Which one should I pick for a new project?

Based on the repository data, cirruslabs/tart is the clear choice for a new project.

Why tart:

1. Active & Maintained: tart has 6,707 stars and 357 forks, indicating active community adoption. Companies like Atlassian, Figma, Mullvad, Krisp, and others rely on it in production.

2. Security: RepoPilot reports 0 critical, 0 high, 0 moderate CVEs across its 6 dependencies.

3. Clear Purpose: tart is a mature virtualization toolset for building, running, and managing macOS and Linux VMs on Apple Silicon. It's purpose-built for CI/automation.

4. Integration: It integrates with OCI registries, has a Packer plugin, and works with any CI system—making it flexible for new projects.

Why not thaw:

[stonerl/thaw] README explicitly states: "This repository has moved to: https://github.com/thaw-app/Thaw" — the repository you're looking at is abandoned and redirects elsewhere. Do not use stonerl/thaw as your dependency source.

One caveat on tart: RepoPilot notes a C-grade architecture (50/100) and OpenSSF Scorecard of 5.6/10, with gaps in dependency tooling, security policy, and SAST checks. However, the zero CVEs and active production use suggest it's operationally sound despite these governance gaps.

FOLLOW_UPS:

• What does tart's architecture C-grade mean for stability?
• How do I integrate tart into my CI pipeline?
• What are tart's system requirements for Apple Silicon?