Comment by ang_cire

Beyond ongoing support, community/number of contributors doesn't indicate anything, though?

And maintainability is a function of code, as it relates to humans, so it is a measure of the code itself.

One of the things I've actually seen companies considering (due to supply chain compromise attacks), is not just having an in-house package repo that trails public versions, but instead fully in-housing critical dependencies and essentially making them private forks that they (probably use LLMs to) maintain.

Basically cutting out the Chainguard-like companies that made private deps their business model.