Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
3,361 commits sit in this repo's top risk tercile, which is 34% of the 10,000scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 6.6 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Consistently other-driven across its history.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Review priority | Top driver |
|---|---|---|---|---|---|---|
| 1 | 2f981978tempfork/sshtest/ssh: add fork of golang.org/x/crypto/ssh for testing only | Brad Fitzpatrick | 1y ago | +19.5K -0 | 100thElevated | more lines added than baseline |
| 2 | 2691b9f6tempfork/acme: add new package for x/crypto package acme fork, move | Brad Fitzpatrick | 1y ago | +5.7K -3 | 100thElevated | more lines added than baseline |
| 3 | 65888d95derp/xdp,cmd/xdpderper: initial skeleton (#12390) | Jordan Whited | 2y ago | +8.7K -11 | 100thElevated | more lines added than baseline |
| 4 | be0e460acmd/k8s-operator,k8s-operator: Kubernetes Peer Relays (#20495) | David Bond | 1mo ago | +3.8K -1 | 100thElevated | more lines added than baseline |
| 5 | 93511be0types/geo: add geo.Point and its associated units (#16583) | Simon Law | 1y ago | +1.6K -0 | 100thElevated | more lines added than baseline |
| 6 | f81baa2dcmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115) | Tom Meadows | 1y ago | +2.2K -63 | 100thElevated | more lines added than baseline |
| 7 | 98f4dd98cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299) | Tom Proctor | 1y ago | +5.3K -66 | 100thElevated | more lines added than baseline |
| 8 | aeb15deautil/syspolicy/source: add package for reading policy settings from external stores | Nick Khyl | 2y ago | +3.0K -2 | 100thElevated | more lines added than baseline |
| 9 | af3d3c43types/prefs: add a package containing generic preference types | Nick Khyl | 2y ago | +2.9K -0 | 100thElevated | more lines added than baseline |
| 10 | 8fad8c4btstest/tailmac: add customized macOS virtualization tooling (#13146) | Jonathan Nobels | 2y ago | +3.0K -0 | 100thElevated | more lines added than baseline |
| 11 | 67df9abdutil/syspolicy/setting: add package that contains types for the next syspolicy PRs | Nick Khyl | 2y ago | +2.6K -90 | 100thElevated | more lines added than baseline |
| 12 | ba517ab3cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274) | Irbe Krumina | 2y ago | +2.1K -192 | 100thElevated | more lines added than baseline |
| 13 | 30993239cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463) | Tom Proctor | 2y ago | +4.2K -1.0K | 100thElevated | more lines added than baseline |
| 14 | 6831a29fpublicapi: create new home for API docs and split into catagory files (#12116) | Charlotte Brandhorst-Satzkorn | 2y ago | +2.2K -0 | 100thElevated | more lines added than baseline |
| 15 | 5bd19fd3cmd/k8s-operator,k8s-operator: proxy configuration mechanism via a new ProxyClass custom resource (#11074) | Irbe Krumina | 2y ago | +2.6K -91 | 100thElevated | more lines added than baseline |
| 16 | 993acf44tailfs: initial implementation | Percy Wegmann | 2y ago | +4.9K -284 | 100thElevated | more lines added than baseline |
| 17 | 92fb80d5tstest, tstime: mockable timers and tickers | Adrian Dewhurst | 3y ago | +3.1K -54 | 100thElevated | more lines added than baseline |
| 18 | ac3de93dtempfork/wireguard-windows/firewall: add. | David Anderson | 5y ago | +2.7K -0 | 100thElevated | more lines added than baseline |
| 19 | eaf1b56fcmd/k8s-operator: move proxyclass reconciler into its own package (#19695) | David Bond | 4w ago | +1.3K -1.1K | 100thElevated | more lines added than baseline |
| 20 | a5102d3fnet/routemanager: add incremental route manager | Brad Fitzpatrick | 1mo ago | +1.9K -0 | 100thElevated | more lines added than baseline |
| 21 | 50d71763control/tsp, cmd/tsp: add low-level Tailscale protocol client and tool | Brad Fitzpatrick | 4mo ago | +1.7K -0 | 100thElevated | more lines added than baseline |
| 22 | 89fe2e1fcmd/tsidp: add allow-insecure-no-client-registration and JSON file migration (#16881) | Remy Guercio | 1y ago | +1.4K -74 | 100thElevated | more lines added than baseline |
| 23 | f421907call-kube: create Tailscale Service for HA kube-apiserver ProxyGroup (#16572) | Tom Proctor | 1y ago | +2.6K -397 | 100thElevated | more lines added than baseline |
| 24 | 09582bdccmd/tsidp: add web UI for managing OIDC clients (#16068) | Raj Singh | 1y ago | +1.1K -7 | 100thElevated | more lines added than baseline |
| 25 | 4941cd7ccmd/tailscaled,ipn/{auditlog,desktop,ipnext,ipnlocal},tsd: extract LocalBackend extension interfaces and implementation | Nick Khyl | 1y ago | +2.1K -331 | 100thElevated | more lines added than baseline |
| 26 | 8597b258tsconsensus: add a tsconsensus package | Fran Bull | 1y ago | +1.9K -2 | 100thElevated | more lines added than baseline |
| 27 | ff5f233cutil/syspolicy: add rsop package that provides access to the resultant policy | Nick Khyl | 1y ago | +1.8K -18 | 100thElevated | more lines added than baseline |
| 28 | da078b4cutil/winutil: add package for logging into Windows via Service-for-User (S4U) | Aaron Klotz | 2y ago | +1.5K -4 | 100thElevated | more lines added than baseline |
| 29 | 14ac41fecmd/k8s-operator,k8s-operator: proxyclass affinity (#11862) | Lee Briggs | 2y ago | +2.4K -1 | 100thElevated | more lines added than baseline |
| 30 | 82394debcmd/tailscale: add shell tab-completion | Paul Scott | 2y ago | +2.4K -18 | 100thElevated | more lines added than baseline |
| 31 | db39a43futil/winutil: add support for restarting Windows processes in specific sessions | Aaron Klotz | 2y ago | +1.6K -75 | 100thElevated | more lines added than baseline |
| 32 | 6e30c9d1client/web: add eslint | Sonia Appasamy | 2y ago | +3.3K -546 | 100thElevated | more lines added than baseline |
| 33 | 70a9854bcmd/tailscale: add background mode to serve/funnel wip (#9202) | Tyler Smalley | 3y ago | +1.4K -42 | 100thElevated | more lines added than baseline |
| 34 | 84777354wgengine/magicsock: factor out more separable parts | David Anderson | 3y ago | +1.4K -1.3K | 100thElevated | more lines added than baseline |
| 35 | f7016d8cwgengine/magicsock: factor out endpoint into its own file | David Anderson | 3y ago | +1.1K -1.1K | 100thElevated | more lines added than baseline |
| 36 | a3c7b21cutil/linuxfw: add nftables support | KevinLiang10 | 3y ago | +1.8K -23 | 100thElevated | more lines added than baseline |
| 37 | f077b672net/dns/recursive: add initial implementation of recursive DNS resolver | Andrew Dunham | 3y ago | +1.4K -0 | 100thElevated | more lines added than baseline |
| 38 | ef6f66bbapi.md: refresh of API docs | Julia at Tailscale | 3y ago | +1.2K -604 | 100thElevated | more lines added than baseline |
| 39 | 5a44f9f5tempfork: temporarily fork gliderlabs/ssh and x/crypto/ssh | Brad Fitzpatrick | 4y ago | +2.8K -17 | 100thElevated | more lines added than baseline |
| 40 | da7544bccontrol/noise: implement the base transport for the 2021 control protocol. | David Anderson | 4y ago | +2.0K -0 | 100thElevated | more lines added than baseline |
| 41 | ea714c60cmd/tailscale/cli: split out web.css file | David Crawshaw | 5y ago | +1.3K -1.3K | 100thElevated | more lines added than baseline |
| 42 | 8d57bce5cmd/tailscale: add initial web UI (#1621) | Ross Zurowski | 5y ago | +1.6K -44 | 100thElevated | more lines added than baseline |
| 43 | 9f4fe8b5util/ioqueue: new log buffer implementation (#20816) | Joe Tsai | 2w ago | +849 -0 | 99thElevated | more lines added than baseline |
| 44 | 9d48dbd5ssh/tailssh: keep acceptEnv values and names out of the incubator cmdline (#20552) | Patrick O'Doherty | 4w ago | +821 -211 | 99thElevated | more lines added than baseline |
| 45 | 1c77079fipn/ipnlocal, feature/acme: move most remaining cert code into feature/acme | Brad Fitzpatrick | 2mo ago | +2.2K -2.0K | 99thElevated | more lines added than baseline |
| 46 | eea39eafcmd/k8s-operator: add affinity rules to DNSConfig (#19360) | David Bond | 4mo ago | +1.8K -0 | 99thElevated | more lines added than baseline |
| 47 | 2cb86cf6cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344) | David Bond | 7mo ago | +1.7K -64 | 99thElevated | more lines added than baseline |
| 48 | 73cb3b49cmd/k8s-operator/e2e: run self-contained e2e tests with devcontrol (#17415) | Tom Proctor | 7mo ago | +1.7K -331 | 99thElevated | more lines added than baseline |
| 49 | 478342a6wgengine/netlog: embed node information in network flow logs (#17668) | Joe Tsai | 10mo ago | +1.1K -591 | 99thElevated | more lines added than baseline |
| 50 | fcb614a5cmd/jsonimports: add static analyzer for consistent "json" imports (#17669) | Joe Tsai | 10mo ago | +937 -0 | 99thElevated | more lines added than baseline |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 200 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
HexSleeves/tailscale has 11,204 commits in its history from 400 contributors, the first of them Feb 1, 2020. In the last 90 days 786 files were touched, 1,756 times in total, most often local.go. Every commit is scored for change risk from its size, spread and the history of the files it touches.
