📣 New Release: codeanalyzer-python 1.3.0

[rahlk]

codeanalyzer-python (canpy) v1.3.0

TL;DR — canpy now sees your whole repository, not just the Python in it. Version 1.3.0 adds the artifact layer: every non-code file becomes part of the analysis — dependency manifests parsed into a provenance-tagged SBOM, configuration files parsed into first-class keys, and a new deterministic edge that answers which line of code reads which configuration key. No breaking changes; everything is additive to schema v2.

Highlights

Your repository's files, inventoried. application.artifacts records every non-.py file: manifests, Dockerfiles, compose/k8s configs, CI workflows, docs, licenses, scripts — text captured verbatim (size-capped, off-switchable with --no-artifact-text), binaries by hash. Nothing on disk goes unrecorded.

Dependencies with evidence. application.dependencies parses requirements files (with -r/-c chasing), pyproject (PEP 621 + Poetry), setup.py (statically — never executed), setup.cfg, Pipfile, environment.yml, and the poetry/uv/Pipfile lock files. Every record says where it was declared and how it's known (declared, lockfile, opt-in installed-metadata, heuristic); lockfile-only transitives are marked direct: false. The flip side ships too: application.unresolved_imports lists every import no manifest accounts for.

Configuration as a graph. Keys from .env, yaml, json, toml, ini, properties — and now deployment sources: Dockerfile ENV/ARG, compose environment:, k8s env: lists — become ConfigKey nodes with values, spans, and cross-file references (${VAR}, %(name)s, ${{ ... }}).

Code-to-config edges, never guessed. PY_USES_CONFIG links the exact statement to the exact key it reads, in three deterministic tiers that widen with the analysis level: string literals at -a 2, def-use chains closing on one literal at -a 3, cross-function chains at -a 4. Reads that can't be proven land in application.config_reads_unresolved with a reason — on odoo, that list is the service's ambient-environment contract (37 env vars the code reads that nothing defines).

In Neo4j, the shared nouns are deliberately language-neutral — :Artifact, :Package (purl ids like pkg:pypi/requests), :ConfigKey — so sibling analyzers over the same repo merge onto the same nodes; the Python-specific claims stay PY_-prefixed.

New release assets: schema.cypher (the Neo4j contract as runnable DDL) and the analyzing-canpy-graphs skill bundle — a query cookbook covering call-graph, dataflow, taint, SBOM, and the new config analyses.

Also in this release: the SDG builder now resolves call sites from the deterministic linker-backed path rather than Jedi's cache-sensitive side channel, and call arguments carry literal values (PyCallArgument.value/.name).

Upgrade

pip install -U "codeanalyzer-python==1.3.0"

New flags (all optional): --resolve-installed, --artifact-text/--no-artifact-text, --artifact-text-max-bytes.

Links

• GitHub release
• CHANGELOG