3 Hotspots Analyses Worth Reading This Week
Key Points
What is Hotspots?
Hotspots is a free, open-source CLI that scores every function in a codebase by structural complexity (cyclomatic complexity, nesting depth, fan-out) weighted by how recently and how often that function has actually changed. It runs locally in under a minute with no account and no data leaving your machine — github.com/Stephen-Collins-tech/hotspots.
How are these three repos picked?
Hotspots.dev crawls popular, actively-maintained open-source repos nightly and publishes a full analysis for each. This roundup is a manual pick of the three most interesting results from the past week, chosen for the story the data tells rather than just the highest score.
Hotspots.dev runs a nightly crawl against popular, actively-maintained open-source repos and publishes a full breakdown for each — every function scored by structural complexity and weighted by recent change activity. Most weeks turn up a few analyses worth a second look beyond the raw numbers. Here are three from the past week.
apache/log4j — the riskiest functions haven’t been touched in 12 years
Log4j’s top five hotspots all sit in the debt quadrant: complex, but dormant. The worst, setOption in contribs/ThomasFenner/JDBCAppender.java, scores an activity risk of 16.9 with a nesting depth of 12 and a fan-out of 27 — and hasn’t changed in 4,480 days. Three of the five live under contribs/, which holds contributed add-ons rather than the core logging path, so the headline number undersells how isolated the risk actually is. What makes this one worth reading isn’t the score, it’s the quadrant: zero functions in this snapshot are both complex and actively changing. That’s a useful reminder that activity-weighted risk is explicitly not a defect list — a CC-128 function nobody has touched in 12 years is a very different kind of problem than the same complexity under live edits, and this analysis is a clean example of the former with none of the latter.
urfave/cli — the command runner and flag parser are both being edited today
This is the opposite case. run in command_run.go (CC 128, 58 distinct callees) was last changed zero days before the crawl ran, and parseFlags in command_parse.go (CC 90) two days before — and between them they’re the entry point and argument parser for every single CLI invocation in the library. 33 of 430 analyzed functions landed in the fire quadrant, meaning complex and currently churning, which is a high share for a library this size. The pairing is what makes it worth a look: it’s not one god function sitting still, it’s the two highest-complexity functions in the whole codebase both under active edit at the same time, on the path every consumer hits.
vectordotdev/vector — all five top hotspots changed within the last 8 days
Vector’s top five — file tailing, gRPC decompression, Lua metric conversion, S3/SQS ingestion, and Elasticsearch config — are each complex and each was touched between zero and eight days before the crawl. Across 12,200 analyzed functions, 1,288 landed in the fire quadrant and literally none in debt — nothing in this snapshot is dormant. The detail that stood out: several of the flagged functions carry lint suppressions pointing at the same open tracking issue (vectordotdev/vector#23659), with comments noting the splitting work is deliberately deferred during a lint rollout. In other words, the maintainers already know these functions need to be broken up — the crawl is just surfacing a backlog they’ve already filed, not a surprise.
All three analyses — and every other repo Hotspots has crawled — are free to read at hotspots.dev/blog. The CLI itself is free and open source: pip install hotspots-cli or npm install -g @stephencollinstech/hotspots.