v1.0.0

[github-actions[bot]]

codeanalyzer-typescript v1.0.0 — schema v2 CPG, dataflow, TS-prefixed graph

v1.0.0 is the analyzer's first major release. It moves the output to the canonical CLDK schema v2 and completes the TS namespacing of the Neo4j graph (graph schema 2.0.0).

Breaking changes — read before upgrading

• Neo4j vocabulary is TS-prefixed (graph schema 2.0.0). Bare specific node labels are gone and every relationship type is renamed. Migration: update your Cypher — Callable → TSCallable, Module → TSModule, CALLS → TS_CALLS, HAS_MODULE → TS_HAS_MODULE, and so on. Nodes still merge on the shared, unprefixed CanNode label with the id key (can:// URIs), which stays the cross-language canonical layer.
• analysis.json is now the schema-v2 envelope. The payload is {schema_version, language, analyzer, max_level, application}; the symbol table, call graph, and external symbols live under .application, keyed by can:// ids. Migration: re-analyze and point consumers at the new envelope (the CLDK python-sdk 2.x line consumes it natively).
• Migrating a shared 1.x database: the first 2.0.0 bolt push removes ALL pre-2.0.0 TS graph data (legacy-generation wipe). Back up any old TS projection you still need before pushing.

Highlights

• Canonical CPG output (schema v2). Every node carries a stable can:// id; the graph projection merges on CanNode/id with TS-prefixed specific labels for attribution in shared multi-language databases.
• Dataflow analysis levels. -a 3 adds intraprocedural dataflow (CFG, CDG, DDG with a configurable access-path k-limit); -a 4 adds the interprocedural SDG (param_in / param_out / summary edges). --graphs selects sections; -j parallelizes level-3 extraction.
• Far better external-call resolution. Property and method-signature members of external types now resolve through the checker; on OWASP juice-shop, external-call resolution went from 0.287 to 0.857.
• Multi-tsconfig program construction. Projects with nested tsconfigs — Angular-style frontends, project references, scoped installs — now build correctly instead of losing the nested program's resolution.
• Deterministic edge identity. Relationships carry a _k discriminant, keeping parallel edges distinct and making repeated bolt pushes idempotent.
• Version-gated live migration. Pushing to a live Neo4j with a schema-version mismatch forces a full upsert and cleans legacy residue, so a 2.0.0 push leaves no stale 1.x data behind.

Install / upgrade

Shell installer (prebuilt binary; macOS and Linux):

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-typescript/releases/latest/download/cants-installer.sh | sh

Homebrew:

brew upgrade codellm-devkit/homebrew-tap/codeanalyzer-typescript

PyPI:

pip install -U "codeanalyzer-typescript==1.0.0"

Links

• Release (binaries for macOS arm64/x86-64, Linux x86-64/aarch64, Windows x64, plus the Neo4j schema.json contract): https://github.com/codellm-devkit/codeanalyzer-typescript/releases/tag/v1.0.0
• Full change set: feat!: schema v2 — CanNode CPG, L3 dataflow, TS-prefixed graph vocabulary (1.0.0, graph schema 2.0.0) #78