I don't know what the status of Bookshelf is but I do note that there are still regular contributions to the project.

As a rule Ghost tries to have write permission to core dependencies including bookshelf so there is no danger of it or any other package threatening the future of the project.

Besides, the beauty of an open source stack is there's always the ability to fork - worse comes to worst.