Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
headscale's policy/v2 layer carries the highest activity risk — 2 functions to address first
headscale's policy engine is where structural complexity meets live development pressure: the two highest-risk functions are both actively changing right now, making them live regression risks rather
graphify's extract layer carries the highest activity risk — 2 functions to address first
graphify's extraction layer is carrying extreme structural complexity while being actively changed — a combination that makes regressions likely with every commit touching extract.py.
BMAD-METHOD's installer module carries the highest activity risk — 5 functions to address first
Five functions in BMAD-METHOD's installer layer combine high cyclomatic complexity with deep nesting and active churn — making the module management subsystem the repo's highest-priority refactoring target.
cherry-studio's AI core and MCP layer carry the highest activity risk — 5 functions to address first
Two functions deep in cherry-studio's MCP integration and AI reasoning layer are both structurally extreme and actively changing — a combination that makes regressions not a future concern, but a pres
chrome-devtools-mcp's response layer carries the highest risk — 2 functions to fix first
Two functions in a single file are driving nearly all of chrome-devtools-mcp's live regression risk — and both were touched in the last two days.
alibaba/canal's adapters carry the highest activity risk — 5 functions to address first
A Hotspots analysis of alibaba/canal at commit cf97b2a, surfacing the top functions by activity-weighted risk score.
agent-browser's React bridge has top activity risk — 5 functions to address first
A Hotspots analysis of vercel-labs/agent-browser at commit 82eadce, surfacing React instrumentation, CLI, and command-parser functions with the highest activity-weighted risk.
3x-ui's bot and inbound paths carry the highest risk — 5 functions to address first
Five functions in 3x-ui are both structurally complex and actively changing right now — one with a cyclomatic complexity of 101. That combination is a live regression risk, not a cleanup backlog item.
minimind's RL trainers carry the highest activity risk — 3 functions to address first
minimind's RL training layer is both its most complex and most actively changing code — two trainer functions at CC 52 with commits landing days ago, making refactoring a live risk.
CowAgent's LLM protocol layer carries the highest activity risk — 2 functions to address first
Two functions in CowAgent are both structurally extreme and changing right now — CC 120+ with nesting 7–11 deep, touched repeatedly in the last 30 days. That combination makes regressions a live risk rather than a cleanup backlog item.
career-ops' analysis layer carries the highest activity risk — 5 functions to address first
The top-ranked function in career-ops has 54 outbound calls and 42 execution paths — and it was touched just 27 days ago. That combination makes it a live regression risk, not a cleanup backlog item.
pi's AI provider and tooling layers carry the highest activity risk — 5 functions to address first
Pi's AI provider layer is its leading regression hotspot, but the top five also include model-data generation, autocomplete, and response-stream processing.
jan's proxy and provider UI carry the highest first-party risk — 2 functions to address first
Three of jan's top five hotspots are bundled Swagger UI code; the two first-party functions to act on are proxy_request (CC 191, fan-out 64) in the Tauri server layer and ProviderDetail (fan-out 106) in the provider settings UI.
WxJava's member card and serialization layers carry the highest structural risk — 5 functions to address first
WxJava's highest-risk function has CC 42 and 72 callees, so the next developer to open it faces a high blast-radius change.
alist's WebDAV XML layer carries the highest activity risk — 3 functions to address first
Four of alist's top five hotspots sit in the internal WebDAV XML implementation; unmarshal leads with CC 36 and fan-out 66, while UploadByMultipart's fan-out of 48 makes it the clearest storage-driver refactoring target.
labstack/echo's binding and middleware layers carry the highest activity risk — 5 functions to address first
Echo's request-binding layer is the most structurally complex part of the top-five hotspot set, while CSRF and CORS middleware add high-coupling factory functions.
rust-course's rustlings-zh entry points carry the highest structural debt — 2 functions to address first
The two highest-risk functions in rust-course haven't been touched in over three years — but their complexity means the next developer who does will face a steep blast radius.
nanobot's message and CLI layers carry the highest activity risk — 2 functions to address first
nanobot's top two hotspots are both complex AND changing right now — one was touched today. That combination makes them live regression risks, not backlog items.
remote-jobs' link checker carries the highest risk — 5 functions to review first
A single script file, fix-links.mjs, concentrates the highest structural and activity risk in remote-jobs — its top function carries a cyclomatic complexity of 38.
Scrapling's engine layer — 5 functions with the highest activity-weighted risk
Two files in Scrapling's engine layer account for the codebase's highest structural risk — and the top-ranked function has been touched 6 times in the last 30 days with a cyclomatic complexity of 41.
immer's perf scripts and plugins carry the highest risk — 5 functions to review first
immer's highest-ranked hotspots are split between performance tooling and core plugin code. The production concern is concentrated in patches, array method interception, and proxy access paths.
Jest's runtime and mocking layers lead a 5-function risk list to fix first
I went looking for jestjs/jest's most structurally risky functions and found five that are both hard to reason about and being edited right now — not backlog debt, but live regression surface in the ESM loader, the mock engine, and the equality comparator that every test assertion depends on.
Slidev's export and Vite loader paths lead a 5-function risk list to fix first
I looked at where slidev's structural complexity and recent commit activity overlap, and the answer isn't the parser or the theming code — it's the Vite slide loader and the export pipeline, both getting touched right now while carrying fan-out counts north of 60.
Vuetify's color utilities carry the highest activity risk — 5 functions to address first
Two functions in vuetifyjs/vuetify sit at the intersection of extreme structural complexity and active commit churn — making them live regression risks, not backlog items. One parses color values for