Install

pip install codeanalyzer-java==3.1.0   # bundles a JVM; installs the canjv launcher

Or the jar with a codeanalyzer launcher (requires Java 11+):

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v3.1.0/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

# JSON output, at the analysis level you ask for
java -jar codeanalyzer.jar -i /path/to/project -a 4 -o ./out          # writes out/analysis.json

# Neo4j projection - always full depth, so it takes no --analysis-level
java -jar codeanalyzer.jar -i /path/to/project --emit neo4j -o ./out  # writes out/graph.cypher

Downloads

📦 Other Changes

• feat(config): config-read literal tier — J_USES_CONFIG and J_READS_CONFIG_UNRESOLVED
  • PR: #233
• feat(entrypoints): report on the application root, framework attribution on the node
  • PR: #235
• feat(config): dataflow tiers — close non-literal keys over the L3 DDG and L4 call graph
  • PR: #237
• docs(schema): stop calling the graph contract 2.2.0
  • PR: #238
• chore(release): 3.1.0
  • PR: #239

Install

pip install codeanalyzer-java==3.0.3   # bundles a JVM; installs the canjv launcher

Or the jar with a codeanalyzer launcher (requires Java 11+):

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v3.0.3/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

# JSON output, at the analysis level you ask for
java -jar codeanalyzer.jar -i /path/to/project -a 4 -o ./out          # writes out/analysis.json

# Neo4j projection - always full depth, so it takes no --analysis-level
java -jar codeanalyzer.jar -i /path/to/project --emit neo4j -o ./out  # writes out/graph.cypher

Downloads

📦 Other Changes

• fix(ddg): drop dependence edges whose endpoint is not a body node
  • PR: #229
• fix(l4): join the SDG port lattice to the statement ddg
  • PR: #230

Install

pip install codeanalyzer-java==3.0.2   # bundles a JVM; installs the canjv launcher

Or the jar with a codeanalyzer launcher (requires Java 11+):

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v3.0.2/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

# JSON output, at the analysis level you ask for
java -jar codeanalyzer.jar -i /path/to/project -a 4 -o ./out          # writes out/analysis.json

# Neo4j projection - always full depth, so it takes no --analysis-level
java -jar codeanalyzer.jar -i /path/to/project --emit neo4j -o ./out  # writes out/graph.cypher

Downloads

📦 Other Changes

• Read the primordial scope from jrt:/ and ship codeanalyzer-java on PyPI with a bundled JVM
  • PR: #223
• ci: publish the PyPI wheel from release-pypi.yml after Java Release succeeds
  • PR: #224

Install

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v3.0.1/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

# JSON output, at the analysis level you ask for
java -jar codeanalyzer.jar -i /path/to/project -a 4 -o ./out          # writes out/analysis.json

# Neo4j projection - always full depth, so it takes no --analysis-level
java -jar codeanalyzer.jar -i /path/to/project --emit neo4j -o ./out  # writes out/graph.cypher

Downloads

What's changed in 3.0.1

Fixed

• --emit neo4j no longer fails on a large repository. The whole Cypher script was built as one String before a byte was written, and a script containing any non-Latin-1 character is stored as UTF16 — capping it at ~1.07 billion characters. ThingsBoard v4.0 renders 1.169 billion, so the run died with OutOfMemoryError and left a zero-byte graph.cypher. Not heap exhaustion: no -Xmx avoided it. The writer now streams, so peak memory is one batch rather than the whole graph. (#211)
• An incremental Bolt push can no longer delete a graph it did not write. Two separate defects, both fixed:
  • It matched _module with no label at all. Sibling analyzers set that same property to the same value, so wherever a file key collided across languages, a java push deleted their nodes. (#213)
  • Even labelled, it was application-blind — _module is a bare project-relative path, so two java applications sharing src/main/java/Foo.java deleted each other's nodes for that file. No label could fix that: both applications' nodes are identical apart from identity. Deletion is now scoped by the module's own can:// id. (#218)
• Configuration XML is recognized rather than assumed. Every *.xml was flattened into config keys, so data files became configuration: ThingsBoard emitted 42,768 keys, 30,408 of them from LwM2M object registries. Only recognized configuration shapes are flattened now — by name, by conventional suffix, and by location (WEB-INF/, META-INF/ are spec-defined descriptor directories). ThingsBoard drops to 9,352 keys; daytrader8 is byte-identical. (#210)
• A <!DOCTYPE> no longer discards a whole configuration file. The parser refused any DOCTYPE, which threw away 43 files on ThingsBoard — 35 of them logback.xml, marked extraction=partial with zero keys while spraying [Fatal Error] at stderr. Configuration files now parse with an internal subset permitted and every external route still closed: external general and parameter entities, external DTD loading and XInclude all remain off, and entity expansion stays capped. Manifests keep the categorical refusal — a pom.xml has no legitimate reason to declare a DOCTYPE.
• Release notes no longer advertise -a 2 --emit neo4j, which exits 1 (the graph is always projected at full depth and rejects --analysis-level), and the changelog no longer renders empty when pull requests carry no labels.

Changed — read this if you query the Neo4j graph

• _module is no longer emitted on any node. It was internal by convention (leading underscore) and existed only to tell the writer which module a node belonged to — something the graph never needed to be told, because a node's owning module is already the prefix of its can:// id. No version number signals this: the graph contract is deliberately held at 2.0.0, since it is shared across analyzers and moves only when all of them re-baseline together. If you query _module, that is the change to make.
• Nodes keyed by a can:// id now carry a :JCanNode marker, with an index on id. It exists only so a prefix predicate can seek — Neo4j property indexes are label-scoped. It makes no semantic claim, unlike :JSymbol.
• The incremental push no longer purges legacy --schema v1 graphs. Those ids are FQN-shaped and carry no application segment, so there is no safe way to scope a delete; a v1 push now upserts and says it skipped.

Verified for this release

daytrader8: schema conformance valid at every level, repeated runs byte-identical, --emit neo4j clean. ThingsBoard v4.0 (4131 files): --emit neo4j completes where 3.0.0 exited 1 and wrote nothing.

📦 Other Changes

• fix(neo4j): stream the Cypher snapshot instead of building it as one String
  • PR: #211
• fix(artifacts): flatten only configuration XML, not every XML in the repository
  • PR: #212
• fix(neo4j): anchor the Bolt purge on java-owned labels
  • PR: #216
• fix(neo4j)!: scope the v2 purge on the can:// id prefix; retire _module from v2
  • PR: #220
• fix(neo4j): hold the graph contract at the shared 2.0.0 baseline
  • PR: #221

Install

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v3.0.0/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

# JSON symbol table + call graph + dataflow, at the level you ask for
java -jar codeanalyzer.jar -i /path/to/project -a 4 -o ./out          # writes out/analysis.json

# Neo4j projection — always full depth, so it takes no --analysis-level
java -jar codeanalyzer.jar -i /path/to/project --emit neo4j -o ./out  # writes out/graph.cypher

Downloads

What's changed in 3.0.0

Changed

• BREAKING — canonical schema v2 is now the default output. Pass --schema v1 for the previous shape. (#201)
• BREAKING — --emit neo4j always projects at full depth and rejects --analysis-level; the graph is no longer level-truncated.
• Neo4j graph contract is now 2.2.0, carrying the L4 and artifact overlays. Read it from the release's schema.neo4j.json.

Added

• Level 4 — interprocedural SDG. param_in / param_out edges, semantic (points-to) DDG provenance alongside SSA, and per-callable summary shortcut edges. Run with -a 4. (#203)
• Repository-artifact layer. Build artifacts, declared dependencies, and configuration keys, projected to the cross-language Artifact / Package / ConfigKey labels so sibling analyzers merge onto the same nodes. (#206)
• L3 dataflow seeds from @entry's formals, making seeding semantic rather than textual — which is what lets the summary pass compose. (#205)

Fixed

• The call graph is now reproducible. Entrypoints were collected through a parallel stream over an unordered class hierarchy, so RTA reached a slightly different set on every run: three runs over daytrader8 gave 1876 / 1875 / 1876 edges with the declared/rta provenance split swinging across ~14 edges. Output is now byte-identical run to run.
• A relative -i path no longer silently yields an empty symbol table, and build/resources fixtures are no longer analyzed as project code. (#200)
• A CLI parameter error now exits non-zero.
• The conformance schema admits L4's compound body-node ids (<line:col>/actual_in:<i>, <line:col>/actual_out), so an -a 4 payload validates against it. (#208)

Verified for this release

Run on the daytrader8 fixture (141 files) at -a 4: monotonic across all four levels (186k scalar facts, none lost or rewritten), byte-identical across repeated runs, and the JSON and Neo4j projections agree exactly on all ten overlay counts.

Install

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v2.4.1/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

java -jar codeanalyzer.jar -i /path/to/project -a 2 --emit neo4j -o ./out   # writes out/graph.cypher

Downloads

Install

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v2.4.0/codeanalyzer-installer.sh | sh

Or run the JAR directly (requires Java 11+):

java -jar codeanalyzer.jar -i /path/to/project -a 2 --emit neo4j -o ./out   # writes out/graph.cypher

Downloads

🚀 Features

• feat(neo4j): J-namespaced, lossless Neo4j graph output (#154)
  • PR: #155

🐛 Fixes

• feat(neo4j): J-namespaced, lossless Neo4j graph output (#154)
  • PR: #155

📚 Documentation

• feat(neo4j): J-namespaced, lossless Neo4j graph output (#154)
  • PR: #155

🚨 Breaking Changes

• feat(neo4j): J-namespaced, lossless Neo4j graph output (#154)
  • PR: #155

What's Changed

• Add new import schema with path, is_static, and is_wildcard fields by @tylerstennett in #144
• feat: emit per-variable field initializers in field declarations by @tylerstennett in #145
• ci: cross-build macOS x86_64 on Apple Silicon; drop Windows by @rahlk in #147
• ci: make musl toolchain/zlib downloads resilient to musl.cc outages by @rahlk in #148
• ci: fix musl static-PIE link + macOS x86_64 cross-wheel smoke test by @rahlk in #149
• ci: smoke-test musl wheels in Alpine, then publish them by @rahlk in #150

New Contributors

• @tylerstennett made their first contribution in #144

Full Changelog: v2.3.6...v2.3.7

🐛 Fixes

• Fix/239 240 duplicate key node range errors
  • PR: #141
• Lexical printer error
  • PR: #143