Hotspots on eslint/eslint: the 5 functions with the highest activity-weighted risk

ESLint is a widely-used JavaScript linter and a critical infrastructure project with 11,396 functions across its codebase. Of these, 672 functions are flagged as critical risk—a significant concentration that warrants investigation. The analysis reveals a concentrated hotspot problem: three of the top five critical functions reside in a vendored third-party library, while the remaining two (create in lib/rules/indent-legacy.js and lib/rules/no-unused-vars.js) represent core rule logic that is both structurally complex and actively changing.

The table below ranks functions by activity-weighted risk — a score that multiplies structural complexity by recent commit frequency. A function that is both hard to understand (high cyclomatic complexity) and actively changing is a higher priority than one that is complex but untouched. CC = cyclomatic complexity (independent execution paths); ND = max nesting depth; FO = fan-out (distinct callees).

Top 5 Hotspots

Function	File	Risk	CC
k	docs/src/assets/js/css-vars-ponyfill@2.js	26	76
u	docs/src/assets/js/css-vars-ponyfill@2.js	20	34
create	lib/rules/indent-legacy.js	20	88
<anonymous>	docs/src/assets/js/css-vars-ponyfill@2.js	20	189
create	lib/rules/no-unused-vars.js	20	114

Hotspot Analysis

create — lib/rules/indent-legacy.js

This rule implementation exhibits extreme structural risk: a cyclomatic complexity of 88 with a maximum nesting depth of 9 indicates a function with 88 independent execution paths buried in deeply nested control structures. The lrs of 20.04 shows sustained recent commit activity, meaning developers are repeatedly modifying this complex branching logic. With a fan-out of 52, changes here cascade across the rule evaluation pipeline and can have unexpected ripple effects. This combination of complexity + active churn creates a high regression hazard.

Recommendation: Before refactoring, add characterization tests that cover the major branching paths (focus on the deepest nesting levels first). Consider extracting sub-functions for indent validation logic and error reporting to reduce CC and ND in parallel. Review callers of create to understand the blast radius before making structural changes.

create — lib/rules/no-unused-vars.js

The unused-vars rule is a god function: CC of 114, ND of 7, and fan-out of 77 means it embodies complex logic for detecting unused identifiers across multiple scopes and patterns. The lrs of 19.4 indicates frequent recent modifications. At CC 114, this function requires roughly 114 distinct test cases to cover all paths—a maintenance burden that grows with each new conditional. The high fan-out signals that bugs or subtle behavior changes here will impact many callers and downstream tools that depend on this rule.

Recommendation: Map the function’s major decision trees (scoping logic, pattern matching, scope traversal) and extract each into a separate, testable module with lower CC. Start with the deepest nesting branches (ND 7 is a refactoring signal). Establish regression test coverage for the current behavior before splitting the function.

Patterns Found

Antipatterns detected across the top functions in this snapshot:

Pattern	Occurrences
cyclic_hub	7
exit_heavy	5
god_function	5
long_function	5
complex_branching	4
deeply_nested	4
hub_function	3

Tier 1 (structural): complex_branching, deeply_nested, exit_heavy, long_function, god_function. Tier 2 (relational/temporal): hub_function, cyclic_hub, middle_man, neighbor_risk, stale_complex, churn_magnet, shotgun_target, volatile_god.

Vendor Files in Results

Three of the top five critical functions appear in docs/src/assets/js/css-vars-ponyfill@2.js, a minified vendored CSS polyfill library. The functions k, u, and an anonymous function exhibit CC values of 76, 34, and 189 respectively, with ND of 9, 3, and 9—typical of obfuscated third-party code. These files should be excluded from structural analysis since they represent bundled external dependencies, not project code. Add docs/src/assets/ to your .hotspotsrc.json exclude patterns to focus analysis on ESLint’s own rule and core logic files.

Key Takeaways

• ESLint’s rule implementations (indent-legacy.js and no-unused-vars.js) are the real structural risk: both exhibit CC > 100 and ND ≥ 7, combined with active churn (lrs > 19). These are not bugs but legitimate complexity hotspots that demand test-first refactoring.
• Five functions across the codebase are classified as long, god functions with multiple exit paths—each a hub that couples to dozens of other functions (fan-out 37–77). Prioritize extracting validation and formatting logic out of the rule create functions to reduce their fan-out and CC in tandem.
• Exclude the vendored docs/src/assets/ directory from hotspot analysis to focus engineering effort on native ESLint code. The polyfill library’s high scores reflect minification and third-party code organization, not actionable refactoring opportunities.

Reproduce This Analysis

git clone https://github.com/eslint/eslint
cd eslint
git checkout ee9ff31cee13712d2be2a6b5c0a4a54449fe9fe1
hotspots analyze . --mode snapshot

Hotspots highlights structural and activity risk — not “bad code.” Findings are a prioritization aid, not a bug predictor. Editorial policy →