Engineering-health report
pallets/flask
Flask shows a working delivery pipeline with configured CI and a test footprint larger than its source footprint. Its main diligence concern is how concentrated recent contribution is in a single maintainer. Dependency freshness is mixed: half of the sampled dependencies have not had a recent upstream release.
Of the 98 commits read from the last 12 months, the top author, davidism, accounts for a top-author share of 93%, and only 6 active authors appear in that window. The same pattern holds at the directory level. In src, the leading author's share of recent commits is 94% across 2 contributors. In docs it is 90% across 3 contributors, and in tests it is 84% across 3 contributors. Only examples is more evenly split, with a leading-author share of 50% across 2 contributors. For an acquirer, this means knowledge of the core source tree rests largely with one person over this period. The commit data alone cannot show whether other maintainers review or approve changes without authoring them. Review and merge records would resolve that question.
The repository recorded 98 commits in the last 12 months. That is a single total with no monthly breakdown, so it supports no conclusion about pace or direction. The test-to-source file ratio is 133%, meaning there are more test files than source files. This is a favorable structural signal, although file counts do not measure coverage or test quality. CI is configured. The dependency manifest, pyproject.toml, declares 6 dependencies. All 6 were sampled, and 3, or 50%, have a newest upstream release more than 18 months old. This measures upstream release age, not how far the pinned versions lag. A stale upstream may simply be a mature, stable package rather than an abandoned one, and the data does not distinguish between the two. The README was last updated on 2025-06-12.
A diligence reviewer should ask three follow-up questions. First, given a top-author share of 93% and a 94% leading-author share in src, who besides davidism holds merge rights and release authority, and how many pull requests did others review in the same 12-month window? Second, for the 3 of 6 dependencies with no release in over 18 months, are these stable mature packages or unmaintained ones, and how current are the pinned versions relative to their latest releases? Third, beyond the 133% test-to-source file ratio, what line or branch coverage does CI report, and do CI failures block merges?
The numbers
- Commits (12 mo)
- 98
- Active authors
- 6
- Top-author share
- davidism · 93%
- Test-to-source ratio
- 133%
- CI present
- Yes
- Stale dependencies
- 3 of 6 (50%)
- README last updated
- 2025-06-12
Bus factor by directory
| Directory | Dominant author | Share | Contributors |
|---|---|---|---|
docs | davidism | 90% | 3 |
tests | davidism | 84% | 3 |
examples | davidism | 50% | 2 |
src | davidism | 94% | 2 |
How we computed this
Every number in this report comes from the repository's public GitHub data and public package registries on the report date, so each one can be checked against those sources.
- Commit activity: 98 commits on the default branch in the last 12 months, counted from GitHub's commit list.
- Author concentration: Top-author share of 93% across 6 active authors, counted from the newest 98 commits in those 12 months, attributed to authors as GitHub records them.
- Bus factor by directory: For up to 8 of the largest top-level directories, the leading author's share of the newest commits touching that directory in the last 12 months, up to 300 commits per directory, and how many authors made those commits. Taken from GitHub's commit list filtered by path.
- Test signal: 133% test-to-source file ratio: source files in test directories or named as tests, against other source files, in the default branch's file list. A proxy for coverage, not a coverage measurement.
- CI presence: A CI configuration file was found in the repository (GitHub Actions, GitLab CI, CircleCI, Jenkins, Travis CI, Azure Pipelines, Buildkite, Bitbucket Pipelines, AppVeyor or Drone).
- Dependency freshness: Of 6 dependencies declared in the root manifest, 6 checked against the npm or PyPI registry: 3 (50%) have a newest release more than 18 months old. This shows whether a dependency is still being released, not how far behind the repository's pinned version is.
- README date: The root README was last changed on 2025-06-12, from GitHub's commit list for that file.