langfuse

NOT the latest Langfuse JS/TS SDK. Deprecated v3 client (new Langfuse(), trace(), api.traceList). For new work: npm install @langfuse/tracing @langfuse/otel @opentelemetry/sdk-node. Docs: https://langfuse.com/docs/observability/sdk/overview

Latest 3.39.2

NPM

68%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package includes a substantial README, but it explicitly identifies this as a legacy v3 SDK in maintenance mode and directs new users to newer packages. Repository tests and a changelog provide compensating project-quality evidence.

Release history

The package has 238 releases over roughly 3 years, but only 3 releases in the last 12 months, consistent with its documented maintenance-only status. The latest release is current, so this is not abandonment.

Security policy

No security policy was found in the repository, leaving vulnerability-reporting expectations less transparent. Active maintenance and CodeQL provide only partial practical compensation.

Token permissions

Four workflows declare read-only permissions, but two omit top-level permissions and the release workflow has top-level write access, leaving some least-privilege hygiene concerns.