Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
xyflow's system layer carries the highest activity risk — 5 functions to address first
xyflow's drag system is carrying a CC of 42 and fans out to 32 distinct callees — structural debt that will bite hard the next time anyone touches it.
google/zx's markdown layer is the live regression risk — 4 structural debt functions follow
zx's markdown transformer is the live regression risk — CC 18 and actively changing. _pipe and formatCmd are structural debt: equally complex, but stable for months and overdue for proactive refactoring.
context7's CLI commands carry the highest activity risk — 5 functions to address first
context7's CLI command layer is where complexity and commit churn collide: generateCommand has a fan-out of 99 and is actively changing, making every edit a regression risk.
marked's Tokenizer and Instance layers carry the highest activity risk — 3 functions to address first
marked's list tokenizer scores CC 51 with fan-out 31 — structural debt that hasn't been touched in 33 days and carries a high blast radius when next changed.
react-hook-form's control layer carries the highest activity risk — 3 functions first
The function that powers every react-hook-form instance has CC 174 and touched 112 distinct callees — still being actively changed. That combination turns complexity into regression risk.
typeorm's query-builder and driver layer carries the highest activity risk — 5 functions to address first
typeorm's WHERE-clause builder and Postgres type-conversion functions are simultaneously the most complex and most actively changed code in the repo — where structural debt meets commit velocity.
styled-components' CSS parsing layer carries the highest activity risk — 4 functions to address first
styled-components' CSS parsing layer mixes structural debt (sanitizeCSS, hasUnbalancedBraces — untouched 39 days) with actively changing fire-quadrant functions, making it a high blast-radius refactoring target.
chalk/chalk's vendor layer carries the highest activity risk — 3 functions to address first
chalk's riskiest code isn't in its core index.js — it's inside two vendored files carrying structural debt frozen in place for years, with high blast radii that warrant refactoring before the vendor copies are next updated.
lossless-cut's renderer layer leads activity risk — 5 functions to address first
lossless-cut's App function has a cyclomatic complexity of 143 and calls 394 distinct functions — and it's still being actively changed, making every commit a regression gamble.
Zod's JSON schema layer carries the highest activity risk — 5 functions to address first
Zod's JSON schema conversion layer is actively changing while carrying extreme structural complexity — one function alone has 114 execution paths and calls 79 distinct functions.
full-stack-fastapi-template's HTTP client layer carries the highest activity risk — 2 functions to address first
The HTTP client layer in full-stack-fastapi-template carries a cyclomatic complexity of 15 and 5 levels of nesting while seeing active commit churn — a live regression risk, not a future cleanup item.
lerna's oidc and command initializers carry the highest activity risk — 3 to prioritize
lerna's oidc function hits CC 35 — structurally complex with a high blast radius when next changed. At 127 days untouched, it's overdue for refactoring before the next development push on the authentication layer.
oh-my-openagent's event and hooks layer carries the highest activity risk — 5 functions to address first
The event plugin and pre/post tool-use hooks in oh-my-openagent are simultaneously the most structurally complex and the most actively changed code in the repo — a combination that makes them live reg
umami's API and tracker layer carry the highest activity risk — 5 functions to address first
umami's event ingestion endpoint and client tracker are structurally complex and still actively changing — a combination that makes regressions hard to catch and fixes expensive to ship.
hexojs/hexo's post-rendering layer carries the highest activity risk — 5 functions to address first
The function that escapes Swig template tags in hexo's post pipeline has a cyclomatic complexity of 61 and hasn't been touched in 114 days — structural debt with a high blast radius that warrants refactoring before the next development push.
ant-design-pro's request and mock layers carry the highest activity risk — 4 functions to address first
The error-handling config in ant-design-pro is both the most structurally complex function in the codebase and a high blast-radius refactoring candidate — structural debt that's been untouched for 60 days.
jsoncrack.com's json2go and parser layers carry the highest activity risk — 5 functions to address first
The json2go converter in jsoncrack.com carries CC 32 and fan-out 47 — deep structural debt untouched for 40 days that represents a high blast-radius risk for any future development on these files.
type-challenges' automation scripts carry the highest activity risk — 3 functions to address first
The riskiest code in type-challenges isn't the type puzzles — it's the automation layer. Three scripts with CC up to 27 and fan-out up to 25 carry deep structural debt that warrants refactoring before the next development push.
chatbox's UI and knowledge-base layers carry the highest activity risk — 5 functions to address first
The main input component in chatbox packs 117 execution paths and touches 142 distinct callees — and it's still being actively committed to, which turns a complexity problem into a live regression ris
tldraw's Editor.ts carries the highest activity risk — 3 functions to address first
Three of tldraw's five highest-risk functions live in one file — and they're all actively changing. That's not a cleanup backlog; it's a live regression surface.
OpenCut's timeline and audio layer carries the highest activity risk — 5 functions to address first
OpenCut's timeline drag-drop hook is simultaneously its most structurally complex and most actively changing function — a combination that turns every commit into a regression gamble.
TanStack/query's persistence and devtools layers carry the highest activity risk — 3 functions to address first
TanStack/query's persistence layer is its hottest code right now — the top-ranked function is both structurally dense and seeing heavy recent commit activity, a combination that makes regressions far
FlowiseAI/Flowise's agent execution layer carries the highest activity risk — 5 functions to address first
The functions powering Flowise's agent execution are not just complex — they're changing constantly, making every commit a regression risk. Five functions in the agent and graph layers all sit in the
eslint's rule engine carries the highest activity risk — 2 functions to address first
The eslint rule most developers rely on to catch dead code also has 114 independent execution paths — and it's still being actively changed. That combination is a live regression risk, not a cleanup b