We measured 195 public GitHub repositories with 1,000+ stars each: 253,688 production source files and 79.7 million lines of code. Here is where change lands, where bugs get fixed, how much code nothing uses, and who holds the knowledge.
- of 90-day churn lands in 10% of files
- 68%of 90-day churn lands in 10% of files
median repository
- hotspot health against code health, out of 10
- 4.9 vs 7.1hotspot health against code health, out of 10
median repository
- as often bug-fixed: the 20 lowest-scoring files
- 5.4xas often bug-fixed: the 20 lowest-scoring files
median of 173 repos
- of repositories carry dead code
- 96%of repositories carry dead code
182 of 190 repos
Key findings
Ten facts, each with its number.
Medians across repositories, so each repository counts once. Every sentence has its own anchor to link to.
195 public GitHub repositories with 1,000+ stars each, 253,688 production source files, November 2026
- 01
In the median repository, 10% of production files absorb 68% of all line churn over 90 days, and the busiest 5% absorb 52%. See the data
- 02
Median code health is 7.1 out of 10, but the files that change most score 4.9; in 174 of 186 (94%) repositories, hotspot files score below the repo average. See the data
- 03
The least-healthy 20% of files hold 60% of all files that needed a bug fix in the last 180 days, and the 20 lowest-scoring files were bug-fixed 5.4x as often as the average file. See the data
- 04
182 of 190 (96%) repositories have at least one dead code finding in production code, and 139 of 190 (73%) have at least one high-confidence finding. See the data
- 05
170 of 190 (89%) repositories contain at least one production source file that nothing imports; in the median repository that is 3.2% of production files. See the data
- 06
173 of 195 (89%) repositories have at least one circular import chain between files, and every one of the 51 Python repositories does; 12 of 22 Go repositories do. See the data
- 07
In the median repository, a single hub file is imported by 20% of all production files, and in 68 of 195 (35%) repositories one file is imported by a quarter or more of the codebase. See the data
- 08
In the median repository, 60% of production files have a bus factor of 1: one person made 80% or more of their commits. See the data
- 09
188 of 195 (96%) repositories contain test files; the median repository has 0.52 test files per production file. See the data
- 10
Repositories with 1,000+ production files have a median code health of 7.5 out of 10, higher than repositories with 50 to 249 production files (6.9). See the data
01Hotspots and churn
Most change lands in a few files.
In the median repository, the busiest 10% of production files take 68% of all lines added and deleted over 90 days. In 150 of 186 (81%) repositories, half or more of all churn lands in those 10%.
- Busiest 1% of files23%
- Busiest 5%52%
- Busiest 10%68%
- Busiest 20%85%
median of 186 repos; churn = lines added + deleted
52%
of 90-day commits touch the busiest 10% of files
median, 186 repos
10%
of production files are hotspots
median, 195 repos
62%
of production files changed in the last 90 days
median, 195 repos
02Health vs hotspot health
The files that change most are the least healthy.
Median code health is 7.1 out of 10. Hotspot files, the ones changing fastest, score 4.9. In 174 of 186 (94%) repositories the hotspots score below the repo average, by a median of 2.0 points.
- Code health7.1
- Maintainability7.9
- Hotspot health4.9
- 9 to 1014
- 8 to 936
- 6 to 8115
- 4 to 628
- Below 42
code health weighted by lines of code; hotspot health over 186 repos with hotspots
50 of 195 (26%)
repositories score 8.0 or higher
6.4 to 8.0
code health, middle half of repositories
p25 to p75
7.9
median maintainability score
183 repos
03Bug-fix concentration
Low health points at real bugs.
In the median repository, the least-healthy 20% of files hold 60% of every file that needed a bug fix in the last 180 days. The 20 lowest-scoring files were bug-fixed 5.4x as often as the average file.
- Least-healthy 20% of files60%
- If fixes spread evenly20%
median of 173 repos
3.6x to 8.1x
lift of the 20 lowest-scoring files, middle half of repositories
p25 to p75
173
repositories with 25+ scored files and 5+ bug-fixed files
a bug fix = a fix: commit
04Dead code
Almost every popular repository carries dead code.
182 of 190 (96%) repositories have at least one dead code finding in production code. 170 of 190 (89%) have a production file that nothing imports, and in 44 of them that is 10% or more of their production files.
- Any finding96%
- Unused export91%
- Unreachable file89%
- High-confidence finding73%
- Unused workspace package38%
190 repos with dead-code data; findings at confidence 0.4+, high confidence 0.7+
3.2%
of production files flagged as unreachable
median, 190 repos
19,697
unreachable files and 39,863 unused exports, pooled
3.5 million lines
16.2
findings per 100 production files
median; 58% of all findings are high confidence
05Circular import chains
Circular import chains between files are the norm.
173 of 195 (89%) repositories have at least one set of files that all reach each other through imports. Every one of the 51 Python repositories has one; 12 of 22 Go repositories do. A package __init__.py re-export or a TypeScript barrel index.ts forms one too.
- Python100%
- C#100%
- C++100%
- Rust93%
- TypeScript92%
- All repos89%
- JavaScript69%
- Go55%
languages with 8+ repositories; file-to-file imports between production files
9.2%
of production files sit inside a circular chain
median, 195 repos
66 of 195 (34%)
repositories have one chain of 50 or more files
16
files in the largest chain
median repository
06Hub files
One file holds the codebase together.
In the median repository, the most-imported file is imported by 20% of all production files, and the top 1% of files receive 17% of all import edges. In 68 of 195 (35%) repositories, one file is imported by a quarter or more of the codebase.
- docker/compose67%
- grafana/grafana31%
- redis/redis28%
- keycloak/keycloak26%
- Median repository20%
- django/django18%
median of 194 repos, with five named repositories
513
production source files
median repository
7
top-level modules
median repository
3.0
import edges per production file
median repository
07Bus factor and ownership
Knowledge sits with one person per file.
In the median repository, 60% of production files have a bus factor of 1: one person made 80% or more of their commits. In 124 of 195 (64%) repositories that is the majority of files.
- Rust79%
- TypeScript70%
- C#66%
- All repos60%
- Python57%
- Go49%
- JavaScript45%
- C++44%
median per language; bus factor = fewest authors with 80% of a file's commits
34%
of 20,941 hotspot files have a bus factor of 1
pooled across the cohort
25%
of hotspot files have a bus factor of 1
median, 176 repos with hotspots
08Tests
Tests are nearly universal. Depth varies.
188 of 195 (96%) repositories contain test files. The median repository has 0.52 test files per production file, and 28 of 195 (14%) have more test files than production files. Rust keeps many unit tests inside the source file, so its ratio counts files, not tests.
- JavaScript0.77
- Python0.70
- Go0.58
- All repos0.52
- TypeScript0.52
- C#0.24
- Rust0.19
- C++0.13
median per language; test files classified by code origin or the parser's test flag
By language
Every measure, by primary language.
Medians per language, for the 7 languages with8 or more repositories (GitHub's primary-language label). Hub reach is the share of production files that import the repository's most-imported file.
| Language | Repos | Code health | Hotspot health | Bug-fixed in worst 20% | Churn in busiest 10% | Unreachable files | Dead code / 100 files | Repos with circular imports | Files in circular chains | Hub reach | Bus factor 1 | Tests per prod file |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| All repos | 195 | 7.14 | 4.86 | 60% | 68% | 3.2% | 16.2 | 89% | 9.2% | 20% | 60% | 0.52 |
| TypeScript | 52 | 7.46 | 5.51 | 57% | 62% | 1.7% | 10.1 | 92% | 6.4% | 17% | 70% | 0.52 |
| Python | 51 | 6.97 | 4.58 | 60% | 66% | 3.9% | 15.7 | 100% | 16.4% | 18% | 57% | 0.70 |
| Go | 22 | 6.83 | 4.62 | 57% | 81% | 0.6% | 21.4 | 55% | 0.6% | 27% | 49% | 0.58 |
| Rust | 15 | 5.89 | 3.76 | 58% | 54% | 1.8% | 5.0 | 93% | 22.2% | 21% | 79% | 0.19 |
| JavaScript | 13 | 6.50 | 3.86 | 53% | 69% | 14.6% | 26.6 | 69% | 3.1% | 15% | 45% | 0.77 |
| C# | 10 | 8.71 | 7.03 | 49% | n/a | n/a | n/a | 100% | 8.1% | 18% | 66% | 0.24 |
| C++ | 8 | 6.43 | 3.94 | 62% | 61% | n/a | n/a | 100% | 20.2% | 15% | 44% | 0.13 |
Scroll the table sideways to see every column.
Groups under 15 repositories are indicative. Dead-code rates are reported for languages whose imports name files; C# and C++ reference symbols across files without a file-level import, so their unreachable-file rates are not comparable. The C# repositories' indexed history is too shallow for a 90-day churn share.
By size
Scale does not mean decay.
Repositories with 1,000+ production files have a median code health of 7.5 out of 10, higher than repositories with 50 to 249 production files (6.9). Sizes count production source files only.
| Production files | Repos | Code health | Hotspot health | Bug-fixed in worst 20% | Churn in busiest 10% | Unreachable files | Dead code / 100 files | Repos with circular imports | Files in circular chains | Hub reach | Bus factor 1 | Tests per prod file |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 50 to 249 files | 59 | 6.94 | 4.59 | 67% | 62% | 4.3% | 21.1 | 75% | 4.9% | 26% | 57% | 0.49 |
| 250 to 999 files | 80 | 7.13 | 4.92 | 60% | 66% | 2.9% | 12.6 | 94% | 11.6% | 17% | 65% | 0.51 |
| 1,000+ files | 56 | 7.49 | 4.94 | 57% | 73% | 3.3% | 15.3 | 96% | 11.3% | 15% | 53% | 0.52 |
Scroll the table sideways to see every column.
In named repositories
The same patterns, in projects you know.
Each repository links to its page on Repowise, where the same index is open to browse.
facebook/react: The least-healthy 20% of files hold 67% of the files bug-fixed in the last 180 days, and the 20 lowest-scoring files were bug-fixed 19 times as often as the average file.
252k stars, indexed 2026-11-04
grafana/grafana:
packages/grafana-data/src/index.tsis imported by 3,178 of 10,090 production files (31%).78k stars, indexed 2026-10-28
keycloak/keycloak:
KeycloakSession.javais imported by 1,690 of 6,626 production files (26%), with a code health of 8.3 out of 10 across them.38k stars, indexed 2026-11-04
docker/compose:
pkg/api/context.gois imported by 130 of 194 production files (67%), the widest hub among repositories above 20k stars.39k stars, indexed 2026-07-02
django/django:
django/conf/__init__.pyis imported by 158 of 870 production files, and 10% of production files absorbed 96% of 90-day churn.92k stars, indexed 2026-07-29
redis/redis:
src/server.his included by 77 of 272 production files (28%), and the least-healthy 20% of files hold 77% of recently bug-fixed files.77k stars, indexed 2026-10-09
paperless-ngx/paperless-ngx: The least-healthy 20% of files hold 94% of the files bug-fixed in the last 180 days.
48k stars, indexed 2026-10-15
apache/airflow: 4,158 test files for 4,387 production files.
47k stars, indexed 2026-08-19
Zero circular import chains among production files: gohugoio/hugo, gin-gonic/gin, temporalio/temporal and binwiederhier/ntfy.
Healthiest large codebases (1,000+ production files): chatwoot/chatwoot 9.41 (3,599 files), MassTransit/MassTransit 9.38 (4,403 files), shadcn-ui/ui 9.23 (3,853 files), stablyai/orca 9.03 (23,793 files).
Method
How we measured.
Cohort. Every public, non-fork GitHub repository indexed on repowise.dev with at least 1,000 stars, at least 100 indexed files, a completed index with a code health score, and at least 50 production source files. 215 repositories met the first four conditions; 20 were left out for having fewer than 50 production source files (prompt collections and small libraries). That leaves 195 repositories, one row each at its latest completed index. Stars range from 1,015 upward, with a median of 13,375; 108 have 10,000 or more.
Date. Data pulled on 2026-11-10. Each repository is measured at its own latest index, between 2026-05-20 and 2026-11-10; 94 of 195 were indexed in October or November 2026.
Sources.Repowise's own index of each repository: the stored code health overview (health, hotspot health, defect concentration), the import graph, the dead-code findings and the mined git history (churn, hotspots, ownership, tests).
Production code only.Every file is classified by repowise's code-origin rules as production, test, generated, vendored, build, docs example or tooling. File-level numbers count production source files in code languages only (no Markdown, JSON or YAML). Tests, generated code, vendored copies, build scripts, tooling and docs examples are excluded, except where a measure is about tests. That is 253,688 production source files and 79.7 million lines of code.
Languages. TypeScript 52, Python 51, Go 22, Rust 15, JavaScript 13, C# 10, C++ 8, Java 7, C 6, and 11 more across 7other languages, by GitHub's primary-language label.
- Code health
- Repowise's 0 to 10 file score (10 = no issues), averaged over production files and weighted by lines of code. Hotspot health is the same score over hotspot files only.
- Hotspot
- A file in the top 25% of its repository by recency-weighted change activity that also clears absolute activity floors.
- Churn
- Lines added plus lines deleted in the last 90 days of indexed history.
- Bug-fixed file
- A file touched by a fix: commit in the last 180 days. Lift is how much more often the 20 lowest-scoring files were bug-fixed than the repository average; it is computed where a repository has 25+ scored files and 5+ bug-fixed files.
- Dead code
- Repowise findings on production files: an unreachable file (nothing imports it and it is not an entry point), an unused export (a public symbol nothing imports) or an unused workspace package. Findings start at confidence 0.4; high confidence is 0.7 or above.
- Circular import chain
- A set of two or more production files that all reach each other through file-to-file imports (a strongly connected component of the import graph).
- Hub
- The production file imported by the most other production files.
- Bus factor
- The fewest authors who together made 80% of a file's commits. A bus factor of 1 means one person made 80% or more.
- Median repository
- The median of per-repository values, so each repository counts once.
How to cite
Quote it, link it.
Use the numbers freely with a link to this page. To point at one fact, link its anchor, for example #finding-3.
Repowise, "State of open-source code health 2026", November 2026. 195 public GitHub repositories with 1,000+ stars, 253,688 production source files. https://repowise.dev/research/code-health-2026
Short form: State of open-source code health 2026, Repowise, November 2026, https://repowise.dev/research/code-health-2026
FREQUENTLY ASKED
Questions, answered
How healthy is the typical popular open-source repository?
The median repository with 1,000+ GitHub stars scores 7.1 out of 10 on code health, and 50 of 195 (26%) score 8.0 or higher. The files that change most score lower: median hotspot health is 4.9.
How much dead code do open-source projects have?
182 of 190 (96%) of the repositories we measured have at least one dead code finding in production code. In the median repository, 3.2% of production files are flagged as unreachable, meaning nothing imports them and they are not entry points.
How common are circular imports in open-source code?
173 of 195 (89%) repositories have at least one circular import chain between files, and in the median repository 9.2% of production files sit inside one. Every Python repository in the cohort has one; 12 of 22 Go repositories do.
How much code churn lands in hotspot files?
In the median repository, the busiest 10% of production files take 68% of all lines added and deleted over 90 days, and the busiest 1% take 23%.
Which repositories are in the dataset?
Every public, non-fork GitHub repository indexed on repowise.dev with 1,000+ stars and at least 50 production source files: 195 repositories in 16 primary languages, led by TypeScript (52), Python (51) and Go (22). Each one has a public page on repowise.dev with the same index.
See these numbers for your own repository.
Index any public repository free and get the same measures: code health, hotspots, dead code, import chains and ownership.