Hub Function
Tier 2hub_function Called by many callers (high fan-in). Changes ripple across the codebase because every caller is a potential regression surface. Introduce a stable interface before refactoring internals.
LocalAI's static asset layer carries the highest activity risk
When I ran Hotspots against mudler/LocalAI, the highest activity-weighted risk scores didn't surface in the Go inference engine or the model-loading pipeline — they surfaced in two bundled JavaScript files served as static assets. Three of the five hotspots I found live in a single file, core/http/static/assets/htmx.js, which means any team member touching that module is navigating a dense web of structurally complex, interacting functions all at once.
ruff's AST checker carries the highest activity risk — 5 functions to address first
One function in astral-sh/ruff sits in a completely different complexity category from everything else on the list: `expression` in `analyze/expression.rs` has a cyclomatic complexity of 552, compared to 16 for the fifth-ranked function — a gap of 536 points that puts it in outlier territory by any measure. With 2 commits touching it in the last 30 days and an activity-weighted risk score of 26.01, this isn't a cleanup item sitting in the backlog; it's a live regression surface that is changing right now.
supabase's type parser and storage explorer are the highest risks — all 5 touched today
Every function in supabase's top-five hotspot list was touched in the last day. Two of them share a single file in the docs layer. One has fan-out into 173 distinct callees. The structural debt isn't theoretical — it's actively compounding.
yazi: actor, shim, and CLI layers carry the highest risk — 5 functions to fix first
Four of yazi's top five hotspots are in the fire quadrant right now: structurally complex functions that are also receiving active commits, making them live regression surfaces rather than backlog cleanup items. I'd start with `r#do` in `bulk_rename.rs`, which scored an activity-weighted risk of 14.61 and was touched twice in the last 30 days — but the deeper structural story is `value_to_data` in `sendable.rs`, a CC-55 function that hasn't been touched in 43 days and is overdue for decomposition before the next development push reaches the Lua data layer.
eslint's rule engine carries the highest activity risk — 2 functions to address first
The eslint rule most developers rely on to catch dead code also has 114 independent execution paths — and it's still being actively changed. That combination is a live regression risk, not a cleanup b
tldraw's Editor.ts carries the highest activity risk — 3 functions to address first
Three of tldraw's five highest-risk functions live in one file — and they're all actively changing. That's not a cleanup backlog; it's a live regression surface.
umami's API and tracker layer carry the highest activity risk — 5 functions to address first
umami's event ingestion endpoint and client tracker are structurally complex and still actively changing — a combination that makes regressions hard to catch and fixes expensive to ship.
xyflow's system layer carries the highest activity risk — 5 functions to address first
xyflow's drag system is carrying a CC of 42 and fans out to 32 distinct callees — structural debt that will bite hard the next time anyone touches it.
Chat2DB's SQL processing layer carries the highest activity risk — 3 functions to address first
Chat2DB has 385 critical functions across 6,984 analyzed — and its SQL split processor alone carries a cyclomatic complexity of 58 with 38 distinct callees. Here's what to fix first.