📣 New Release: codeanalyzer-python 1.1.1

[rahlk]

codeanalyzer-python (canpy) v1.1.1

TL;DR — a patch release that makes the L4 system dependence graph traversable end-to-end: the interprocedural port layer is now connected to the statement-level ddg, and nested call vertices are anchored to their statement. No breaking changes; strictly additive output.

What was fixed (#115, PR #116)

The port layer was an island. L4 emits parameter ports (actual_in/actual_out/formal_in/formal_out) and wires them across calls with param_in/param_out/summary edges — but no ddg edge connected any statement to any port. The SDG was two disconnected graphs, so an end-to-end flows_to(def_stmt, callee_formal) witness, or a return-value flow (x = f(y) → uses of x), could not be expressed. The binding edges existed in the analyzer's IR all along and were emitted by the old v1 projection; the v2 emission dropped them.

v1.1.1 emits all four binding classes on each callable's ddg, tagged prov:["reaching-defs"] (the same label codeanalyzer-typescript uses, so the provenance vocabulary stays shared across analyzers):

• def stmt → actual_in:k — argument binding at the call site
• actual_out → callsite stmt — return-value binding
• formal_in:k → first-use stmts — parameter flow inside the callee
• return stmt → formal_out — return binding out of the callee

The edges are strictly additive over the untouched L3 ssa set, so the L3 ⊆ L4 monotonicity invariant holds.

Call vertices are anchored. A call nested in a larger statement (y = f(x)) deliberately sits off the CFG spine (it's a dataflow satellite, not a control-flow step) — but nothing said which statement owned it. From L3 it now carries parent = its enclosing statement's local id, the same anchoring the actual ports already use. This is a sanctioned null → value refinement (like callee: null → id at L1→L2), recorded in the schema decision log.

Upgrade

pip install -U "codeanalyzer-python==1.1.1"

Consumers walking the graph: prov on L4 ddg edges is now one of ssa, points-to, or reaching-defs — a filter that allow-listed the first two should add the third to see cross-call flow.

Links: GitHub release · CHANGELOG