Which has better activity and maintenance signals?

Based on the RepoPilot analysis signals provided:

brettwooldridge/hikaricp shows concerning maintenance signals:

• Single-maintainer risk — the verdict flags this as "WAIT" due to single-maintainer dependency
• OpenSSF Scorecard: 3.7/10 — notably weak across critical areas:
  • Dependency-Update-Tool: 0/10
  • Security-Policy: 0/10
  • SAST (Static Analysis Security Testing): 0/10
• No open SAST alerts, but the low scorecard indicates gaps in automated security practices and dependency management tooling

realm/realm-java does not have explicit RepoPilot signals in the provided data, so I cannot make a direct comparison using the authoritative computed signals.

However, from the repository data alone:

• realm/realm-java shows recent activity with entries in CHANGELOG.md dated recently (enhancements noted)
• realm/realm-java has documented contribution guidelines [README.md:L281-L293], a code of conduct reference, and community resources [README.md:L41-L46]
• hikaricp's README reflects a mature, stable library ("A solid, high-performance, JDBC connection pool at last") but doesn't indicate active development cadence

Bottom line: The available signals suggest hikaricp has maintenance risk (single maintainer, weak OpenSSF scorecard), while realm/realm-java appears to have more structured maintenance and community engagement based on documentation and changelog activity. However, I lack full RepoPilot analysis for realm-java to make a definitive comparison.

FOLLOW_UPS:

• When was hikaricp's last commit or release?
• Does realm-java have OpenSSF Scorecard metrics?
• How many active maintainers does realm-java have?