Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
vitejs/vite's import analysis layer carries the highest activity risk — 5 functions to address first
Across 2,301 functions in vitejs/vite, the import analysis and SSR transform layers concentrate the highest activity-weighted risk — with the top-ranked function scoring 21.04 while being touched 4 times in the last 30 days and modified as recently as today. For anyone shipping code against this repo this week, that combination of structural complexity and active change is worth understanding before the next merge.
swagger-ui's JSON Schema layer carries the highest structural debt — 5 functions to address first
The riskiest code in swagger-api/swagger-ui isn't on fire right now — it's a slow-burning fuse. Five functions in the JSON Schema type-inference and sample-generation layer have gone unmodified for 50 days while carrying complexity scores that make the next developer to touch them significantly exposed.
lighthouse's audits and renderer carry the highest activity risk — 5 to address first
Five of lighthouse's critical functions are in the 'fire' quadrant right now — structurally complex and touched within the last 30 days — making them live regression risks, not backlog items. The most striking is `_setPerfGaugeExplodey` in the report renderer, which calls 71 distinct functions and carries an activity-weighted risk of 15.09, touched once in the last 30 days, 28 days ago.
parallax/jsPDF: WebPDecoder.js holds the highest structural debt — 4 functions to address
Four of the five highest-risk functions in parallax/jsPDF live in the same file, WebPDecoder.js — and not one of them has been touched in nearly four months. That concentration means any future work on WebP image decoding carries an outsized blast radius before a single line is changed.
sharp's _createInputDescriptor carries the top risk — CC 183, five times the next hotspot
The function `_createInputDescriptor` in sharp's input layer has a cyclomatic complexity of 183 — a number that puts it in a different structural category from every other function in the codebase, including the next four highest-risk functions whose complexity scores top out at 35. What makes this more than a cleanup problem is that it was touched 3 times in the last 30 days and carries an activity-weighted risk score of 20.24, meaning structural complexity and active development are colliding in exactly the place where all image input is normalized.
netron's core viewer and tooling carry the highest activity risk — 5 functions to address first
Five functions in lutzroeder/netron are both structurally extreme and actively changing right now — including a schema builder that was committed to yesterday and a format-detection function touched twice in the last two days. Any engineer shipping to this codebase this week is working adjacent to live regression risk.
learnGitBranching's app layer carries structural debt — 5 functions to address first
Every one of the five highest-risk functions in learnGitBranching has gone untouched for at least 46 days, yet several carry enough structural complexity to make the next developer who opens them work hard just to understand what they're reading. The risk here isn't an emergency — it's a slow accumulation of structural debt that will become an emergency the moment someone needs to extend any of these entry points.
large-monorepo's benchmark.js carries the highest activity risk — 3 functions to watch first
When I ran Hotspots against vsavkin/large-monorepo, the entire top of the risk list collapsed into a single file: benchmark.js, which accounts for all three of the repository's highest-scoring functions. That concentration tells a specific story about where change pressure is currently landing in this codebase.
Aider's core coder and I/O layers carry the highest structural debt — 5 functions to address first
Every one of aider's top five riskiest functions sits in the debt quadrant — structurally complex, untouched for 66 days, and waiting for the next developer to open them. The most striking case is `send_message` in `base_coder.py`, a single function with 99 independent execution paths that calls 47 distinct callees — in Python, where type resolution happens at runtime, that fan-out is broader than it looks on paper.
CyberChef's core ops carry the highest activity risk — 5 functions to address first
Five functions in CyberChef's core operations layer are simultaneously structurally complex and actively changing — meaning any engineer who merged code in the last eight days was working inside some of the highest-risk surfaces in the repository. The top-ranked function, `run` in `ParseIPv6Address.mjs`, carries an activity-weighted risk score of 19.46 with a cyclomatic complexity of 102 and was touched just 8 days ago — that combination makes it a live regression risk, not a backlog item.
react-bits' tools and backgrounds carry the highest activity risk — 5 functions to address first
Two functions in react-bits are both structurally complex and actively changing right now, making them live regression risks for anyone shipping code this week. Three more copies of the same ShapeGrid component sit untouched for 42 days with enough structural complexity that the next engineer to open them will be walking into a minefield.
streamlit's server and script-runner layer carries the highest activity risk — 5 functions to address first
Five functions in streamlit's core layers are simultaneously the most structurally complex and the most actively touched — meaning every commit landing on them this week is a regression bet made against code that already has up to 136 independent execution paths. If your team is shipping to streamlit's server or script-runner subsystems right now, these are the numbers that should be on your radar.
tesseract.js's worker-script carries the highest activity risk — 4 functions
Four of the five most complex, recently-changed functions in tesseract.js share the same file: src/worker-script/index.js. That concentration means a single developer touching that module today is navigating overlapping god functions, branching paths into the dozens, and fan-out counts that would stress any static analysis tool — all while the file is still being committed to.
Phaser's tween builder and WebGL renderer carry the highest activity risk — 5 functions
Five functions in Phaser's tween builder, texture parser, utility layer, WebGL renderer, and tilemap system all sit in the fire quadrant right now — structurally complex and touched within the last 24 hours. Any engineer shipping Phaser code this week is working within blast radius of at least one of them.
video.js's events.js carries the highest structural debt — 3 functions to address first
Three of the top five hotspots in videojs/video.js come from the same file — src/js/utils/events.js — meaning the event-handling module isn't just one overdue cleanup item but a concentration of structural debt that will bite whoever touches it next. I'd treat that file as a single refactoring project, not three separate tickets.
VitePress's router and plugin layer carry the highest structural debt — 5 functions to address first
The riskiest function in vuejs/vitepress hasn't been touched in 37 days and carries a cyclomatic complexity of 24 with fan-out to 32 distinct callees — a combination that makes the next person to edit it the inheritor of significant accumulated complexity. All five top-ranked functions sit in the debt quadrant, meaning the pressure is not active churn but blast-radius risk the moment any of them is reopened.
zen-browser/desktop's tab and split-view layer carries the highest activity risk — 5 functions to address first
Five functions in zen-browser/desktop are both structurally complex and receiving active commits right now, putting them squarely in live-regression territory. The tab management and split-view subsystems dominate the critical band, and any engineer shipping to these areas this week is working on some of the densest branching logic in the repository.
yarn's PnP resolver carries the highest structural debt — 4 functions to address first
Four of the five highest-risk functions in yarnpkg/yarn live in a single file — `src/util/generate-pnp-map-api.tpl.js` — and none of them have been touched in nearly six years. That concentration of structural debt in one module means that when the PnP resolution layer is next opened for changes, the engineer doing the work will be navigating some of the most complex code in the repository.
nw.js's test vendor bundle carries the highest activity risk — 4 functions to address first
Four of the five highest-risk functions in nw.js's codebase all live in the same file — a vendor bundle checked into the test tree. That concentration means any commit touching `test/sanity/issue7197-load/js/chunk-vendors.6e82bc79.js` is simultaneously reaching Vue's virtual DOM patching engine, async component resolution, and a minified merge utility, all of them scoring in the critical band.
Swiper's mousewheel and touch modules carry the highest risk — 5 functions to address
Swiper's highest-risk code isn't where the commits are — it's in the functions that haven't been touched in 97 days but would take a seasoned engineer a full day to reason through safely. The one exception, `onTouchMove`, is the opposite problem: CC 127, three commits in the last 30 days, and two authors working on it right now.
parcel's compiler core carries the highest structural debt — 5 functions to fix first
The riskiest code in parcel-bundler/parcel isn't on fire right now — it's a slow-burning fuse. Five critical-band functions in the Rust compiler core have sat untouched for 239 days, each carrying enough structural complexity that the next developer to modify any of them faces a high probability of introducing a regression.
gofiber/fiber's middleware layer carries the highest activity risk — 5 functions to address first
The cache middleware's `New` function in gofiber/fiber has a cyclomatic complexity of 56 — nearly five times the moderate threshold — and was touched 7 times in the last 30 days, making it a live regression risk right now, not a backlog item. Across 1,444 analyzed functions, 145 land in the critical band, and the structural patterns concentrated in the middleware layer tell a specific story about where the next bug is most likely to be introduced.
wshobson/agents' tooling layer carries the highest activity risk — 5 functions to address first
Every one of the five highest-risk functions in wshobson/agents sits in the tools/ layer, and all five are in the 'fire' quadrant — meaning they are both structurally complex and receiving commits right now. If you are shipping changes to the agent tooling pipeline this week, these are the functions where a regression is most likely to hide.
Leaflet's GeoJSON and map core carry the highest activity risk — 5 to address first
Leaflet's GeoJSON conversion entry point and its map-level event dispatcher are both structurally complex and receiving commits right now, making them live regression risks rather than backlog items. I found 20 critical-band functions across 956 total in this codebase, and the most urgent two are sitting at the intersection of high cyclomatic complexity and recent commit activity.