📣 New Release: codeanalyzer-python v0.3.0

[rahlk]

codeanalyzer-python (canpy) v0.3.0

TL;DR — the level-2 call graph switched engines: CodeQL is gone, PyCG is in, selected with the reintroduced --analysis-level {1,2} flag. Level 2 now scales to large applications through coupling-aware sharding with adaptive decomposition. If you pass --codeql anywhere, you need a one-line change.

⚠️ Breaking changes

• CodeQL is replaced by PyCG as the level-2 call-graph backend.
  • --codeql / --no-codeql no longer exist — replace them with --analysis-level 2 (or drop them for level 1, the default).
  • Call-edge provenance values change: "codeql" → "pycg" — update anything that filters edges by provenance.
  • The codeanalyzer.semantic_analysis.codeql package is removed; pycg (Apache-2.0) is a new dependency.

🚀 New features

• --analysis-level {1,2} (reintroduced): level 1 is the symbol table + Jedi call graph; level 2 adds PyCG-resolved edges, provenance-merged with Jedi's.
• Coupling-aware PyCG sharding (--pycg-shard): instead of a flat file count, shards follow Jedi module coupling (SCC condensation so import cycles never split, plus Louvain communities), so few call edges are severed between shards. Each shard runs in a symlink mini-project that bounds PyCG to that shard's files, Ray-parallel.
• Adaptive decomposition of runaway shards: PyCG's fixpoint can diverge on heavy metaclass/mixin code. A shard that hits the timeout is re-sharded at half the budget and re-run, down to a 10-file floor; what still diverges falls back to Jedi-only coverage. On the Odoo benchmark (1028 modules) this recovered 22,210 PyCG edges versus 17,149 for the best uniform ceiling, losing only 20 files instead of whole shards.
• New tuning flags: --pycg-shard-strategy {jedi,package}, --pycg-shard-ceiling (default 100), --pycg-shard-timeout (default 120 s), --pycg-max-iter (default 50 — a divergent shard returns a partial graph instead of hanging).

🐛 Fixes

• The shard planner now keys modules by file path — keying by module_name (just the file stem) collided on every __init__.py and silently dropped files from shards.
• PyCG no longer follows imports into an in-tree analysis venv (e.g. .codeanalyzer/): dependencies resolve outside the shard bound and stay ghost nodes.
• The analyzer always uses the vendored uv from its own dependency (no more PATH fallback), falling back to pip only if the package is missing.

Upgrade

pip install -U "codeanalyzer-python==0.3.0"

Or the standalone CLI installer:

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-python/releases/latest/download/canpy-installer.sh | sh

• Release notes: https://github.com/codellm-devkit/codeanalyzer-python/releases/tag/v0.3.0
• Full changelog: https://github.com/codellm-devkit/codeanalyzer-python/blob/main/CHANGELOG.md