KeePass 2 seems to still be hosted on Sourceforge, and I'm not even sure where to get a copy of the latest (non-release) version of the source. The [Sourceforge repo][1] seems to be an outdated SVN repo which was last updated in 2009, and I don't see any description of how to contribute code to the project anywhere. As a result I'm not really sure how to gauge the level of activity on the project itself. Similarly, the website is ancient and doesn't seem to have kept up with the times; I seem to recall it was only recently that it even got HTTPS support.
In contrast, KeePassXC is hosted on GitHub, development is done out in the open, and it's trivial to see that in just the last year there were [dozens of individual contributors][2]. The website looks clean, is user-friendly with up-to-date documentation, and a [contribution guide][3] is plainly visible in the README on GitHub.
As a result, I feel a bit better about the long-term prospects of KeePassXC over KeePass 2.
[1]: https://sourceforge.net/p/keepass/code/HEAD/tree/
[2]: https://github.com/keepassxreboot/keepassxc/graphs/contribut...
[3]: https://github.com/keepassxreboot/keepassxc#contributing
With KeePassXC for example, even though the latest release came out less than a day ago I can see that there have already been [14 commits][1] to the `develop` branch since that release. I can't find the equivalent of such a branch for KeePass 2.
[1]: https://github.com/keepassxreboot/keepassxc/compare/2.3.0......
They do make the source available with each release, and a user has mirrored them onto GitHub [3]. I also cannot find the source for older releases.
[1] https://sourceforge.net/p/keepass/discussion/329220/thread/0...
[2] https://sourceforge.net/p/keepass/discussion/329220/thread/b...
On Windows, KPXC might actually be a step backward since KP2 is quite stable and has more plugins. I'm not sure which is more secure between the two.