← Home

drizzle-kit

npm Repository Homepage

Drizzle Kit is a CLI migrator tool for Drizzle ORM. It is probably the one and only tool that lets you completely automatically generate SQL migrations and covers ~95% of the common cases like deletions and renames by prompting user input. <https://github

74
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

dankochetovsherimanalexblokhkyrylo_usichenko

Keywords

drizzleormpgmysqlsinglestorepostgresqlpostgressqlitedatabasesqltypescripttsdrizzle-kitmigrationsschema

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:drizzle-orm AI (phantom-deps): Optional peer used by the ORM tooling; stable FP. ai
install-scripts install-script:preinstall AI (install-scripts): Preinstall is only-allow pnpm guard; no code fetch/exec. ai
phantom-deps phantom-dep:ink AI (phantom-deps): UI framework dependency for CLI; referenced in config files as documented. ai
phantom-deps phantom-dep:react AI (phantom-deps): React peer dependency for ink-based UI; stable pattern for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Standard SASL/SCRAM auth decoding in bundled pg driver, not payload hiding. ai
phantom-deps phantom-dep:use-immer AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:immer AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:uuid AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:ink-router AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:ink-text-input AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:immer-reducer AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:ink-divider AI (phantom-deps): Used via config/CLI wiring, stable false positive for this package. ai
phantom-deps phantom-dep:@types/uuid AI (phantom-deps): Type package, expected pattern. ai
phantom-deps phantom-dep:pg AI (phantom-deps): Driver loaded dynamically by config, longstanding pattern. ai
semgrep semgrep:env-bulk-read AI (semgrep): Debug library env filtering, not credential exfil. ai
phantom-deps phantom-dep:xstate AI (phantom-deps): CLI tool with dynamic config-based dependency loading; stable pattern for this package. ai
phantom-deps phantom-dep:enquirer AI (phantom-deps): Interactive CLI dependency; expected for this package. ai
phantom-deps phantom-dep:js-yaml AI (phantom-deps): Config parsing dependency; expected for CLI tool. ai
phantom-deps phantom-dep:source-map-support AI (phantom-deps): Build tool dependency; expected for this package. ai
phantom-deps phantom-dep:pretty-error AI (phantom-deps): Error formatting utility; expected for this package. ai
phantom-deps phantom-dep:loading-cli AI (phantom-deps): CLI progress indicator; expected for this package. ai
phantom-deps phantom-dep:cli-table AI (phantom-deps): CLI output formatting; expected for this package. ai
phantom-deps phantom-dep:npm AI (phantom-deps): Long-standing declared dep used via CLI tooling, stable false positive. ai
semgrep semgrep:eval-usage AI (semgrep): eval() executes locally-compiled esbuild output within the build pipeline, not remote/untrusted input. ai
semgrep semgrep:child-process-spawn AI (semgrep): Part of bundled commander CLI arg-parsing, standard pattern. ai
semgrep semgrep:child-process-import AI (semgrep): Bundled commander library code, not package's own logic. ai
semgrep semgrep:new-function-constructor AI (semgrep): jsonc-comment-stripping parser utility, not exec of untrusted input. ai
phantom-deps phantom-dep:zod AI (phantom-deps): Used via config/schema validation, standard phantom-dep FP. ai
phantom-deps phantom-dep:hanji AI (phantom-deps): CLI rendering helper referenced indirectly; known FP pattern. ai
phantom-deps phantom-dep:json-diff AI (phantom-deps): Used for diffing, phantom-dep FP. ai
dependencies unvetted-dep:immer-reducer AI (dependencies): Legitimate immer helper lib, long-standing dependency. ai
dependencies unvetted-dep:@lambda-team/ltdl AI (dependencies): Publisher's own org package, consistent with repo ownership. ai
phantom-deps phantom-dep:toml AI (phantom-deps): Config-loaded dep, expected false positive for CLI tool. ai
dependencies unvetted-dep:ink-router AI (dependencies): Legitimate ink TUI routing lib used by drizzle-kit's CLI. ai
dependencies unvetted-dep:hanji AI (dependencies): hanji is drizzle-team's own small CLI prompt lib, long-standing dependency. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require loads user schema files, core to drizzle-kit's introspection functionality. ai
source-diff obfuscated-file:api.mjs AI (source-diff): esbuild ESM bundle output, minified not obfuscated ai
source-diff net-exec-file:api.js AI (source-diff): esbuild-bundled CLI; net+exec are normal build-tool primitives ai
source-diff obfuscated-file:api.js AI (source-diff): esbuild bundle output for new ./api export, not obfuscation ai
provenance missing-githead AI (provenance): explained by move to CI/CD SLSA-attested publish ai
source-diff net-exec-file:api.mjs AI (source-diff): esbuild-bundled CLI; dual-use build primitives ai
phantom-deps phantom-dep:hono AI (phantom-deps): Used internally by CLI bundle, not directly imported at top level. ai
phantom-deps phantom-dep:@hono/zod-validator AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:@hono/node-server AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:superjson AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:minimatch AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:env-paths AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:commander AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:camelcase AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:semver AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:chalk AI (phantom-deps): Bundled CLI dep, false positive pattern. ai
phantom-deps phantom-dep:@esbuild-kit/esm-loader AI (phantom-deps): @esbuild-kit/esm-loader is a legitimate build/loader dependency; phantom-dep is expected for build infrastructure. ai
phantom-deps phantom-dep:@drizzle-team/brocli AI (phantom-deps): @drizzle-team/brocli is a legitimate CLI utility dependency; phantom-dep is expected for CLI tools. ai
phantom-deps phantom-dep:esbuild-register AI (phantom-deps): esbuild-register is a legitimate build/config dependency; phantom-dep is expected for build infrastructure. ai
phantom-deps phantom-dep:esbuild AI (phantom-deps): esbuild is a legitimate build dependency used in the build process; phantom-dep is expected for build tools. ai
dependencies unvetted-dep:@esbuild-kit/esm-loader AI (dependencies): Well-known ESM loader utility; standard tooling dependency for drizzle-kit's build/runtime pipeline. ai
dependencies unvetted-dep:@drizzle-team/brocli AI (dependencies): First-party dependency from the drizzle-team namespace; stable CLI utility used across drizzle-kit versions. ai

Versions (showing 74 of 174)

Version Deps Published
0.16.0 7 / 22
0.15.1 7 / 22
0.15.0 7 / 22
0.14.8 7 / 22
0.14.7 7 / 22
0.14.6 7 / 22
0.14.5 7 / 22
0.14.4 7 / 22
0.14.3 7 / 22
0.14.2 7 / 17
0.14.1 7 / 17
0.14.0 7 / 17
0.13.0 7 / 17
0.12.18 7 / 17
0.12.17 7 / 17
0.12.16 7 / 17
0.12.15 7 / 17
0.12.14 7 / 17
0.12.13 7 / 17
0.12.12 7 / 17
0.12.10 7 / 17
0.12.7 5 / 16
0.12.6 6 / 16
0.12.5 5 / 16
0.12.4 5 / 16
0.12.3 5 / 16
0.12.2 5 / 16
0.12.1 5 / 16
0.9.54 12 / 7
0.9.53 12 / 7
0.9.52 12 / 7
0.9.50 10 / 13
0.9.49 10 / 13
0.9.48 10 / 13
0.9.47 10 / 13
0.9.46 10 / 13
0.9.45 10 / 13
0.9.44 10 / 13
0.9.43 10 / 13
0.9.42 10 / 13
0.9.41 10 / 13
0.9.40 11 / 13
0.9.39 11 / 13
0.9.38 11 / 13
0.9.37 11 / 13
0.9.36 11 / 13
0.9.35 11 / 13
0.9.34 11 / 12
0.9.33 11 / 12
0.9.32 11 / 12
0.9.31 11 / 12
0.9.30 11 / 12
0.9.29 11 / 12
0.9.28 10 / 12
0.9.27 10 / 12
0.9.26 10 / 12
0.9.25 10 / 27
0.9.24 10 / 27
0.9.23 10 / 24
0.9.22 23 / 24
0.9.21 23 / 24
0.9.19 23 / 24
0.9.17 23 / 26
0.9.16 23 / 26
0.9.15 22 / 27
0.9.13 23 / 26
0.9.12 23 / 26
0.9.11 23 / 25
0.9.10 23 / 26
0.9.4 40 / 24
0.9.3 40 / 24
0.9.2 40 / 24
0.9.1 40 / 24
0.9.0 26 / 20

v0.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.15

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexblokh.

v0.12.14

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexblokh.

v0.12.13

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexblokh.

v0.12.12

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexblokh.

v0.12.10

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexblokh.

v0.12.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.1

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexblokh.

v0.9.54

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.53

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.52

2 findings
HIGH Package has 'preinstall' script install-scripts

Script: npx only-allow pnpm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.50

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.49

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.48

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.47

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.46

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.45

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.44

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.43

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.42

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.41

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.40

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.39

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.38

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.37

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.36

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.35

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.34

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.33

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.28

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.27

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.25

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.24

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.