Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
Chat2DB's SQL processing layer carries the highest activity risk — 3 functions to address first
Chat2DB has 385 critical functions across 6,984 analyzed — and its SQL split processor alone carries a cyclomatic complexity of 58 with 38 distinct callees. Here's what to fix first.
casey/just's parser and lexer carry the highest activity risk — 5 functions to address first
just's parser and lexer are both deeply complex and under active development right now — a combination that puts live regressions well within reach as the codebase continues to evolve.
bubbletea's core runtime carries the highest activity risk — 3 functions to address first
Three functions in bubbletea's core runtime are both structurally complex and changing right now — making them live regression risks, not just cleanup items on a backlog.
ai-hedge-fund's frontend layer carries the highest activity risk — 3 files to address first
All five of ai-hedge-fund's top hotspots sit in the frontend layer — and every one is a god function flagged as structural debt with a blast radius waiting to be triggered.
drawdb's editor and SQL layer carry the highest activity risk — 5 functions to address first
drawdb's diagram editor hides a live regression risk: its ControlPanel component is both deeply complex and actively changing right now — CC 55, nesting depth 15, and 163 distinct callees.
gstack's browse layer carries the highest activity risk — 5 functions to address first
gstack's browse layer is under live regression pressure: its top command handlers combine extreme cyclomatic complexity with high recent commit activity, putting every active change at elevated risk.
learn-claude-code's agent layer carries highest activity risk — 5 functions to address
The agent loop functions in learn-claude-code are both structurally complex and actively changing right now — a combination that makes regressions easy to introduce and hard to catch.
get-shit-done's CLI core carries the highest activity risk — 5 functions to address first
Every top hotspot in get-shit-done lives in the CLI layer — and all five are actively changing right now. The command dispatcher alone has 181 execution paths and calls 108 distinct functions.
lx-music-desktop's renderer layer carries the highest structural risk — 5 functions to address first
183 critical functions in lx-music-desktop — and the riskiest ones sit untouched in the renderer layer, accumulating structural debt that will bite hard the next time anyone opens them.
bruno's OpenAPI sync and CLI runner carry the highest activity risk — 3 functions to address first
Two anonymous god-functions in openapi-sync.js (CC 135, CC 100) and a CLI runner function (CC 169) are both structurally extreme and actively changing, making them live regression risks in bruno's request execution layer.
xyflow's system layer carries the highest activity risk — 5 functions to address first
xyflow's drag system is carrying a CC of 42 and fans out to 32 distinct callees — structural debt that will bite hard the next time anyone touches it.
google/zx's markdown layer is the live regression risk — 4 structural debt functions follow
zx's markdown transformer is the live regression risk — CC 18 and actively changing. _pipe and formatCmd are structural debt: equally complex, but stable for months and overdue for proactive refactoring.
context7's CLI commands carry the highest activity risk — 5 functions to address first
context7's CLI command layer is where complexity and commit churn collide: generateCommand has a fan-out of 99 and is actively changing, making every edit a regression risk.
marked's Tokenizer and Instance layers carry the highest activity risk — 3 functions to address first
marked's list tokenizer scores CC 51 with fan-out 31 — structural debt that hasn't been touched in 33 days and carries a high blast radius when next changed.
react-hook-form's control layer carries the highest activity risk — 3 functions first
The function that powers every react-hook-form instance has CC 174 and touched 112 distinct callees — still being actively changed. That combination turns complexity into regression risk.
typeorm's query-builder and driver layer carries the highest activity risk — 5 functions to address first
typeorm's WHERE-clause builder and Postgres type-conversion functions are simultaneously the most complex and most actively changed code in the repo — where structural debt meets commit velocity.
styled-components' CSS parsing layer carries the highest activity risk — 4 functions to address first
styled-components' CSS parsing layer mixes structural debt (sanitizeCSS, hasUnbalancedBraces — untouched 39 days) with actively changing fire-quadrant functions, making it a high blast-radius refactoring target.
chalk/chalk's vendor layer carries the highest activity risk — 3 functions to address first
chalk's riskiest code isn't in its core index.js — it's inside two vendored files carrying structural debt frozen in place for years, with high blast radii that warrant refactoring before the vendor copies are next updated.
lossless-cut's renderer layer leads activity risk — 5 functions to address first
lossless-cut's App function has a cyclomatic complexity of 143 and calls 394 distinct functions — and it's still being actively changed, making every commit a regression gamble.
Zod's JSON schema layer carries the highest activity risk — 5 functions to address first
Zod's JSON schema conversion layer is actively changing while carrying extreme structural complexity — one function alone has 114 execution paths and calls 79 distinct functions.
full-stack-fastapi-template's HTTP client layer carries the highest activity risk — 2 functions to address first
The HTTP client layer in full-stack-fastapi-template carries a cyclomatic complexity of 15 and 5 levels of nesting while seeing active commit churn — a live regression risk, not a future cleanup item.
lerna's oidc and command initializers carry the highest activity risk — 3 to prioritize
lerna's oidc function hits CC 35 — structurally complex with a high blast radius when next changed. At 127 days untouched, it's overdue for refactoring before the next development push on the authentication layer.
oh-my-openagent's event and hooks layer carries the highest activity risk — 5 functions to address first
The event plugin and pre/post tool-use hooks in oh-my-openagent are simultaneously the most structurally complex and the most actively changed code in the repo — a combination that makes them live reg
umami's API and tracker layer carry the highest activity risk — 5 functions to address first
umami's event ingestion endpoint and client tracker are structurally complex and still actively changing — a combination that makes regressions hard to catch and fixes expensive to ship.