📣 New Release: codeanalyzer-python 1.5.3

[github-actions[bot]]

codeanalyzer-python 1.5.3 is out. A patch release with two fixes, both of which
were silently losing data rather than failing loudly.

No breaking changes. schema_version and the graph SCHEMA_VERSION both stay 2.0.0.

pip install -U "codeanalyzer-python==1.5.3"

The analyzer no longer eats its own output (#207)

If you pointed --output (or --cache-dir) at a directory inside --input, each run
inventoried the previous run's analysis.json and embedded it whole. Run 2 contained run
1, run 3 contained run 2, and so on — the payload squared each time until the process was
killed decoding tens of gigabytes of its own output. Because the symptom was a SIGKILL
and not an error, it read as a flaky, load-sensitive test suite, and had been misdiagnosed
as one more than once.

The analyzer now knows where it writes and skips those paths: the output and cache
directories, and the output files inside them. Matching is on resolved paths, so relative,
..-laden, and symlinked targets all exclude the same tree, while an output directory
outside the project excludes nothing. -o pointed straight at the project root is handled
too — skipping the whole directory there would empty the artifact inventory, so only the
run's own output files are skipped.

If you have been working around this by pointing -o outside your project, you no longer
need to.

Nested calls that start at the same column each get a node (#215)

body was keyed on a call site's start position, and two nested calls can share one. In
getattr(obj, name)(arg), the outer invocation and the inner getattr both begin at the
g, so only one survived — the inner one. The dynamic call vanished from analysis.json,
from the CFG/CDG/DDG endpoints that use the same keys, and from the Neo4j projection. On a
merged Odoo graph that meant 193 getattr call sites, 193 edges to the builtin, and no
node anywhere for the invocation that followed.

A call key now takes a /2, /3, … suffix when a position holds more than one call,
outermost first. On the flask fixture this recovers 68 call nodes that were previously
dropped. The spelling is codeanalyzer-typescript's, adopted verbatim, so the two analyzers
address these nodes identically.

Two related fixes ride along: the Neo4j projection joins callee_signature on the body key
rather than on (line, column), and a call whose callee is itself a call now reports
callee_signature: null with method_name: "<unknown>" instead of claiming to call the
inner callee. What such a dynamic call actually reaches is still not inferred — the site is
recorded so you can decide, and no call edge is invented.

For consumers: a body key that used to collide now resolves to the outer call instead of
the inner one; keys that do not collide are unchanged. python-sdk needs no update — it
already parses the suffixed form.

• Release v1.5.3
• CHANGELOG