Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
react-bits' tools and backgrounds carry the highest activity risk — 5 functions to address first
Two functions in react-bits are both structurally complex and actively changing right now, making them live regression risks for anyone shipping code this week. Three more copies of the same ShapeGrid component sit untouched for 42 days with enough structural complexity that the next engineer to open them will be walking into a minefield.
streamlit's server and script-runner layer carries the highest activity risk — 5 functions to address first
Five functions in streamlit's core layers are simultaneously the most structurally complex and the most actively touched — meaning every commit landing on them this week is a regression bet made against code that already has up to 136 independent execution paths. If your team is shipping to streamlit's server or script-runner subsystems right now, these are the numbers that should be on your radar.
tesseract.js's worker-script carries the highest activity risk — 4 functions
Four of the five most complex, recently-changed functions in tesseract.js share the same file: src/worker-script/index.js. That concentration means a single developer touching that module today is navigating overlapping god functions, branching paths into the dozens, and fan-out counts that would stress any static analysis tool — all while the file is still being committed to.
Phaser's tween builder and WebGL renderer carry the highest activity risk — 5 functions
Five functions in Phaser's tween builder, texture parser, utility layer, WebGL renderer, and tilemap system all sit in the fire quadrant right now — structurally complex and touched within the last 24 hours. Any engineer shipping Phaser code this week is working within blast radius of at least one of them.
video.js's events.js carries the highest structural debt — 3 functions to address first
Three of the top five hotspots in videojs/video.js come from the same file — src/js/utils/events.js — meaning the event-handling module isn't just one overdue cleanup item but a concentration of structural debt that will bite whoever touches it next. I'd treat that file as a single refactoring project, not three separate tickets.
VitePress's router and plugin layer carry the highest structural debt — 5 functions to address first
The riskiest function in vuejs/vitepress hasn't been touched in 37 days and carries a cyclomatic complexity of 24 with fan-out to 32 distinct callees — a combination that makes the next person to edit it the inheritor of significant accumulated complexity. All five top-ranked functions sit in the debt quadrant, meaning the pressure is not active churn but blast-radius risk the moment any of them is reopened.
zen-browser/desktop's tab and split-view layer carries the highest activity risk — 5 functions to address first
Five functions in zen-browser/desktop are both structurally complex and receiving active commits right now, putting them squarely in live-regression territory. The tab management and split-view subsystems dominate the critical band, and any engineer shipping to these areas this week is working on some of the densest branching logic in the repository.
yarn's PnP resolver carries the highest structural debt — 4 functions to address first
Four of the five highest-risk functions in yarnpkg/yarn live in a single file — `src/util/generate-pnp-map-api.tpl.js` — and none of them have been touched in nearly six years. That concentration of structural debt in one module means that when the PnP resolution layer is next opened for changes, the engineer doing the work will be navigating some of the most complex code in the repository.
nw.js's test vendor bundle carries the highest activity risk — 4 functions to address first
Four of the five highest-risk functions in nw.js's codebase all live in the same file — a vendor bundle checked into the test tree. That concentration means any commit touching `test/sanity/issue7197-load/js/chunk-vendors.6e82bc79.js` is simultaneously reaching Vue's virtual DOM patching engine, async component resolution, and a minified merge utility, all of them scoring in the critical band.
Swiper's mousewheel and touch modules carry the highest risk — 5 functions to address
Swiper's highest-risk code isn't where the commits are — it's in the functions that haven't been touched in 97 days but would take a seasoned engineer a full day to reason through safely. The one exception, `onTouchMove`, is the opposite problem: CC 127, three commits in the last 30 days, and two authors working on it right now.
parcel's compiler core carries the highest structural debt — 5 functions to fix first
The riskiest code in parcel-bundler/parcel isn't on fire right now — it's a slow-burning fuse. Five critical-band functions in the Rust compiler core have sat untouched for 239 days, each carrying enough structural complexity that the next developer to modify any of them faces a high probability of introducing a regression.
gofiber/fiber's middleware layer carries the highest activity risk — 5 functions to address first
The cache middleware's `New` function in gofiber/fiber has a cyclomatic complexity of 56 — nearly five times the moderate threshold — and was touched 7 times in the last 30 days, making it a live regression risk right now, not a backlog item. Across 1,444 analyzed functions, 145 land in the critical band, and the structural patterns concentrated in the middleware layer tell a specific story about where the next bug is most likely to be introduced.
wshobson/agents' tooling layer carries the highest activity risk — 5 functions to address first
Every one of the five highest-risk functions in wshobson/agents sits in the tools/ layer, and all five are in the 'fire' quadrant — meaning they are both structurally complex and receiving commits right now. If you are shipping changes to the agent tooling pipeline this week, these are the functions where a regression is most likely to hide.
Leaflet's GeoJSON and map core carry the highest activity risk — 5 to address first
Leaflet's GeoJSON conversion entry point and its map-level event dispatcher are both structurally complex and receiving commits right now, making them live regression risks rather than backlog items. I found 20 critical-band functions across 956 total in this codebase, and the most urgent two are sitting at the intersection of high cyclomatic complexity and recent commit activity.
meteor/meteor's core packages carry the highest structural debt — 5 functions to address first
Meteor's highest-risk code isn't actively on fire right now — it's a cluster of structurally complex functions that haven't been touched in weeks, sitting in the webapp server, mongo replication layer, and package toolchain, waiting for the next developer who has to change them. With 332 functions in the critical band across 5,292 analyzed, the question isn't whether this debt will cost something, but when.
monaco-editor's LSP and tokenization layer carries the highest structural debt — 5 functions to address first
Every one of monaco-editor's top five risk functions sits in the 'debt' quadrant: complex, untouched for 61 days, and owned by a single author in the last 90 days. The next developer who needs to change the JSON tokenizer or any of the LSP symbol-mapping functions will be walking into the highest structural complexity in the repository with essentially no recent institutional memory to lean on.
serverless/serverless's auth layer carries the highest activity risk — 5 to address first
All five of the highest-risk functions in serverless/serverless sit in the fire quadrant — structurally complex and touched within the last 11 days — which means any engineer shipping code this week is working alongside active changes in the most tangled parts of the codebase. I'd start with `getAuthenticatedData` in the auth layer: a cyclomatic complexity of 91 combined with recent commit activity makes it a live regression risk, not a cleanup item for the backlog.
htmx's structural debt is concentrated — 5 functions to address first
The riskiest function in htmx hasn't been modified in 78 days — but with a cyclomatic complexity of 49, a nesting depth of 14, and 31 distinct function calls, the next developer who touches it will be navigating one of the most structurally dense functions in the repo without the benefit of recent familiarity. All five top hotspots sit in the debt quadrant: no active churn, but significant structural complexity waiting to bite.
claude-mem's SearchManager.ts carries the highest activity risk — 4 functions to address first
Four of the five highest-risk functions in thedotmack/claude-mem live in a single file, and all of them changed in the last two days — that concentration is the real story. When structurally dense search logic is both hard to reason about and actively in motion, the window for introducing a regression is open right now, not at some future refactoring milestone.
worldmonitor's notification layer carries the highest activity risk — 5 functions to address first
Five functions across worldmonitor's notification relay, digest pipeline, and channel API are simultaneously among the most structurally complex in the codebase and still receiving commits this week. If you are shipping changes to any of these paths right now, you are doing it inside code that cyclomatic complexity analysis flags as extreme — and the live commit signal makes that a regression risk today, not a backlog item.
redis/redis's module and networking layer carries the highest structural debt — 5 functions to address first
The riskiest function in redis/redis hasn't been touched in 51 days, but when it is next changed, whoever opens it will face a nesting depth of 13 and a long if-else chain dispatching across more than a dozen distinct server events. That structural weight is sitting silently in five critical-band functions spread across the module system, client lifecycle, cluster slot migration, and blocked-client machinery — none of them are burning right now, but all of them are overdue for refactoring before the next development push.
upscayl's electron commands carry the highest structural debt — 5 functions to address first
Every one of upscayl's top-ranked functions sits in the debt quadrant — structurally complex code that nobody has touched in months, some for over a year. The question isn't whether these functions are changing right now; it's what happens to the next developer who has to change them cold.
react-native-chart-kit's render layer carries the highest structural debt — 5 functions to address first
The riskiest code in react-native-chart-kit isn't actively on fire — it's been sitting untouched for over a month, quietly accumulating blast radius. Four of the five top-ranked functions are monolithic render methods that no one has touched in 32 days, and the structural complexity they carry means the next developer to open one of those files is in for a rough time.
mattermost/mattermost's API and notification layer carries the highest activity risk — 5 functions to address first
Five functions across mattermost's server API, frontend notification logic, and admin console are simultaneously the hardest to reason about and the most recently changed — meaning any engineer shipping code this week is working right next to live regression risk. The top hotspot, `getUsers` in `server/channels/api4/user.go`, carries an activity-weighted risk of 20.86 with a cyclomatic complexity of 33, a nesting depth of 8, and 55 distinct callees — and it was changed 0 days ago.