You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
codeanalyzer-typescript v0.6.0 — JavaScript is analyzed
The first release that analyzes JavaScript at all. Before this, discovery accepted only .ts/.tsx/.mts/.cts, so a JavaScript project produced an empty symbol table and exited 0 with no warning — on OWASP NodeGoat, 0 modules and an 84-byte analysis.json.
This is a 0.x maintenance-line release, shipped there because python-sdk pins codeanalyzer-typescript==0.4.3 and reads the v1 schema. It is not a successor to 1.0.0.
⚠️ If you are on 1.0.0, do not upgrade blindly
Because 0.6.0 was published after 1.0.0, GitHub now lists it as the latest release and the Homebrew formula points at it. That means:
brew upgrade codellm-devkit/homebrew-tap/codeanalyzer-typescript will move you from schema v2 back to v1
the cants-installer.sh one-liner resolves through releases/latest, so it now fetches 0.6.0
If you are on the 1.0.0 (v2) line and do not need JavaScript support, stay where you are and pin explicitly.
Breaking changes
1. Neo4j labels and relationship types are namespaced per source language.
Node labels gain a language twin and every relationship type is prefixed. This matches codeanalyzer-python, which already namespaces all of its edges (PY_CALLS, PY_DECLARES, …), so a database holding output from more than one analyzer no longer mingles them.
MATCH ()-[:CALLS]->() → MATCH ()-[:TS_CALLS|JS_CALLS]->()
An edge takes its source module's language, falling back to its target's. Nodes with no language of their own — the application root, packages, external library symbols — keep the analyzer's TS namespace. The Neo4j schema version moves 1.1.0 → 2.0.0, which forces a full re-upsert on the next incremental push.
2. Analyzer caches from 0.5.0 and earlier are invalidated.
Extraction now finds more callables in unchanged sources, so ANALYZER_VERSION moved with the release. Migration: none — the first run after upgrading simply rebuilds.
What's new
JavaScript discovery — .js, .jsx, .mjs, .cjs. .test.js / .spec.js are skipped like their TypeScript counterparts. Nothing downstream needed changing: the compiler already ran with allowJs and Jelly already accepted .js — neither was ever handed a file.
Dynamic method idioms are materialized — this.<name> = fn inside a constructor function, and object-literal members ({ foo(){} }, { foo: function(){} }). Previously the first landed in local_variables and the second was dropped, so no call could resolve to either. This is language-neutral: both were missed in TypeScript too.
A failed Jelly leg is now loud on JavaScript projects. It used to degrade to tsc-only and say so at info, which is not printed at default verbosity — a ~81% edge loss with no signal.
Discovery on an empty project warns instead of exiting 0 silently.
Measured on OWASP NodeGoat (dependencies installed, -a 2):
0.5.0
0.6.0
modules
0
27
callables
0
59
call-graph edges
0
184
resolved call sites
0
51
59 callables matches the parser-derived count of nameable functions in the source exactly.
Known gaps
CommonJS require / module.exports are not modelled at module level, so imports and exports stay empty on CommonJS input. Relative require()call targets do resolve.
Method calls on an untyped receiver (db.collection(...) where db is an untyped parameter) produce no edge into the library. The call is still attributable — recorded on the enclosing callable with its receiver expression — but there is no machine-checkable edge. Tracked in feat(call-graph): attribute method calls on untyped receivers so DB sinks are reachable #87.
Install — pin explicitly
pip install "codeanalyzer-typescript==0.6.0"
pip install codeanalyzer-typescript without a pin still resolves to 1.0.0, the v2 line.
Direct binary download, if you want 0.6.0 specifically rather than whatever latest resolves to:
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
codeanalyzer-typescript v0.6.0 — JavaScript is analyzed
The first release that analyzes JavaScript at all. Before this, discovery accepted only
.ts/.tsx/.mts/.cts, so a JavaScript project produced an empty symbol table and exited 0 with no warning — on OWASP NodeGoat, 0 modules and an 84-byteanalysis.json.This is a 0.x maintenance-line release, shipped there because
python-sdkpinscodeanalyzer-typescript==0.4.3and reads the v1 schema. It is not a successor to 1.0.0.Because 0.6.0 was published after 1.0.0, GitHub now lists it as the latest release and the Homebrew formula points at it. That means:
brew upgrade codellm-devkit/homebrew-tap/codeanalyzer-typescriptwill move you from schema v2 back to v1cants-installer.shone-liner resolves throughreleases/latest, so it now fetches 0.6.0If you are on the 1.0.0 (v2) line and do not need JavaScript support, stay where you are and pin explicitly.
Breaking changes
1. Neo4j labels and relationship types are namespaced per source language.
Node labels gain a language twin and every relationship type is prefixed. This matches
codeanalyzer-python, which already namespaces all of its edges (PY_CALLS,PY_DECLARES, …), so a database holding output from more than one analyzer no longer mingles them.Migration: every stored query must change —
An edge takes its source module's language, falling back to its target's. Nodes with no language of their own — the application root, packages, external library symbols — keep the analyzer's
TSnamespace. The Neo4j schema version moves 1.1.0 → 2.0.0, which forces a full re-upsert on the next incremental push.2. Analyzer caches from 0.5.0 and earlier are invalidated.
Extraction now finds more callables in unchanged sources, so
ANALYZER_VERSIONmoved with the release. Migration: none — the first run after upgrading simply rebuilds.What's new
.js,.jsx,.mjs,.cjs..test.js/.spec.jsare skipped like their TypeScript counterparts. Nothing downstream needed changing: the compiler already ran withallowJsand Jelly already accepted.js— neither was ever handed a file.this.<name> = fninside a constructor function, and object-literal members ({ foo(){} },{ foo: function(){} }). Previously the first landed inlocal_variablesand the second was dropped, so no call could resolve to either. This is language-neutral: both were missed in TypeScript too.info, which is not printed at default verbosity — a ~81% edge loss with no signal.Measured on OWASP NodeGoat (dependencies installed,
-a 2):59 callables matches the parser-derived count of nameable functions in the source exactly.
Known gaps
require/module.exportsare not modelled at module level, soimportsandexportsstay empty on CommonJS input. Relativerequire()call targets do resolve.db.collection(...)wheredbis an untyped parameter) produce no edge into the library. The call is still attributable — recorded on the enclosing callable with its receiver expression — but there is no machine-checkable edge. Tracked in feat(call-graph): attribute method calls on untyped receivers so DB sinks are reachable #87.Install — pin explicitly
pip install "codeanalyzer-typescript==0.6.0"pip install codeanalyzer-typescriptwithout a pin still resolves to 1.0.0, the v2 line.Direct binary download, if you want 0.6.0 specifically rather than whatever
latestresolves to:curl -LsSf https://github.com/codellm-devkit/codeanalyzer-typescript/releases/download/v0.6.0/cants-macosx_11_0_arm64 -o cants && chmod +x cantsBinaries for Apple Silicon / Intel macOS, x86-64 / ARM64 Linux and x64 Windows are attached to the release.
Release v0.6.0 · CHANGELOG · #84 · #85 · #88
All reactions