# Vetting record: drizzle-orm
package: drizzle-orm
version: 0.45.2
integrity: sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==
verdict: REVIEW
reviewed-by: Claude (evaluator) with tools/npm-vet.mjs stage 1
date: 2026-08-28
## Justifications
All 91 findings are low-severity documentation URLs (postgresql.org,
sqlite.org, and similar reference links) inside comments and .d.ts
files across the dialect modules - inert text, justified as such.
Provenance attested, no install scripts, no credential/process/eval
markers, zero runtime dependencies (drivers are peer dependencies the
consumer admits separately - see plugins/postgres). 2666 files
scanned.
## Adapter trust boundary (WO-19)
The repository-owned `adapter.js` validates every row returned to host code
through `validatedRows(table, rows)`. It uses Drizzle's published table and
column metadata to enforce mapped runtime type, enum membership, nullability,
array element types, and exact declared row shape. A mismatch fails closed as
`DATABASE_ROW_DRIFT` and records the physical `table.column`, row index,
expected mapping, and received runtime type. Custom column types without a
published runtime representation are refused instead of guessed. PostgreSQL
`bit(n)` strings require exactly `n` binary digits. PostgreSQL `interval`
strings are refused until the adapter has a reviewed closed representation
contract; the broad JavaScript string carrier alone does not establish trust.
Behavioral coverage lives in `plugins/drizzle-orm/validated-rows.test.mjs` and
is joined to `cargo test --workspace` by
`crates/cli/tests/wo19_validated_rows.rs`.
WO-37 extends the same boundary to the published `mysql-core` column types.
The mapping enforces signed and unsigned integer widths, safe-number versus
BigInt carriers, decimal precision and scale, temporal ranges and fractional
precision, string/enumeration widths, JSON shape, and binary widths. Unknown
`MySql*` custom types fail closed instead of inheriting a broad JavaScript
carrier. Scheme dispatch and MySQL mappings are covered by
`plugins/drizzle-orm/mysql.test.mjs`; the live MySQL 8 round trip is joined to
the workspace gate by `crates/cli/tests/wo37_mysql.rs`.
WO-38 extends the boundary to the published `sqlite-core` column types and
uses only Node.js's builtin `node:sqlite`. No SQLite registry package, native
addon, install script, or transitive dependency is admitted. Drizzle 0.45.2
does not include a `node:sqlite` driver, so `adapter.js` owns the minimal
synchronous client compatibility layer while continuing to use Drizzle's
SQLite dialect and session. The exact affinity/carrier table is documented in
`README.md`; unknown `SQLite*` custom types fail closed. File and memory
round-trips, row trust, and availability diagnostics are covered by
`plugins/drizzle-orm/sqlite.test.mjs` and joined to every workspace run by
`crates/cli/tests/wo38_sqlite.rs`.
## Stage-1 report
```json
{
"package": "drizzle-orm@0.45.2",
"integrity": "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==",
"provenance": "attested",
"filesScanned": 2666,
"findings": [
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/columns/common.cjs: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/columns/common.d.ts: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/columns/common.js: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/db.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/db.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/db.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/delete.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/delete.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/delete.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/insert.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/insert.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/insert.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/select.cjs: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/select.d.ts: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/select.js: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/update.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/update.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "gel-core/query-builders/update.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/columns/date.common.cjs: https://dev.mysql.com"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/columns/date.common.js: https://dev.mysql.com"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/db.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/db.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/db.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/delete.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/delete.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/delete.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/insert.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/insert.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/insert.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/select.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/select.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/select.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/update.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/update.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/query-builders/update.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql-core/schema.d.ts: https://dev.mysql.com"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql2/driver.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "mysql2/driver.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "package.json: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/columns/common.cjs: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/columns/common.d.ts: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/columns/common.js: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/db.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/db.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/db.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/delete.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/delete.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/delete.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/insert.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/insert.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/insert.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/select.cjs: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/select.d.ts: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/select.js: https://www.postgresql.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/update.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/update.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "pg-core/query-builders/update.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/columns/common.cjs: https://docs.singlestore.com"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/columns/common.js: https://docs.singlestore.com"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/db.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/db.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/db.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/delete.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/delete.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/delete.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/insert.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/insert.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/insert.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/select.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/select.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/select.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/update.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/update.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/query-builders/update.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "singlestore-core/schema.d.ts: https://docs.singlestore.com"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/columns/blob.d.ts: https://www.sqlite.org"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/db.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/db.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/db.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/delete.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/delete.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/delete.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/insert.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/insert.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/insert.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/select.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/select.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/select.js: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/update.cjs: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/update.d.ts: https://orm.drizzle.team"
},
{
"severity": "low",
"kind": "external-url",
"detail": "sqlite-core/query-builders/update.js: https://orm.drizzle.team"
}
],
"notes": [
"resolved drizzle-orm@0.45.2, integrity sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q=="
],
"sandbox": null,
"verdict": "REVIEW"
}
```