Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
cal.com's booking layer carries the highest activity risk — 5 functions to address first
Three of cal.com's top five hotspots are named `handler` — all in the booking layer. One has a cyclomatic complexity of 243.
chakra-ui's codemod layer carries the highest activity risk — 2 functions to address first
Chakra-ui's codemod layer is where structural complexity and live commit activity collide: two functions in that package hold critical-band risk scores and were each touched within the past month, making them live regression risks rather than backlog items. If you're shipping codemod tooling for a major migration, these are the two functions that deserve a closer look before the next release.
typescript-cheatsheets/react's tooling layer carries the highest activity risk — 2 functions to address first
Even documentation-focused repos accumulate structural and operational risk in their tooling. In typescript-cheatsheets/react, the readme generator and the homepage component are the two functions most worth watching right now — both touched within the last day, and both carrying fan-out that means changes ripple into several downstream dependencies.
go-gorm/gorm's schema debt leads the risk list — 5 functions to address first
gorm's highest-risk functions are mostly quiet right now, but they carry heavy structural debt: schema field setup, condition building, association saving, schema parsing, and create-value conversion all combine high branching with deep nesting or broad fan-out. The next change in these paths will inherit months of dormancy plus dense control flow.
rustfs storage and protocol hotspots — 5 functions to address first
In rustfs, the highest-priority functions are not concentrated in one subsystem: storage healing, Swift request handling, scanner traversal, lifecycle evaluation, and object listing all appear in the top five. The common theme is structural density — every listed function combines complex branching, deep nesting, exit-heavy flow, god-function scope, and long-function shape.
langextract's batch provider and extraction carry the highest activity risk — 5 hotspots
langextract's core extraction and OpenAI batch provider are both structurally overloaded and actively changing right now — a combination that puts live regression risk on the table, not just future cleanup. With 72 critical-band functions across 348 total, the codebase has meaningful structural debt concentrated in exactly the modules users interact with most.
javascript-interview-questions' deepMerge carries the highest risk — 1 function to address first
A repository built to demonstrate JavaScript mastery has one function quietly accumulating structural debt: deepMerge, untouched for over five months, carries every quality signal worth watching before the next contributor opens it up.
GitNexus's ingestion core carries the highest activity risk — 2 functions to address first
At the heart of GitNexus's ingestion pipeline, two functions are simultaneously the most structurally complex and the most actively changed code in the entire codebase — a combination that turns every commit into a live regression risk. With 544 critical-band functions across 3,612 total, the scope of structural debt here is significant, but two functions demand attention right now.
zoxide's import layer carries the highest activity risk — 3 functions to address first
zoxide's import subsystem is live regression territory right now: two actively changing functions carry cyclomatic complexity of 16–19 while a utility god-function hasn't been touched in 606 days but carries a blast radius of 14 distinct callees.
echo's binding layer carries the highest activity-weighted risk — 5 functions to address
echo's request binding owns the top two risk slots — `bindData` calls 41 distinct functions while `bindValue` branches across 29 execution paths, both in actively committed code across a framework trusted by thousands of Go services.
headscale's policy/v2 layer carries the highest activity risk — 2 functions to address first
headscale's policy engine is where structural complexity meets live development pressure: the two highest-risk functions are both actively changing right now, making them live regression risks rather
graphify's extract layer carries the highest activity risk — 2 functions to address first
graphify's extraction layer is carrying extreme structural complexity while being actively changed — a combination that makes regressions likely with every commit touching extract.py.
BMAD-METHOD's installer module carries the highest activity risk — 5 functions to address first
Five functions in BMAD-METHOD's installer layer combine high cyclomatic complexity with deep nesting and active churn — making the module management subsystem the repo's highest-priority refactoring target.
cherry-studio's AI core and MCP layer carry the highest activity risk — 5 functions to address first
Two functions deep in cherry-studio's MCP integration and AI reasoning layer are both structurally extreme and actively changing — a combination that makes regressions not a future concern, but a pres
chrome-devtools-mcp's response layer carries the highest risk — 2 functions to fix first
Two functions in a single file are driving nearly all of chrome-devtools-mcp's live regression risk — and both were touched in the last two days.
alibaba/canal's adapters carry the highest activity risk — 5 functions to address first
A Hotspots analysis of alibaba/canal at commit cf97b2a, surfacing the top functions by activity-weighted risk score.
agent-browser's React bridge has top activity risk — 5 functions to address first
A Hotspots analysis of vercel-labs/agent-browser at commit 82eadce, surfacing React instrumentation, CLI, and command-parser functions with the highest activity-weighted risk.
3x-ui's bot and inbound paths carry the highest risk — 5 functions to address first
Five functions in 3x-ui are both structurally complex and actively changing right now — one with a cyclomatic complexity of 101. That combination is a live regression risk, not a cleanup backlog item.
minimind's RL trainers carry the highest activity risk — 3 functions to address first
minimind's RL training layer is both its most complex and most actively changing code — two trainer functions at CC 52 with commits landing days ago, making refactoring a live risk.
CowAgent's LLM protocol layer carries the highest activity risk — 2 functions to address first
Two functions in CowAgent are both structurally extreme and changing right now — CC 120+ with nesting 7–11 deep, touched repeatedly in the last 30 days. That combination makes regressions a live risk rather than a cleanup backlog item.
career-ops' analysis layer carries the highest activity risk — 5 functions to address first
The top-ranked function in career-ops has 54 outbound calls and 42 execution paths — and it was touched just 27 days ago. That combination makes it a live regression risk, not a cleanup backlog item.
pi's AI provider and tooling layers carry the highest activity risk — 5 functions to address first
Pi's AI provider layer is its leading regression hotspot, but the top five also include model-data generation, autocomplete, and response-stream processing.
jan's proxy and provider UI carry the highest first-party risk — 2 functions to address first
Three of jan's top five hotspots are bundled Swagger UI code; the two first-party functions to act on are proxy_request (CC 191, fan-out 64) in the Tauri server layer and ProviderDetail (fan-out 106) in the provider settings UI.
WxJava's member card and serialization layers carry the highest structural risk — 5 functions to address first
WxJava's highest-risk function has CC 42 and 72 callees, so the next developer to open it faces a high blast-radius change.