What's shipped in Hotspots lately: perf gates, Astro support, and a public research repo

Stephen Collins • Oct 21, 2026
4 mins

Key Points

What is Hotspots?

Hotspots is a free, open-source CLI that scores every function in a codebase by structural complexity (cyclomatic complexity, nesting depth, fan-out) weighted by how recently and how often that function has actually changed. It runs locally in under a minute with no account and no data leaving your machine — github.com/Stephen-Collins-tech/hotspots.

Where can I see the research behind the scoring methodology?

hotspots-public-research publishes write-ups of findings that have already shipped in the CLI via a merged PR, rewritten without any private corpus data or unreleased methodology. It's a one-way, manual promotion from the private research process — not everything that's been tried, just what's shipped and been cleaned up for a public write-up.

What's the perf regression gate?

A criterion-based macro-benchmark suite now runs in CI against the parse/CFG/metrics hot path, and only flags a benchmark as regressed when the confidence intervals of the old and new runs don't overlap. That was a deliberate fix — the first version of the gate flagged false positives on sub-microsecond benchmarks where noise alone could shift the mean.

It’s been a few weeks of mostly unglamorous work — CI hardening, a couple of correctness fixes, and expanding the crawl corpus — so this is a straight progress update rather than a single feature post.

v2.2.0, and what’s queued up behind it

The last tagged release, v2.2.0, added Astro (.astro) language support and dropped a stale Centrality axis from the schema table. Since then, the unreleased branch has picked up:

  • A fix to action policy scoping. The GitHub Action’s policy check now scopes PR comments by path and corrects the input semantics it was using — if you’re running hotspots as a CI gate on PRs, this is worth pulling in before it hits a tagged release.
  • A criterion-based perf regression gate. CI now runs macro-benchmarks against the parse/CFG/metrics hot path, flagging a benchmark as regressed only when the confidence intervals between the old and new run don’t overlap — the earlier version of this gate was producing false positives on sub-microsecond benchmarks where pure noise could shift the mean.
  • --timing-report, which breaks down analyze runtime per phase, useful if you’re trying to figure out whether a slow run is parse time, CFG construction, or scoring.
  • Iterative CFG builders for Go and JS/TS, replacing native recursion with a work-stack walk — this removes a stack-overflow risk on deeply nested code that the recursive version could hit on large, deeply-nested files.
  • A documentation hedge on warning thresholds — the cutoffs that decide when a function gets flagged are now explicitly marked as unvalidated heuristics rather than implied as calibrated values, until the research backing them is further along.

hotspots-content: past 400 crawled analyses

The nightly crawl against popular, actively-maintained open-source repos has kept adding analyses — recent additions include apache/log4j, urfave/cli, vectordotdev/vector, openssh/openssh-portable, and hashicorp/packer, among others. Every analysis is free to read at hotspots.dev/blog.

A new public research repo

The research behind Hotspots’ scoring has always happened in a private repo, for the obvious reason that not every experiment pans out and a lot of the raw material (labeled bug-fix corpora, in-progress signal work) isn’t meant to be public. But findings that have shipped — landed in a merged PR, validated, and no longer dependent on private data — are now getting rewritten and published in a new repo, hotspots-public-research.

It’s seeded with nine findings so far, including the independence-hypothesis work behind hotspots analyze --axes, the directed/recency-windowed coupling feature used in the trainer, and the C language validation that shipped tree-sitter-c support. Each entry links back to the PR that shipped it, and notes whether the finding is still reproducible as described or has since been superseded (one listed finding was shipped and later removed after a follow-up found a ratchet effect in the training data). More findings will get promoted over time — promotion is deliberately one-directional and manual, not an automated sync, so the public repo stays small and only holds things that are actually settled.

Upgrading

brew upgrade hotspots
# or
cargo install hotspots-cli
# or
pip install hotspots-cli
# or
npm install -g @stephencollinstech/hotspots

Full release notes and source at github.com/Stephen-Collins-tech/hotspots.

Recommended Posts