📣 New Release: codeanalyzer-python 1.2.0

[rahlk]

codeanalyzer-python 1.2.0 is out. This is the release that replaces the analyzer's call-graph engine — read the breaking changes before upgrading.

⚠️ Breaking changes

• PyCG is removed. Level 2 call graphs are now built by Jedi plus a new defuse linker — a per-callable resolution pass over Python's own name-lookup rules with a bounded type-propagation round. All --pycg-* flags (--pycg-shard, --pycg-shard-ceiling, --pycg-shard-strategy, --pycg-max-iter, --pycg-shard-timeout) are gone; drop them from your invocations — there is nothing to configure. Call-edge prov values are now "jedi", "defuse", or both; anything consuming prov: ["pycg"] must switch.
• The msgpack output format is removed, and the --format flag with it. analysis.json is the single wire format and is always written. Migration: drop --format json / --format msgpack from your invocations; readers of analysis.msgpack switch to the JSON.
• --emit neo4j now enforces its always-full-depth contract: it runs at level 4 with every graph section, and explicitly passing -a or --graphs alongside it is an error (previously it silently emitted a partial level-1 graph). Migration: remove -a/--graphs from --emit neo4j invocations.

Why the engine swap

PyCG's whole-program analysis could run for hours on large codebases without finishing — on a 2,364-file Odoo corpus it computed for 3h19m and produced zero edges. The defuse linker analyzes the same corpus in under 8 minutes with 760k call edges, its output is byte-reproducible on repeat runs (one known probabilistic Jedi quirk remains, tracked as #146), and its edge set was validated arrow-by-arrow against Joern and Fraunhofer-AISEC's CPG until it covered every real edge both tools produce. The provenance tag on every edge tells you which layer resolved it.

Also in this release

• numpy and pandas are no longer dependencies — neither was ever imported, and their pins forced source builds on some targets (Red Hat UBI images in particular). Installs get lighter and stop failing there.
• Python 3.10 support is now exercised in CI: the release pipeline gained a compatibility job for the 3.10 dependency line (older ray/pydantic pins), and the pydantic-v1 incompatibilities it caught are fixed.

Upgrade

pip install -U "codeanalyzer-python==1.2.0"

• Release notes
• Full changelog
• How the new call graph works, in plain language