Compare libraries on what actually breaks a project
Downloads and stars tell you what other people chose. This tool compares maintenance health instead -- bus factor, release cadence, dependency risk, accessibility, RSC safety -- pulled from the same measured data as each package's own catalog page, and lets you drop in your own criteria and weights on top of it.
Every row below is a due-diligence question, not a popularity contest -- downloads and stars tell you what other people already chose, not what breaks a year from now. Adjust a weight to zero to ignore a row entirely, or add your own criterion below the table for anything specific to your project.
| Criterion | Weight | cmdkBest fit for your weights | dnd kit |
|---|---|---|---|
| Maintainer bus factorOne npm account publishing a package is one phishing attempt or one burnout away from an incident (the chalk/debug attack in Sept. 2025 rode exactly one compromised account into 2.6B weekly downloads). More publishers is more resilient, not just more popular. | 3 | 2 maintainers | 1 maintainer |
| Last npm releaseA commit that never ships is a fix you don't have. This measures the last published version, not the last commit -- see "repo activity" below for the other half of that story. | 3 | ~19 mo. ago | ~22 mo. ago |
| Repo still being pushed toA repo with recent commits but no release for over a year (Headless UI's pattern in our own research) is different from one that's genuinely gone quiet -- this row and the one above are meant to be read together, not separately. | 2 | not yet assessed | ~1 mo. ago |
| Open issue backlogNot a defect count -- a proxy for how stretched the maintainers are. react-select sits at 490 open issues with a co-maintainer on record for "critical issues only, voluntary"; that is a fact worth knowing before you file the 491st. | 2 | not yet assessed | 128 open |
| Runtime dependenciesEvery dependency is a transitive CVE surface and a version-conflict risk you inherit. Zero deps means nothing else can drag its own advisory into your lockfile through this package. | 3 | 4 deps | 3 deps |
| Declares sideEffects: falseWithout this, a bundler can't safely drop code you never imported -- the whole package can end up in your bundle even if you only used one export. | 2 | side-effect free | not yet assessed |
| Typical import sizeThe ceiling on the package page imports the whole public surface; this is what bundling just the one export its own docs lead with actually costs, gzipped. Not measured for every package -- only where a single dominant export exists to bundle. | 2 | 17.0 kB min+gzip | 11.5 kB min+gzip |
| React version rangeA peer range that already includes React 19 costs nothing today and saves a forced upgrade fire drill later. | 2 | ^18 || ^19 || ^19.0.0-rc | >=16.8.0 |
| Server Components / App RouterA package that forces "use client" onto everything that touches it (usually via React Context or runtime CSS-in-JS, like styled-components/@emotion) pushes that boundary onto every consumer upstream, not just its own internals. | 3 | not yet assessed | not yet assessed |
| AccessibilityWhether keyboard nav, focus management and ARIA wiring come for free or are homework you now own. "DIY" means the library's own docs say to add it yourself -- Recharts' own wiki asks you to add role="application" by hand. | 3 | not yet assessed | not yet assessed |
| Weighted total (your settings) | 3.3/5 | 2.6/5 |
dnd kit
The actively-developed successor, @dnd-kit/react, is still pre-1.0 more than a year after this package's last release.