Skip to content
todo-comments-vs-repository-age.html

Do older repositories carry more TODOs? 53 projects scanned

← Back to Learn · By · Published

Developers joke that every old codebase is full of "TODO: fix this later" comments that nobody ever fixed. We tested the joke. We counted TODO and FIXME markers in 53 well-regarded open-source projects, about 4.38 million lines of code in all, and compared them with the age of each project. There is a link, but a weak one. A single project accounts for more than half of all the markers, and 10 of the 53 contain none at all.

How we measured

The 53 projects, the commit scanned in each and every figure used here are in the open data file. The set covers 18 Python, 14 C++, 13 Java, 5 JavaScript, 2 C# and 1 TypeScript projects. A few definitions matter:

  • Marker. REPO-SIGHT searches the text of every comment for the strings TODO and FIXME and counts each occurrence. The search is case-sensitive, and it counts comments only, not strings or code. A comment that merely mentions the word is counted too.
  • Density. Markers per 1,000 lines of code, so large and small projects can be compared.
  • Age. Years from the first commit in the repository's history to mid-October 2026. Projects that moved to git from an older system may show a first commit later than their real birth, so treat ages as approximate.
  • Scope. Whole-repository scans, so tests, examples and bundled code are included.

The overall picture

Across all 53 projects there are 2,951 markers in 4,383,346 lines of code, which is roughly 0.67 per 1,000 lines. The typical project is much quieter than that average suggests: the median density is 0.24 per 1,000 lines, or about one marker for every 4,000 lines. The projects range in age from 6.9 to 25.5 years, with a median of 16.2.

Is there a link with age?

Yes, but it is weak. The correlation between a project's age and its TODO density is 0.24 (Pearson), and 0.29 by rank, which means age explains only around 6% of the variation between projects. The direction is what you would expect: older projects tend to carry more notes to themselves. But it is far from a rule.

Grouping the projects by age shows why:

  • Under 10 years (8 projects): median 0.10 markers per 1,000 lines.
  • 10 to 15 years (14 projects): median 0.09.
  • 15 to 20 years (22 projects): median 0.39.
  • 20 years or more (9 projects): median 0.32.

Younger projects sit low, and the older groups sit higher, but the oldest group is not the highest, and there is a lot of overlap. The pattern also holds, weakly, inside individual languages: the rank correlation is 0.26 for the 18 Python projects, 0.37 for the 14 C++ projects and 0.29 for the 13 Java projects. In every case it is positive and modest. Age is one factor among several, and a minor one.

One more detail: 92% of all the markers sit in the 31 projects that are 15 years old or more. That sounds like strong support for the joke, but most of it comes from one project, which the next section explains.

The big outlier: Guava

Google Guava has 1,663 TODO and FIXME markers, which is 56% of the 2,951 in the whole data set. Its density is 3.24 per 1,000 lines, nearly three times the next project. The five that follow it are all close together:

  • Guava (Java, 17.3 years): 3.24 per 1,000 lines, 1,663 markers.
  • Tornado (Python, 17.1 years): 1.18, 48 markers.
  • doctest (C++, 10.6 years): 1.15, 21 markers.
  • Guice (Java, 20.1 years): 1.14, 90 markers.
  • Catch2 (C++, 15.9 years): 1.07, 59 markers.
  • Mockito (Java, 18.9 years): 1.06, 69 markers.

Take Guava out and the other 52 projects together hold 1,288 markers. The age link does not disappear: the correlation without Guava is 0.30, slightly stronger. But the headline average falls sharply, which is a reminder that in code metrics a single large project can dominate a total. It also explains why Java averages about 1.5 markers per 1,000 lines in this data, against about 0.3 to 0.4 for Python and C++ and under 0.1 for JavaScript and C#. The Java average here is mostly a Guava average: its 1,663 markers are 80% of the Java total.

High marker count does not mean low quality. Guava is one of the most widely used and carefully reviewed Java libraries. Its density says something about the project's habits and its size and history. It does not say how many defects it has.

Ten projects with none

Ten of the 53 projects contain no TODO or FIXME markers at all: Polly, axios, CLI11, Express, spdlog, JUnit 5, lodash, Click, Flask and attrs. They are not all new. Express is 17 years old, Flask 16.5 and lodash 17, so age alone does not predict it. They are also smaller than average, with a median of about 27,000 lines of code against about 47,000 for the whole set.

A zero is not necessarily cleaner code. A project may track unfinished work in an issue tracker and keep source comments free of it, which is an arguably better habit. Or its maintainers may remove such notes during review. A marker count measures where people write down unfinished business, not how much of it exists.

What this means for your own code

  • Do not treat a TODO count as a quality score. It is weakly tied to age, strongly tied to team habit, and easily dominated by one project.
  • The useful question is whether notes have an owner. That is why REPO-SIGHT's TODO rules, such as py-todo-without-ticket, flag only markers that lack a ticket reference like #142 or PROJ-123. Compare # TODO fix this later with # TODO(#142): remove after migration. The first is flagged; the second is not.
  • Watch the trend, not the level. If your project's density rises on every scan, notes are piling up faster than they are resolved.
  • Mind the cost. In the health score, TODO density is worth 10% of the grade, with full marks at 0.01 markers per line of code and nothing at 0.05. Across these 53 projects it cost almost nothing, since even Guava's 0.003 is well below the penalty zone.

For the bigger picture on unfinished work, see what is technical debt?.

Limitations

  • Fifty-three projects is a small sample, chosen because they are respected and well known, so they are not representative of all code. Results from private or student projects may look very different.
  • Age is taken from the first commit, which can be misleading for projects that imported history.
  • Correlation is not causation. Older projects also tend to be larger and to have had more contributors, and either could explain a part of the effect.
  • The marker count is a simple text search and cannot judge whether a note is still relevant.

Frequently asked questions

Are TODO comments bad?

No. A TODO attached to a ticket is a reasonable way to record a known gap. The problem is a note with no owner that nobody will ever read again.

Does REPO-SIGHT count FIXME and TODO separately?

It adds them together into one count per project, and flags the ones without a ticket reference.

Can I download the data?

Yes. The open data file lists every project, the commit scanned and all the figures used in this article.

Count the TODOs in your own project

Scan a repository to see your TODO and FIXME count, and which of them have no ticket attached.