javascript Code Health
42 open-source javascript repositories analyzed by activity-weighted risk — complexity × recent commit frequency. Sorted highest risk first.
prettier/prettier's printer layer carries the highest activity risk — 5 functions to address first
Across 3,609 functions in prettier/prettier, five land in the critical band and all five are in the fire quadrant right now — meaning they are both structurally complex and receiving commits this week. If you are shipping prettier patches or consuming its output in a downstream tool, these are the functions where a small change can go wrong quietly.
netron's core viewer and tooling carry the highest activity risk — 5 functions to address first
Five functions in lutzroeder/netron are both structurally extreme and actively changing right now — including a schema builder that was committed to yesterday and a format-detection function touched twice in the last two days. Any engineer shipping to this codebase this week is working adjacent to live regression risk.
Mongoose's query/document layer carries the highest activity risk — 5 functions to address first
Mongoose's query-casting and document-mutation layer is both its most structurally complex code and its most actively changing — five functions scored critical with activity-weighted risk scores between 19.08 and 20.84, meaning engineers are shipping changes into some of the hardest-to-reason-about code in the repository right now. I'd start the conversation with `cast` in `lib/cast.js`: a cyclomatic complexity of 111, a nesting depth of 17, and four touches in the last 30 days make it the single clearest live regression risk in the codebase.
nw.js's test vendor bundle carries the highest activity risk — 4 functions to address first
Four of the five highest-risk functions in nw.js's codebase all live in the same file — a vendor bundle checked into the test tree. That concentration means any commit touching `test/sanity/issue7197-load/js/chunk-vendors.6e82bc79.js` is simultaneously reaching Vue's virtual DOM patching engine, async component resolution, and a minified merge utility, all of them scoring in the critical band.
sharp's _createInputDescriptor carries the top risk — CC 183, five times the next hotspot
The function `_createInputDescriptor` in sharp's input layer has a cyclomatic complexity of 183 — a number that puts it in a different structural category from every other function in the codebase, including the next four highest-risk functions whose complexity scores top out at 35. What makes this more than a cleanup problem is that it was touched 3 times in the last 30 days and carries an activity-weighted risk score of 20.24, meaning structural complexity and active development are colliding in exactly the place where all image input is normalized.
parallax/jsPDF: WebPDecoder.js holds the highest structural debt — 4 functions to address
Four of the five highest-risk functions in parallax/jsPDF live in the same file, WebPDecoder.js — and not one of them has been touched in nearly four months. That concentration means any future work on WebP image decoding carries an outsized blast radius before a single line is changed.
swagger-ui's JSON Schema layer carries the highest structural debt — 5 functions to address first
The riskiest code in swagger-api/swagger-ui isn't on fire right now — it's a slow-burning fuse. Five functions in the JSON Schema type-inference and sample-generation layer have gone unmodified for 50 days while carrying complexity scores that make the next developer to touch them significantly exposed.
CyberChef's core ops carry the highest activity risk — 5 functions to address first
Five functions in CyberChef's core operations layer are simultaneously structurally complex and actively changing — meaning any engineer who merged code in the last eight days was working inside some of the highest-risk surfaces in the repository. The top-ranked function, `run` in `ParseIPv6Address.mjs`, carries an activity-weighted risk score of 19.46 with a cyclomatic complexity of 102 and was touched just 8 days ago — that combination makes it a live regression risk, not a backlog item.
BMAD-METHOD's installer module carries the highest activity risk — 5 functions to address first
Five functions in BMAD-METHOD's installer layer combine high cyclomatic complexity with deep nesting and active churn — making the module management subsystem the repo's highest-priority refactoring target.
Phaser's tween builder and WebGL renderer carry the highest activity risk — 5 functions
Five functions in Phaser's tween builder, texture parser, utility layer, WebGL renderer, and tilemap system all sit in the fire quadrant right now — structurally complex and touched within the last 24 hours. Any engineer shipping Phaser code this week is working within blast radius of at least one of them.
htmx's structural debt is concentrated — 5 functions to address first
The riskiest function in htmx hasn't been modified in 78 days — but with a cyclomatic complexity of 49, a nesting depth of 14, and 31 distinct function calls, the next developer who touches it will be navigating one of the most structurally dense functions in the repo without the benefit of recent familiarity. All five top hotspots sit in the debt quadrant: no active churn, but significant structural complexity waiting to bite.
serverless/serverless's auth layer carries the highest activity risk — 5 to address first
All five of the highest-risk functions in serverless/serverless sit in the fire quadrant — structurally complex and touched within the last 11 days — which means any engineer shipping code this week is working alongside active changes in the most tangled parts of the codebase. I'd start with `getAuthenticatedData` in the auth layer: a cyclomatic complexity of 91 combined with recent commit activity makes it a live regression risk, not a cleanup item for the backlog.
parcel's compiler core carries the highest structural debt — 5 functions to fix first
The riskiest code in parcel-bundler/parcel isn't on fire right now — it's a slow-burning fuse. Five critical-band functions in the Rust compiler core have sat untouched for 239 days, each carrying enough structural complexity that the next developer to modify any of them faces a high probability of introducing a regression.
zen-browser/desktop's tab and split-view layer carries the highest activity risk — 5 functions to address first
Five functions in zen-browser/desktop are both structurally complex and receiving active commits right now, putting them squarely in live-regression territory. The tab management and split-view subsystems dominate the critical band, and any engineer shipping to these areas this week is working on some of the densest branching logic in the repository.
react-bits' tools and backgrounds carry the highest activity risk — 5 functions to address first
Two functions in react-bits are both structurally complex and actively changing right now, making them live regression risks for anyone shipping code this week. Three more copies of the same ShapeGrid component sit untouched for 42 days with enough structural complexity that the next engineer to open them will be walking into a minefield.
Swiper's mousewheel and touch modules carry the highest risk — 5 functions to address
Swiper's highest-risk code isn't where the commits are — it's in the functions that haven't been touched in 97 days but would take a seasoned engineer a full day to reason through safely. The one exception, `onTouchMove`, is the opposite problem: CC 127, three commits in the last 30 days, and two authors working on it right now.
meteor/meteor's core packages carry the highest structural debt — 5 functions to address first
Meteor's highest-risk code isn't actively on fire right now — it's a cluster of structurally complex functions that haven't been touched in weeks, sitting in the webapp server, mongo replication layer, and package toolchain, waiting for the next developer who has to change them. With 332 functions in the critical band across 5,292 analyzed, the question isn't whether this debt will cost something, but when.
career-ops' analysis layer carries the highest activity risk — 5 functions to address first
The top-ranked function in career-ops has 54 outbound calls and 42 execution paths — and it was touched just 27 days ago. That combination makes it a live regression risk, not a cleanup backlog item.
lighthouse's audits and renderer carry the highest activity risk — 5 to address first
Five of lighthouse's critical functions are in the 'fire' quadrant right now — structurally complex and touched within the last 30 days — making them live regression risks, not backlog items. The most striking is `_setPerfGaugeExplodey` in the report renderer, which calls 71 distinct functions and carries an activity-weighted risk of 15.09, touched once in the last 30 days, 28 days ago.
Leaflet's GeoJSON and map core carry the highest activity risk — 5 to address first
Leaflet's GeoJSON conversion entry point and its map-level event dispatcher are both structurally complex and receiving commits right now, making them live regression risks rather than backlog items. I found 20 critical-band functions across 956 total in this codebase, and the most urgent two are sitting at the intersection of high cyclomatic complexity and recent commit activity.
yarn's PnP resolver carries the highest structural debt — 4 functions to address first
Four of the five highest-risk functions in yarnpkg/yarn live in a single file — `src/util/generate-pnp-map-api.tpl.js` — and none of them have been touched in nearly six years. That concentration of structural debt in one module means that when the PnP resolution layer is next opened for changes, the engineer doing the work will be navigating some of the most complex code in the repository.
koajs/koa's response layer carries the highest structural risk — 5 functions to address first
Koa's response pipeline is carrying the most structural weight: the respond function in lib/application.js has accumulated god-function complexity with 26 independent execution paths and hasn't been touched in over seven months — meaning the next change there arrives against a high-complexity backdrop with no recent test pressure. Meanwhile, the set function in lib/response.js was modified today, making it the only live regression risk in the repository right now.
video.js's events.js carries the highest structural debt — 3 functions to address first
Three of the top five hotspots in videojs/video.js come from the same file — src/js/utils/events.js — meaning the event-handling module isn't just one overdue cleanup item but a concentration of structural debt that will bite whoever touches it next. I'd treat that file as a single refactoring project, not three separate tickets.
monaco-editor's LSP and tokenization layer carries the highest structural debt — 5 functions to address first
Every one of monaco-editor's top five risk functions sits in the 'debt' quadrant: complex, untouched for 61 days, and owned by a single author in the last 90 days. The next developer who needs to change the JSON tokenizer or any of the LSP symbol-mapping functions will be walking into the highest structural complexity in the repository with essentially no recent institutional memory to lean on.
tesseract.js's worker-script carries the highest activity risk — 4 functions
Four of the five most complex, recently-changed functions in tesseract.js share the same file: src/worker-script/index.js. That concentration means a single developer touching that module today is navigating overlapping god functions, branching paths into the dozens, and fan-out counts that would stress any static analysis tool — all while the file is still being committed to.
learnGitBranching's app layer carries structural debt — 5 functions to address first
Every one of the five highest-risk functions in learnGitBranching has gone untouched for at least 46 days, yet several carry enough structural complexity to make the next developer who opens them work hard just to understand what they're reading. The risk here isn't an emergency — it's a slow accumulation of structural debt that will become an emergency the moment someone needs to extend any of these entry points.
javascript-interview-questions' deepMerge carries the highest risk — 1 function to address first
A repository built to demonstrate JavaScript mastery has one function quietly accumulating structural debt: deepMerge, untouched for over five months, carries every quality signal worth watching before the next contributor opens it up.
reactjs-interview-questions' coding-exercise carries the highest risk — 2 functions first
The coding-exercise module in reactjs-interview-questions has quietly accumulated structural debt in two functions that haven't been touched in months — one of them for over 750 days. When development next reaches this corner of the repo, the blast radius will be wider than the file size suggests.
eslint's rule engine carries the highest activity risk — 2 functions to address first
The eslint rule most developers rely on to catch dead code also has 114 independent execution paths — and it's still being actively changed. That combination is a live regression risk, not a cleanup b
chalk/chalk's vendor layer carries the highest activity risk — 3 functions to address first
chalk's riskiest code isn't in its core index.js — it's inside two vendored files carrying structural debt frozen in place for years, with high blast radii that warrant refactoring before the vendor copies are next updated.
google/zx's markdown layer is the live regression risk — 4 structural debt functions follow
zx's markdown transformer is the live regression risk — CC 18 and actively changing. _pipe and formatCmd are structural debt: equally complex, but stable for months and overdue for proactive refactoring.
bruno's OpenAPI sync and CLI runner carry the highest activity risk — 3 functions to address first
Two anonymous god-functions in openapi-sync.js (CC 135, CC 100) and a CLI runner function (CC 169) are both structurally extreme and actively changing, making them live regression risks in bruno's request execution layer.
get-shit-done's CLI core carries the highest activity risk — 5 functions to address first
Every top hotspot in get-shit-done lives in the CLI layer — and all five are actively changing right now. The command dispatcher alone has 181 execution paths and calls 108 distinct functions.
drawdb's editor and SQL layer carry the highest activity risk — 5 functions to address first
drawdb's diagram editor hides a live regression risk: its ControlPanel component is both deeply complex and actively changing right now — CC 55, nesting depth 15, and 163 distinct callees.
Preact's diff engine carries the highest activity risk — 3 functions to address first
Preact's virtual DOM differ is both its most structurally complex code and its most actively changed — a combination that makes every commit to src/diff/index.js a live regression risk right now.
hackathon-starter's auth and API layer carries the highest activity risk — 5 functions to address first
All five of hackathon-starter's top hotspots sit in the auth and API layer — and every single one is in the 'fire' quadrant, meaning complexity and active commits are colliding right now.
dayjs's core formatter carries the highest structural debt — 5 functions to address first
dayjs's core format function has 38 independent execution paths and calls 13 distinct functions — structural debt that will bite hard the moment that code is touched again.
docsify's YAML front-matter parser carries the highest activity risk — 3 functions to address first
docsify's YAML front-matter parser hides a nesting depth of 19 inside a single function — and the render layer is actively changing on top of CC 34 and fan-out of 80.
Puter's GUI layer carries the highest activity risk — 3 functions to address first
Puter's window and file-item rendering code is both extremely complex and actively changing right now — a combination that makes every commit a potential regression in the core desktop UI.
React's compiler and hooks plugin carry the highest activity risk — 5 functions
React's new compiler and its exhaustive-deps lint rule are where structural complexity meets live development pressure — five functions account for the repo's highest combined complexity and recent ac
immer's perf scripts and plugins carry the highest risk — 5 functions to review first
immer's highest-ranked hotspots are split between performance tooling and core plugin code. The production concern is concentrated in patches, array method interception, and proxy access paths.
remote-jobs' link checker carries the highest risk — 5 functions to review first
A single script file, fix-links.mjs, concentrates the highest structural and activity risk in remote-jobs — its top function carries a cyclomatic complexity of 38.