Risk Leaderboard

256 open-source repositories ranked by activity-weighted risk — complexity × recent commit frequency. Higher scores mean more urgent refactoring priority.

Repositories 256
Avg Risk Score 18.7
Languages 9
Last Updated 2026-09-09
# Repository Risk
1 mudler/LocalAI 42.3
2 DioxusLabs/dioxus 41.1
3 nushell/nushell 37.1
4 cypress-io/cypress 29.4
5 HeyPuter/puter 28.1
6 eslint/eslint 26.8
7 prettier/prettier 26.1
8 astral-sh/ruff 26.0
9 facebook/react 25.4
10 BerriAI/litellm 24.8
11 odoo/odoo 24.8
12 appsmithorg/appsmith 24.4
13 safishamsi/graphify 22.5
14 calcom/cal.com 22.4
15 jax-ml/jax 22.4
16 fanmingming/live 22.2
17 pandas-dev/pandas 22.1
18 photoprism/photoprism 21.8
19 vercel-labs/agent-browser 21.7
20 gsd-build/get-shit-done 21.7
21 CodePhiliaX/Chat2DB 21.7
22 sqlmapproject/sqlmap 21.6
23 usebruno/bruno 21.5
24 agno-agi/agno 21.4
25 lutzroeder/netron 21.4
26 ToolJet/ToolJet 21.4
27 chatboxai/chatbox 21.3
28 junegunn/fzf 21.3
29 colinhacks/zod 21.3
30 evanw/esbuild 21.2
31 novuhq/novu 21.2
32 juspay/hyperswitch 21.2
33 vllm-project/vllm 21.2
34 FlowiseAI/Flowise 21.2
35 koala73/worldmonitor 21.2
36 pola-rs/polars 21.2
37 exo-explore/exo 21.1
38 abhigyanpatwari/GitNexus 21.1
39 servo/servo 21.1
40 oobabooga/textgen 21.0
41 vitejs/vite 21.0
42 drawdb-io/drawdb 21.0
43 MHSanaei/3x-ui 21.0
44 NervJS/taro 21.0
45 supabase/supabase 20.9
46 mattermost/mattermost 20.9
47 Automattic/mongoose 20.8
48 grafana/k6 20.8
49 lib/pq 20.7
50 apache/airflow 20.7
51 getsentry/sentry 20.7
52 janhq/jan 20.7
53 deepspeedai/DeepSpeed 20.7
54 chakra-ui/chakra-ui 20.6
55 crewAIInc/crewAI 20.6
56 react-hook-form/react-hook-form 20.6
57 NanmiCoder/MediaCrawler 20.5
58 jestjs/jest 20.5
59 nwjs/nw.js 20.5
60 paperclipai/paperclip 20.5
61 moby/moby 20.4
62 gogs/gogs 20.3
63 bevyengine/bevy 20.3
64 zhayujie/CowAgent 20.3
65 seaweedfs/seaweedfs 20.2
66 lovell/sharp 20.2
67 typeorm/typeorm 20.2
68 preactjs/preact 20.2
69 go-gorm/gorm 20.2
70 parallax/jsPDF 20.2
71 cockroachdb/cockroach 20.2
72 wailsapp/wails 20.2
73 portainer/portainer 20.1
74 badlogic/pi-mono 20.1
75 GoogleChrome/lighthouse 20.1
76 virattt/ai-hedge-fund 20.0
77 mifi/lossless-cut 20.0
78 gradio-app/gradio 20.0
79 mitmproxy/mitmproxy 19.9
80 swagger-api/swagger-ui 19.9
81 thedotmack/claude-mem 19.9
82 xuxueli/xxl-job 19.9
83 fish-shell/fish-shell 19.9
84 earendil-works/pi 19.9
85 streamlit/streamlit 19.8
86 XTLS/Xray-core 19.8
87 redisson/redisson 19.8
88 conductor-oss/conductor 19.8
89 ray-project/ray 19.8
90 expo/expo 19.8
91 astral-sh/uv 19.8
92 hashicorp/terraform 19.8
93 gethomepage/homepage 19.7
94 code-yeongyu/oh-my-openagent 19.7
95 harness/harness 19.7
96 rustfs/rustfs 19.7
97 CherryHQ/cherry-studio 19.7
98 HKUDS/nanobot 19.6
99 upstash/context7 19.6
100 garrytan/gstack 19.6
101 pingcap/tidb 19.5
102 outline/outline 19.5
103 gchq/CyberChef 19.5
104 cli/cli 19.4
105 Fission-AI/OpenSpec 19.4
106 run-llama/llama_index 19.4
107 SimplifyJobs/Summer2026-Internships 19.4
108 bmad-code-org/BMAD-METHOD 19.4
109 666ghj/BettaFish 19.3
110 block/goose 19.3
111 phaserjs/phaser 19.3
112 tailscale/tailscale 19.3
113 kubernetes/kubernetes 19.3
114 tldraw/tldraw 19.3
115 hashicorp/vault 19.2
116 bigskysoftware/htmx 19.2
117 remotion-dev/remotion 19.2
118 Aider-AI/aider 19.2
119 apache/rocketmq 19.2
120 hesreallyhim/awesome-claude-code 19.1
121 casey/just 19.1
122 serverless/serverless 19.1
123 twentyhq/twenty 19.0
124 AykutSarac/jsoncrack.com 19.0
125 ruvnet/RuView 19.0
126 elunez/eladmin 18.9
127 helix-editor/helix 18.9
128 surrealdb/surrealdb 18.8
129 Textualize/textual 18.8
130 hpcaitech/ColossalAI 18.8
131 gofiber/fiber 18.8
132 spacedriveapp/spacedrive 18.8
133 remoteintech/remote-jobs 18.7
134 hashicorp/nomad 18.7
135 parcel-bundler/parcel 18.7
136 roboflow/supervision 18.7
137 alibaba/canal 18.7
138 Kong/insomnia 18.7
139 iced-rs/iced 18.6
140 v2ray/v2ray-core 18.6
141 grafana/loki 18.6
142 pixijs/pixijs 18.6
143 D4Vinci/Scrapling 18.6
144 jdx/mise 18.6
145 chenglou/pretext 18.5
146 makeplane/plane 18.5
147 docsifyjs/docsify 18.5
148 FuelLabs/fuels-rs 18.5
149 istio/istio 18.5
150 beetbox/beets 18.5
151 github/github-mcp-server 18.3
152 rust-lang/mdBook 18.3
153 paperless-ngx/paperless-ngx 18.3
154 1Panel-dev/1Panel 18.2
155 vuetifyjs/vuetify 18.2
156 zen-browser/desktop 18.2
157 tiangolo/fastapi 18.2
158 influxdata/influxdb 18.1
159 lapce/lapce 18.1
160 DavidHDev/react-bits 18.0
161 microsoft/qlib 18.0
162 fyne-io/fyne 18.0
163 opentofu/opentofu 17.9
164 ChromeDevTools/chrome-devtools-mcp 17.9
165 valyala/fasthttp 17.9
166 nolimits4web/swiper 17.9
167 PyCQA/pylint 17.8
168 AlistGo/alist 17.8
169 alibaba/zvec 17.8
170 v2fly/v2ray-core 17.8
171 markedjs/marked 17.8
172 meteor/meteor 17.7
173 layui/layui 17.7
174 hashicorp/consul 17.6
175 vadimdemedes/ink 17.6
176 goharbor/harbor 17.5
177 google/gson 17.4
178 containers/podman 17.4
179 juanfont/headscale 17.4
180 babysor/MockingBird 17.3
181 spf13/cobra 17.2
182 schollz/croc 17.2
183 skylot/jadx 17.2
184 shareAI-lab/learn-claude-code 17.1
185 k3s-io/k3s 17.1
186 gin-gonic/gin 17.1
187 lyswhut/lx-music-desktop 17.0
188 validatorjs/validator.js 17.0
189 google/langextract 16.9
190 danielmiessler/Fabric 16.9
191 nestjs/nest 16.9
192 trpc/trpc 16.9
193 slidevjs/slidev 16.9
194 amruthpillai/reactive-resume 16.8
195 TanStack/query 16.8
196 dcloudio/uni-app 16.8
197 tw93/Pake 16.8
198 vercel/hyper 16.8
199 wshobson/agents 16.7
200 OpenCut-app/OpenCut 16.6
201 santifer/career-ops 16.6
202 binarywang/WxJava 16.4
203 hexojs/hexo 16.4
204 ueberdosis/tiptap 16.1
205 elysiajs/elysia 16.1
206 RSSNext/Folo 16.1
207 freqtrade/freqtrade 16.0
208 labstack/echo 16.0
209 restic/restic 16.0
210 charmbracelet/bubbletea 15.9
211 xyflow/xyflow 15.9
212 lerna/lerna 15.8
213 2noise/ChatTTS 15.7
214 starship/starship 15.7
215 docker/compose 15.6
216 streadway/amqp 15.5
217 umami-software/umami 15.5
218 tokio-rs/tokio 15.5
219 styled-components/styled-components 15.4
220 immerjs/immer 15.4
221 sahat/hackathon-starter 15.3
222 11ty/eleventy 15.3
223 filebrowser/filebrowser 15.2
224 vuejs/vitepress 15.2
225 redis/redis 15.1
226 brettwooldridge/HikariCP 15.0
227 kubernetes/minikube 14.9
228 sunface/rust-course 14.9
229 GyulyVGC/sniffnet 14.8
230 Leaflet/Leaflet 14.8
231 google/comprehensive-rust 14.7
232 yarnpkg/yarn 14.7
233 sxyazi/yazi 14.6
234 koajs/koa 14.6
235 ajeetdsouza/zoxide 14.5
236 google/zx 14.4
237 sharkdp/fd 14.3
238 derailed/k9s 14.2
239 gorilla/mux 14.2
240 jingyaogong/minimind 14.0
241 aquasecurity/trivy 14.0
242 videojs/video.js 14.0
243 microsoft/monaco-editor 14.0
244 naptha/tesseract.js 13.5
245 pcottle/learnGitBranching 13.1
246 chalk/chalk 12.8
247 iamkun/dayjs 12.7
248 ant-design/ant-design-pro 12.1
249 type-challenges/type-challenges 11.6
250 fastapi/full-stack-fastapi-template 10.6
251 upscayl/upscayl 9.9
252 sudheerj/javascript-interview-questions 9.0
253 indiespirit/react-native-chart-kit 8.7
254 sudheerj/reactjs-interview-questions 8.3
255 typescript-cheatsheets/react 4.8
256 vsavkin/large-monorepo 3.6

About the Risk Score

Each score is an activity-weighted risk metric: structural complexity (cyclomatic complexity × nesting depth × fan-out) multiplied by recent commit frequency. A function that is both highly complex and actively changing scores highest — it represents live regression risk, not just latent debt. Scores are not comparable across different versions of the same repo — use them to rank hotspots within a single analysis.

≥ 20 critical ≥ 10 high ≥ 5 medium < 5 low