codeanalyzer-python 1.5.3__tar.gz → 1.6.0__tar.gz

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/PKG-INFO

@@ -1,31 +1,23 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.5.3
+Version: 1.6.0
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE
 License-File: NOTICE
-Requires-Python: >=3.9
+Requires-Python: >=3.11
 Requires-Dist: astor<0.9.0,>=0.8.1
-Requires-Dist: jedi<0.20.0,>=0.18.0; python_version < '3.11'
-Requires-Dist: jedi<=0.19.2; python_version >= '3.11'
-Requires-Dist: networkx<3.2.0,>=2.6.0; python_version < '3.11'
-Requires-Dist: networkx<4.0.0,>=3.0.0; python_version >= '3.11'
+Requires-Dist: jedi<=0.19.2
+Requires-Dist: networkx<4.0.0,>=3.0.0
 Requires-Dist: packaging>=25.0
 Requires-Dist: parso>=0.8.5
-Requires-Dist: pydantic<2.0.0,>=1.8.0; python_version < '3.11'
-Requires-Dist: pydantic<3.0.0,>=2.0.0; python_version >= '3.11'
+Requires-Dist: pydantic<3.0.0,>=2.0.0
 Requires-Dist: pyyaml<7.0,>=6.0
-Requires-Dist: ray<3.0.0,>=2.10.0; python_version >= '3.11'
-Requires-Dist: ray==2.0.0; python_version < '3.11'
-Requires-Dist: requests<3.0.0,>=2.20.0; python_version >= '3.11'
-Requires-Dist: rich<14.0.0,>=12.6.0; python_version < '3.11'
-Requires-Dist: rich<15.0.0,>=14.0.0; python_version >= '3.11'
-Requires-Dist: tomli>=2.0; python_version < '3.11'
-Requires-Dist: typer<1.0.0,>=0.9.0; python_version < '3.11'
-Requires-Dist: typer<2.0.0,>=0.9.0; python_version >= '3.11'
-Requires-Dist: typing-extensions<5.0.0,>=4.0.0; python_version < '3.11'
-Requires-Dist: typing-extensions<6.0.0,>=4.5.0; python_version >= '3.11'
+Requires-Dist: ray<3.0.0,>=2.10.0
+Requires-Dist: requests<3.0.0,>=2.20.0
+Requires-Dist: rich<15.0.0,>=14.0.0
+Requires-Dist: typer<2.0.0,>=0.9.0
+Requires-Dist: typing-extensions<6.0.0,>=4.5.0
 Requires-Dist: uv>=0.5.0
 Provides-Extra: neo4j
 Requires-Dist: neo4j<6.0.0,>=5.0.0; extra == 'neo4j'
@@ -112,7 +104,7 @@ needs.
 
 ### Prerequisites
 
-- **Python 3.10 or newer.**
+- **Python 3.11 or newer.**
 - A C toolchain and the `venv` / development headers — the analyzer builds an isolated virtual
   environment per project (via Python's `venv`) so Jedi can resolve types and imports:
 

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/README.md

@@ -79,7 +79,7 @@ needs.
 
 ### Prerequisites
 
-- **Python 3.10 or newer.**
+- **Python 3.11 or newer.**
 - A C toolchain and the `venv` / development headers — the analyzer builds an isolated virtual
   environment per project (via Python's `venv`) so Jedi can resolve types and imports:
 

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/__main__.py

@@ -406,11 +406,10 @@ def _write_output(artifacts, output_dir: Path):
     # Use Pydantic's model_dump_json() for compact output
     # Strip internal-only fields here rather than with a field-level Pydantic
     # `exclude`: the analysis cache shares the serializer and must keep them.
-    json_str = json.dumps(
-        strip_internal_only(model_dump(artifacts, mode="json", exclude_none=True))
-    )
+    from codeanalyzer.core import stream_analysis_json, _log_mem  # LOW-MEM PATCH
     with output_file.open("w") as f:
-        f.write(json_str)
+        stream_analysis_json(artifacts, f, strip_internal=True)
+    _log_mem("after analysis.json write")
     logger.info(f"Analysis saved to {output_file}")
 
 

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/artifacts/config_keys.py

@@ -58,14 +58,9 @@ from __future__ import annotations
 import configparser
 import json
 import re
-import sys
+import tomllib
 from typing import Callable, Dict, List, Optional, Tuple
 
-if sys.version_info >= (3, 11):
-    import tomllib
-else:  # pragma: no cover - exercised on the 3.10 CI leg
-    import tomli as tomllib
-
 import yaml
 
 from codeanalyzer.schema.ids import config_key_id

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/artifacts/parsers.py

@@ -4,15 +4,10 @@ import ast
 import configparser
 import json
 import re
-import sys
+import tomllib
 from dataclasses import dataclass
 from typing import Dict, List, Optional, Tuple
 
-if sys.version_info >= (3, 11):
-    import tomllib
-else:  # pragma: no cover - exercised on the 3.10 CI leg
-    import tomli as tomllib
-
 import yaml
 
 

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/core.py

@@ -1,5 +1,8 @@
+import gc
 import hashlib
+import json
 import os
+import resource
 import shutil
 import subprocess
 import sys
@@ -53,6 +56,90 @@ def _artifact_full_text(project_dir: Path, path: str, art) -> str:
         return art.source
 
 
+def _log_mem(label: str) -> None:
+    """LOW-MEM PATCH: log current/peak RSS of the driver at phase boundaries."""
+    try:
+        cur = int(os.popen(f"ps -o rss= -p {os.getpid()}").read().strip() or 0) / 1024
+    except Exception:
+        cur = -1
+    peak = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss
+    peak = peak / (1024 * 1024) if sys.platform == "darwin" else peak / 1024  # bytes on macOS, KB on Linux
+    logger.info("[mem] %-40s rss=%6.0f MB peak=%6.0f MB", label, cur, peak)
+
+
+def stream_analysis_json(analysis, fh, *, strip_internal: bool) -> None:
+    """LOW-MEM PATCH: serialize an ``Analysis`` envelope to ``fh`` one module at a
+    time instead of materializing the whole tree as one JSON string (cache) or
+    as a dict tree + stripped copy + string (output). The JSON *content* equals
+    ``model_dump_json(exclude_none=True)`` / ``json.dumps(strip_internal_only(
+    model_dump(mode="json", exclude_none=True)))``; only whitespace differs
+    (compact separators throughout). ``call_sites`` live solely under the
+    symbol table's callables, so the envelope needs no stripping."""
+    from codeanalyzer.schema import strip_internal_only
+
+    from typing import List as _List
+    from pydantic import TypeAdapter
+    from codeanalyzer.schema.py_schema import ParamEdge, PyCallEdge
+
+    app = analysis.application
+    # Detach the big collections, dump the (now small) envelope, then splice
+    # each collection back in at its own slot, streaming it in chunks.
+    big = {
+        "symbol_table": (app.symbol_table, "{}"),
+        "call_graph": (app.call_graph, "[]"),
+        "param_in": (app.param_in, "[]"),
+        "param_out": (app.param_out, "[]"),
+    }
+    try:
+        app.symbol_table, app.call_graph, app.param_in, app.param_out = {}, [], [], []
+        envelope = analysis.model_dump_json(exclude_none=True)
+    finally:
+        app.symbol_table = big["symbol_table"][0]
+        app.call_graph = big["call_graph"][0]
+        app.param_in = big["param_in"][0]
+        app.param_out = big["param_out"][0]
+    slots = []
+    for name, (_value, empty) in big.items():
+        marker = f'"{name}":{empty}'
+        idx = envelope.find(marker)
+        if idx < 0 or envelope.find(marker, idx + 1) >= 0:
+            raise RuntimeError(f"stream_analysis_json: could not locate a unique {name} slot")
+        slots.append((idx + len(marker) - 1, name))  # position of the closing bracket
+    slots.sort()
+    adapters = {
+        "call_graph": TypeAdapter(_List[PyCallEdge]),
+        "param_in": TypeAdapter(_List[ParamEdge]),
+        "param_out": TypeAdapter(_List[ParamEdge]),
+    }
+    CHUNK = 20000
+    pos = 0
+    for cut, name in slots:
+        fh.write(envelope[pos:cut])
+        pos = cut
+        value = big[name][0]
+        first = True
+        if name == "symbol_table":
+            for key, module in value.items():
+                if strip_internal:
+                    body = json.dumps(
+                        strip_internal_only(module.model_dump(mode="json", exclude_none=True)),
+                        separators=(",", ":"),
+                    )
+                else:
+                    body = module.model_dump_json(exclude_none=True)
+                fh.write(("" if first else ",") + json.dumps(key) + ":" + body)
+                first = False
+        else:
+            adapter = adapters[name]
+            for i in range(0, len(value), CHUNK):
+                chunk = adapter.dump_json(value[i:i + CHUNK], exclude_none=True).decode()
+                inner = chunk[1:-1]  # strip the chunk's own [ ]
+                if inner:
+                    fh.write(("" if first else ",") + inner)
+                    first = False
+    fh.write(envelope[pos:])
+
+
 def _ensure_ray() -> None:
     """Initialize Ray with the driver's pinned hash seed in the workers.
 
@@ -60,13 +147,23 @@ def _ensure_ray() -> None:
     interpreters, so Jedi inference in Ray workers would run with random
     set-iteration order and the emitted edges vary run to run (issue #99)."""
     if not ray.is_initialized():
-        ray.init(
+        # LOW-MEM PATCH: start a private local cluster with object spilling to
+        # disk disabled, a bounded object store, and an optional worker cap
+        # (CANPY_RAY_CPUS); shut down after the symbol-table phase so the idle
+        # workers release their memory before the single-process L2-L4 phases.
+        init_kwargs = dict(
             runtime_env={
                 "env_vars": {
                     "PYTHONHASHSEED": os.environ.get("PYTHONHASHSEED", "0")
                 }
             },
+            _system_config={"automatic_object_spilling_enabled": False},
+            object_store_memory=int(os.environ.get("CANPY_RAY_OBJECT_STORE", 1_000_000_000)),
+            include_dashboard=False,
         )
+        if os.environ.get("CANPY_RAY_CPUS"):
+            init_kwargs["num_cpus"] = int(os.environ["CANPY_RAY_CPUS"])
+        ray.init(**init_kwargs)
 
 
 @ray.remote
@@ -747,7 +844,16 @@ class Codeanalyzer:
                 k=self.options.graph_field_depth,
                 oracle_factory=lambda c, fast: SyntacticOracle(),
             )
+            del _func_asts  # LOW-MEM PATCH: unused at L3; drop the def-node ASTs now
             emit_l3_body(app, infos, sig_to_id, set(self.options.graphs.split(",")))
+            # LOW-MEM PATCH: L4 only needs the syntactic DDG *sets* (for the
+            # points-to delta), not the PDGs with their statement ASTs.
+            from codeanalyzer.dataflow.builder import syntactic_ddg_sets
+            syn_ddg_sets = syntactic_ddg_sets(app, infos, sig_to_id)
+            infos.clear()
+            del infos
+            gc.collect()
+            _log_mem("after L3 emit (L3 PDGs freed)")
 
         # L4: interprocedural dataflow (param vertices + summary + param_in/out)
         # layered on top of the L3 syntactic overlay (L3 ⊆ L4). Scalpel is the
@@ -772,7 +878,14 @@ class Codeanalyzer:
             # Semantic ddg delta: the alias-derived def-use edges the real
             # oracle adds beyond the L3 syntactic set, tagged prov=["points-to"].
             # ``infos`` are the syntactic (L3) PDGs from the >=3 block above.
-            emit_ddg_pointsto_delta(app, infos, ir, sig_to_id)
+            emit_ddg_pointsto_delta(app, syn_ddg_sets, ir, sig_to_id)
+            # LOW-MEM PATCH: the L3/L4 intermediates (per-function PDGs with their
+            # statement ASTs, SDG IR) are dead from here on; free them before the
+            # config tiers and serialization instead of at analyze() return.
+            del ir
+            del syn_ddg_sets
+            gc.collect()
+            _log_mem("after L4 emit (intermediates freed)")
 
         # config_use (#162) resolution: literal tier always runs at >= 2;
         # the dataflow tiers widen the set as substrate comes online -- intra
@@ -872,7 +985,8 @@ class Codeanalyzer:
         cache_file.parent.mkdir(parents=True, exist_ok=True)
 
         with cache_file.open('w') as f:
-            f.write(model_dump_json(analysis, indent=2))
+            stream_analysis_json(analysis, f, strip_internal=False)  # LOW-MEM PATCH
+        _log_mem("after cache save")
 
         logger.info(f"Analysis cached to {cache_file}")
 
@@ -1013,6 +1127,8 @@ class Codeanalyzer:
                         if result:
                             symbol_table.update(result)
                         progress.advance()
+                ray.shutdown()  # LOW-MEM PATCH: release the worker pool's memory
+                logger.info("Ray shut down after the symbol-table phase.")
         else:
             logger.info("Building symbol table serially.")
             symbol_table_builder = SymbolTableBuilder(self.project_dir, self.virtualenv)

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/access_paths.py

@@ -126,7 +126,7 @@ class FunctionScope:
         return "global"  # unknown free name: a module/builtin binding
 
 
-@dataclass
+@dataclass(slots=True)  # LOW-MEM PATCH: slots
 class StatementFacts:
     """Defs and uses (k-limited access-path strings) of one CFG node."""
 

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/builder.py

@@ -50,6 +50,14 @@ from codeanalyzer.utils import logger
 
 DEFAULT_K_LIMIT = 3
 
+# LOW-MEM PATCH: one shared provenance list per kind instead of a fresh
+# ``["ssa"]`` list object on each of the (tens of) millions of DDG edges. The
+# lists are never mutated; equality comparisons (``e.prov != [...]``) and JSON
+# serialization are unaffected.
+_PROV_SSA = ["ssa"]
+_PROV_REACHING_DEFS = ["reaching-defs"]
+_PROV_POINTS_TO = ["points-to"]
+
 
 def _walk_callables(
     module: PyModule,
@@ -339,7 +347,7 @@ def emit_l3_body(
                         src=im.local(e.source),
                         dst=im.local(e.target),
                         var=e.var,
-                        prov=["ssa"],
+                        prov=_PROV_SSA,
                     )
                     for e in pdg.edges
                     if e.type == "DDG"
@@ -442,6 +450,16 @@ def build_program_graphs(
                 if nested_sig in infos:
                     info.nested_defs.append((node.id, nested_sig))
 
+    # LOW-MEM PATCH: from here on (summary fixpoint, SDG assembly, L4 emit) no
+    # stage reads a statement's AST -- only CFG node ids/positions, facts and
+    # oracles. Drop the def-node map and the per-node AST references so the
+    # whole-program AST copy this pass parsed is collected before the two most
+    # memory-hungry stages run.
+    func_asts.clear()
+    for info in infos.values():
+        for node in info.pdg.cfg.nodes:
+            node.ast_node = None
+
     call_edges = [
         (e.src, e.dst)
         for e in app.call_graph
@@ -609,7 +627,7 @@ def emit_l4(
                 continue
             seen.add(key)
             rows.append(
-                DdgEdge(src=src, dst=dst, var=e.var, prov=["reaching-defs"])
+                DdgEdge(src=src, dst=dst, var=e.var, prov=_PROV_REACHING_DEFS)
             )
         rows.sort(key=lambda r: (r.src, r.dst, r.var or ""))
         pycallable.ddg.extend(rows)
@@ -629,9 +647,36 @@ def _ddg_local_set(im, pdg) -> Set[Tuple[str, str, Optional[str]]]:
     }
 
 
+def syntactic_ddg_sets(
+    app: PyApplication,
+    infos: Dict[str, FunctionInfo],
+    sig_to_id: Dict[str, str],
+) -> Dict[str, Set[Tuple[str, str, Optional[str]]]]:
+    """LOW-MEM PATCH: precompute, per signature, the L3 syntactic DDG set in the
+    exact form :func:`emit_ddg_pointsto_delta` derives from ``syntactic_infos``
+    (local ids are position-based, so an IdentityMap over the syntactic PDG
+    yields the same locals as one over the L4 PDG). Lets the caller free the L3
+    ``FunctionInfo`` records -- and the statement ASTs they pin -- before L4."""
+    from codeanalyzer.dataflow.identity import IdentityMap
+
+    sig_to_callable: Dict[str, PyCallable] = {}
+    for module in app.symbol_table.values():
+        for pycallable, _chain in _walk_callables(module):
+            sig_to_callable[pycallable.signature] = pycallable
+    out: Dict[str, Set[Tuple[str, str, Optional[str]]]] = {}
+    for sig, info in infos.items():
+        pycallable = sig_to_callable.get(sig)
+        if pycallable is None:
+            continue
+        callable_id = sig_to_id.get(sig) or pycallable.id
+        im = IdentityMap.for_function(callable_id, info.pdg)
+        out[sig] = _ddg_local_set(im, info.pdg)
+    return out
+
+
 def emit_ddg_pointsto_delta(
     app: PyApplication,
-    syntactic_infos: Dict[str, FunctionInfo],
+    syntactic_infos,
     ir: ProgramGraphsIR,
     sig_to_id: Dict[str, str],
 ) -> None:
@@ -678,12 +723,14 @@ def emit_ddg_pointsto_delta(
         # untouched — they are L3's and this delta is strictly additive over them.
         pycallable.ddg = [e for e in pycallable.ddg if e.prov != ["points-to"]]
 
-        delta = _ddg_local_set(im, fg.pdg) - _ddg_local_set(im, syn.pdg)
+        # LOW-MEM PATCH: accept a precomputed syntactic set (see syntactic_ddg_sets).
+        syn_set = syn if isinstance(syn, (set, frozenset)) else _ddg_local_set(im, syn.pdg)
+        delta = _ddg_local_set(im, fg.pdg) - syn_set
         for src, dst, var in sorted(delta, key=lambda t: (t[0], t[1], t[2] or "")):
             if src not in pycallable.body or dst not in pycallable.body:
                 continue
             pycallable.ddg.append(
-                DdgEdge(src=src, dst=dst, var=var, prov=["points-to"])
+                DdgEdge(src=src, dst=dst, var=var, prov=_PROV_POINTS_TO)
             )
 
 

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/cfg.py

@@ -102,7 +102,7 @@ EDGE_KINDS = (
 )
 
 
-@dataclass
+@dataclass(slots=True)  # LOW-MEM PATCH: slots
 class CFGNode:
     """A statement-level CFG node. ``id`` is assigned in source-span order
     after construction (ENTRY = 0, EXIT = last CFG id)."""
@@ -118,7 +118,7 @@ class CFGNode:
     ast_node: Optional[ast.AST] = field(default=None, repr=False, compare=False)
 
 
-@dataclass(frozen=True)
+@dataclass(slots=True, frozen=True)  # LOW-MEM PATCH: slots
 class CFGEdge:
     source: int
     target: int

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/defuse.py

@@ -44,7 +44,7 @@ from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.cfg import ControlFlowGraph
 
 
-@dataclass(frozen=True)
+@dataclass(slots=True, frozen=True)  # LOW-MEM PATCH: slots
 class DDGEdge:
     source: int  # the def node
     target: int  # the use node

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/pdg.py

@@ -42,7 +42,7 @@ from codeanalyzer.dataflow.defuse import ddg_edges
 from codeanalyzer.dataflow.dominance import control_dependence
 
 
-@dataclass(frozen=True)
+@dataclass(slots=True, frozen=True)  # LOW-MEM PATCH: slots
 class PDGEdge:
     source: int
     target: int

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/sdg.py

@@ -59,7 +59,7 @@ CAPTURE_PREFIX = "<capture>:"
 GLOBAL_PREFIX = "<global>:"
 
 
-@dataclass
+@dataclass(slots=True)  # LOW-MEM PATCH: slots
 class ParamNode:
     id: int
     kind: str  # formal_in | formal_out | actual_in | actual_out
@@ -69,7 +69,7 @@ class ParamNode:
     end_line: int = -1
 
 
-@dataclass(frozen=True)
+@dataclass(slots=True, frozen=True)  # LOW-MEM PATCH: slots
 class SDGEdge:
     source_sig: str
     source_node: int
@@ -142,6 +142,26 @@ class _FunctionAssembler:
 
     # ---------------------------------------------------------------- formals
 
+    def formal_for(self, var: str) -> Optional[int]:
+        """The ``formal_in`` vertex that defines ``var`` in this callable.
+
+        A parameter, a capture and a read global are all defined at a
+        ``formal_in`` port, not at the synthetic CFG ENTRY node. Reaching-def
+        analysis reports ENTRY as the source for all three, so every place that
+        consumes a raw def source has to remap it here, or the SDG loses the
+        hop from the parameter to whatever uses it. Returns ``None`` when
+        ``var`` is not one of this callable's formals, so a caller can keep the
+        original source.
+        """
+        b = base_of(var)
+        if b in self.formal_in:
+            return self.formal_in[b]
+        if CAPTURE_PREFIX + b in self.formal_in:
+            return self.formal_in[CAPTURE_PREFIX + b]
+        if "::" in b and GLOBAL_PREFIX + b in self.formal_in:
+            return self.formal_in[GLOBAL_PREFIX + b]
+        return None
+
     def build_formals(self) -> None:
         scope, summary = self.scope, self.summary
         params = list(scope.params)
@@ -168,14 +188,8 @@ class _FunctionAssembler:
         for e in self.ddg:
             if e.source != entry:
                 continue
-            b = base_of(e.var)
-            if b in self.formal_in:
-                fid = self.formal_in[b]
-            elif CAPTURE_PREFIX + b in self.formal_in:
-                fid = self.formal_in[CAPTURE_PREFIX + b]
-            elif "::" in b and GLOBAL_PREFIX + b in self.formal_in:
-                fid = self.formal_in[GLOBAL_PREFIX + b]
-            else:
+            fid = self.formal_for(e.var)
+            if fid is None:
                 continue
             self.extra.append(PDGEdge(source=fid, target=e.target, type="DDG", var=e.var))
 
@@ -268,6 +282,8 @@ class _FunctionAssembler:
                         for src, var in self._defs_reaching_call_matching(
                             cs.node_id, path
                         ):
+                            if src == self.cfg.entry_id:
+                                src = self.formal_for(var) or src
                             self.extra.append(
                                 PDGEdge(source=src, target=aid, type="DDG", var=var)
                             )
@@ -296,6 +312,8 @@ class _FunctionAssembler:
                         for src, var in self._defs_reaching_call_matching(
                             cs.node_id, g
                         ):
+                            if src == self.cfg.entry_id:
+                                src = self.formal_for(var) or src
                             self.extra.append(
                                 PDGEdge(source=src, target=aid, type="DDG", var=var)
                             )

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/dataflow/summaries.py

@@ -102,15 +102,21 @@ def _is_global(path: str) -> bool:
 
 def augmented_facts(info: FunctionInfo, summaries: Dict[str, FunctionSummary]):
     """Per-node facts with callee global footprints injected at callsites."""
-    facts = {nid: f for nid, f in info.pdg.facts.items()}
-    out = {}
-    for nid, f in facts.items():
-        out[nid] = type(f)(defs=set(f.defs), uses=set(f.uses))
+    # LOW-MEM PATCH: copy-on-write. Only call-site nodes are ever augmented, and
+    # every downstream consumer (reaching-defs, flows, the SDG assembler) only
+    # reads facts, so the untouched nodes can share the PDG's own records
+    # instead of being deep-copied for every solve.
+    out = dict(info.pdg.facts)
+    copied = set()
     for cs in info.call_sites:
         for target in cs.targets:
             s = summaries.get(target)
             if s is None:
                 continue
+            if cs.node_id not in copied:
+                f = out[cs.node_id]
+                out[cs.node_id] = type(f)(defs=set(f.defs), uses=set(f.uses))
+                copied.add(cs.node_id)
             out[cs.node_id].uses |= s.global_reads
             out[cs.node_id].defs |= s.global_writes
     return out

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/entrypoints/matching.py

@@ -104,8 +104,12 @@ def _methods_of(dec, spec: Optional[Dict[str, Any]], qualified: Optional[str] =
         return []
     source = spec.get("from")
     if source == "match_suffix":
+        # Only a real verb: `heuristic.http-verb` also matches `.websocket`, and a
+        # rule may accept any suffix, but `http_methods` is what a consumer filters
+        # on to enumerate methods -- a value that is not one is worse there than an
+        # empty list (#213). The dispatch path below already filters the same way.
         verb = (qualified or dec.qualified_name or "").rsplit(".", 1)[-1]
-        return [verb.upper()]
+        return [verb.upper()] if verb.lower() in _HTTP_VERBS else []
     if source == "keyword":
         raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
         value = _literal(raw)

{codeanalyzer_python-1.5.3 → codeanalyzer_python-1.6.0}/codeanalyzer/neo4j/cypher.py

@@ -156,3 +156,86 @@ def _edge_statements(edges: List[EdgeRow]) -> List[str]:
                 f"SET r += row.p;"
             )
     return blocks
+
+
+# ----------------------------------------------------------------------------------------------
+# LOW-MEM PATCH: streaming snapshot writer (see write_cypher_streaming).
+# ----------------------------------------------------------------------------------------------
+from codeanalyzer.neo4j.rows import EdgeRow, GraphRows, NodeRef, RowBuilder  # noqa: E402
+
+
+class _NodesOnlyBuilder(RowBuilder):
+    """Pass 1: nodes (merged props/labels, exactly as RowBuilder) + key set; no edges."""
+
+    def edge(self, type_, from_ref, to_ref, props=None, key=None):
+        return None
+
+    def edge_to_symbol(self, type_, from_ref, target_ref, props=None):
+        return None
+
+
+class _EdgeStreamBuilder(RowBuilder):
+    """Pass 2: nodes are already on disk; each edge batch is rendered with
+    ``_edge_statements`` (same grouping/BATCH) the moment it fills."""
+
+    def __init__(self, keys, fh):
+        super().__init__()
+        self._keys = keys
+        self._fh = fh
+        self._pending: Dict[str, List[EdgeRow]] = {}
+
+    def node(self, labels, key_prop, value, props):
+        return NodeRef(labels[0], key_prop, value)
+
+    def edge(self, type_, from_ref, to_ref, props=None, key=None):
+        e = EdgeRow(type_, from_ref, to_ref, dict(props or {}), key)
+        g = (
+            f"{e.type}|{e.from_ref.label}.{e.from_ref.key_prop}"
+            f"|{e.to_ref.label}.{e.to_ref.key_prop}|{e.key is not None}"
+        )
+        batch = self._pending.setdefault(g, [])
+        batch.append(e)
+        if len(batch) >= BATCH:
+            self._flush(g)
+
+    def edge_to_symbol(self, type_, from_ref, target_ref, props=None):
+        if (target_ref.label, target_ref.value) in self._keys:
+            self.edge(type_, from_ref, target_ref, props)
+
+    def _flush(self, g):
+        batch = self._pending.pop(g, None)
+        if batch:
+            for stmt in _edge_statements(batch):
+                self._fh.write(stmt)
+                self._fh.write("\n")
+
+    def finish(self) -> GraphRows:
+        for g in list(self._pending):
+            self._flush(g)
+        return GraphRows([], [])
+
+
+def write_cypher_streaming(fh, app, app_name: str, sig_to_id: dict, analyzer=None) -> None:
+    """Write the ``graph.cypher`` snapshot for ``app`` to ``fh`` without holding the
+    edge rows or the rendered text in memory (two projection passes)."""
+    from codeanalyzer.neo4j.project import project
+
+    nodes_b = _NodesOnlyBuilder()
+    project(app, app_name, sig_to_id, analyzer=analyzer, builder=nodes_b)
+    rows = nodes_b.finish()
+    keys = nodes_b._keys
+
+    fh.write("// ── constraints & indexes ──\n")
+    for stmt in CONSTRAINTS:
+        fh.write(f"{stmt};\n")
+    for stmt in INDEXES:
+        fh.write(f"{stmt};\n")
+    fh.write("\n// ── wipe this project's prior subgraph (externals/packages/decorators are shared) ──\n")
+    fh.write(_wipe(app_name) + "\n")
+    fh.write("\n// ── nodes ──\n")
+    for stmt in _node_statements(rows.nodes):
+        fh.write(stmt + "\n")
+    del rows, nodes_b
+
+    fh.write("\n// ── relationships ──\n")
+    project(app, app_name, sig_to_id, analyzer=analyzer, builder=_EdgeStreamBuilder(keys, fh))