Which has better activity and maintenance signals?

Based on the RepoPilot analysis signals:

brettwooldridge/hikaricp shows significantly better maintenance signals:

• 21,202 stars, 3,011 forks — indicates substantial adoption and community interest
• OpenSSF Scorecard: 3.7/10 — while modest, it reflects an established project with some security practices
• 0 known CVEs in dependencies — clean dependency security record
• Active CI/CD: The README references CircleCI builds and codecov coverage tracking [README.md:L574-L592], indicating ongoing testing infrastructure

However, there's a critical caveat: WAIT — Single-maintainer risk is the RepoPilot verdict. This is a major concern for long-term maintenance despite high activity metrics.

pqpo/smartcropper shows limited maintenance signals:

• No RepoPilot analysis provided in the data
• The retrieved code snippets are from TensorFlow/edge-detection workflows (Python, not actively indexed in the build system)
• No CI/CD, test coverage, or dependency security data visible in the retrieved excerpts
• Appears to be a research/tool project with less structured maintenance infrastructure

Conclusion: HikariCP has better apparent activity (stars, forks, CI/CD setup), but both projects carry maintenance risks — HikariCP due to single-maintainer concentration, smartcropper due to limited visibility into current maintenance practices. For production use, HikariCP's established track record is more defensible despite the maintainer risk.

FOLLOW_UPS:

• How does HikariCP's single-maintainer risk affect adoption decisions?
• What are smartcropper's core dependencies and stability concerns?
• When was HikariCP's last major release or commit?