Knex VS MikroORM

Knex.js

AdonisJS core team has created/maintains Lucid. It is a SQL query builder, and an Active Record ORM built on top of Knex.

Now, why not use an ORM? I've seen performance issues too many times with ORMs. I prefer writing my own SQL to avoid surprises. After all, I know the database schema and writing code for a specific purpose very often leads to better performance than generic code. ORMs have to support all kinds of database schemas. I only have to support mine. Having successfully used Knex.js in NodeJS (a popular query builder) in the past, I know writing SQL queries myself is not hard and provides very good performance.

Given the dynamic nature of the schema, we employ Knex, a query builder, for database access.

https://www.npmjs.com/package/knex - 779 issues

# related: https://github.com/knex/knex/issues/2354

This article will be focused on a security issue that I found in Knex and how to mitigate it, but I'll also talk briefly about the social aspects of this problem.

SQL is an old, irregular language to work with, but it is better known than HCL and SQL already has it's own Pulumi/CDK in the form of every ORM with introspection (like Javascript's Prisma, Python's Django, Go's XO etc) and QueryBuilder (LINQ, Knex, etc) in whatever programming language you prefer. You probably already know it.

In my usual NodeJS tech stack, which includes GraphQL, NestJS, SQL (predominantly PostgreSQL with MikroORM), I encountered these limitations. To overcome them, I've developed a new stack utilizing Rust, which still offers some ease of development:

https://www.npmjs.com/package/mikro-orm - 44 issues

Mikro-ORM is a TypeScript ORM that focuses on simplicity and efficiency. It supports various SQL databases and MongoDB. Mikro-ORM is known for its simplicity and developer-friendly APIs. It provides a concise syntax for defining data models and relationships, making it easy to use.

I found MikroORM [0] to be quite reasonable if you're in the TS ecosystem already. It was also easy to do custom, raw queries, and really just felt like it wasn't in the way.

[0] https://mikro-orm.io/

It also does code generation into its own module, so good luck with hoisting in a monorepo where you want multiple independent prisma schemas. MikroORM[1] is a much better alternative to Prisma in my opinion but any ORM carries some form of baggage.

[1] https://mikro-orm.io/

More about v6 development can be found here.

I recommend looking at https://mikro-orm.io/