canpy) v1.1.0

TL;DR — the Scalpel-backed points-to oracle is now built into the package and is the default for L4 analysis on every supported Python (3.9–3.14). On Python 3.12+, where the old optional install could never work, L4 alias analysis gets strictly more precise. One packaging change to note: the [scalpel] extra is gone.

What changed (#113, PR #111)

L4 (-a 4) widens the data-dependence graph with alias-derived edges (prov:["points-to"]), answered by a may-alias oracle. The strong oracle — Scalpel's solved SSA + copy/const state, closed into a union-find over access paths — previously required pip install "codeanalyzer-python[scalpel]". But python-scalpel hard-depends on typed_ast, abandoned with no wheels for Python 3.12+, so on modern interpreters the extra could not install at all and L4 silently fell back to the coarser type-based oracle.

v1.1.0 vendors the exact 9-module SSA/cfg/core slice of python-scalpel 1.0b0 that the oracle uses — typed_ast-free, Apache-2.0 with license and NOTICE attribution, byte-identical to upstream except one lazy-import patch that drops the graphviz dependency. ScalpelAliasOracle is now the shipping default everywhere; the type-based oracle remains only as a per-callable/per-query runtime safety net.

Effect on output: on environments that previously lacked the extra (any 3.12+ host), L4's prov:["points-to"] DDG edges become scalpel-precise — a tighter subset of the old over-approximation. The prov:["ssa"] edges (the L3 subset) are unchanged, so the L3 ⊆ L4 monotonicity invariant holds. No schema changes.

Packaging notes

• Removed: the [scalpel] extra. If you installed codeanalyzer-python[scalpel], install plain codeanalyzer-python — you get the same oracle, now built in.
• Added dependency: astor (pure-Python, needed by the vendored SSA slice). typed_ast and graphviz are not dependencies.
• Also includes everything from 1.0.2 (Neo4j code property fix) and 1.0.3 (parso-aware env provisioning) if you're upgrading from 1.0.1.

Upgrade

pip install -U "codeanalyzer-python==1.1.0"

Links: GitHub release · CHANGELOG