3 Hotspots Analyses Worth Reading This Week
Key Points
What is Hotspots?
Hotspots is a free, open-source CLI that scores every function in a codebase by structural complexity (cyclomatic complexity, nesting depth, fan-out) weighted by how recently and how often that function has actually changed. It runs locally in under a minute with no account and no data leaving your machine — github.com/Stephen-Collins-tech/hotspots.
How are these three repos picked?
Hotspots.dev crawls popular, actively-maintained open-source repos nightly and publishes a full analysis for each. This roundup is a manual pick of the three most interesting results from the past week, chosen for the story the data tells rather than just the highest score.
Hotspots.dev runs a nightly crawl against popular, actively-maintained open-source repos and publishes a full breakdown for each — every function scored by structural complexity and weighted by recent change activity. Most weeks turn up a few analyses worth a second look beyond the raw numbers. Here are three from the past week.
astral-sh/ruff — a 26-branch function inside the linter that checks your branches
Ruff is the Python linter written in Rust that’s largely replaced flake8 in new projects, so it’s a little pointed that its own highest-risk function, expression in crates/ruff_linter/src/checkers/ast/analyze/expression.rs, scores an activity risk of 26.0 — the top result of the week — and carries six flagged antipatterns simultaneously, including cyclic_hub and hub_function. It’s the dispatcher that walks every expression node in a Python AST and routes it to the right lint check, so its size is somewhat structurally justified: it’s a giant match statement, not spaghetti logic. Still, a hub function this size means every new expression-level lint rule added to Ruff has to touch the same 26-branch chokepoint.
bevyengine/bevy — a glTF loader carrying all five structural antipatterns at once
Bevy’s load_gltf function, in crates/bevy_gltf/src/loader/mod.rs, is the rare case where a single function trips complex branching, deep nesting, early-exit sprawl, god-function scope, and sheer length all at once. That’s not surprising for a glTF loader — the format has to branch on meshes, materials, skins, animations, and extensions in one pass — but it’s exactly the kind of function where a change to skin support can silently regress animation import, because the paths aren’t separated. It’s the clearest example this week of complexity that’s earned rather than accidental, and also the clearest case for extracting each glTF subsystem into its own function before the next contributor has to touch it.
juspay/hyperswitch — the riskiest function in a payments core was changed today
Hyperswitch is an open-source payment orchestration platform, and its second-highest-risk function, payment_response_update_tracker (CC 61), was last modified zero days before the crawl ran. Activity-weighted risk exists precisely to catch this: a CC-61 function that’s been stable for two years is a very different problem than a CC-61 function receiving active edits today, because every edit to a function this complex has more surface area to introduce a regression. In a payments codebase specifically, that’s the function you’d want covered by characterization tests before the next change lands, not after.
All three analyses — and every other repo Hotspots has crawled — are free to read at hotspots.dev/blog. The CLI itself is free and open source: pip install hotspots-cli or npm install -g @stephencollinstech/hotspots.