Is @adonisjs/lucid safe to use?

@adonisjs/lucid has 1 known vulnerabilities on the latest version (22.4.2). DepScope rates its health at 60/100 (moderate risk).

What is the latest version of @adonisjs/lucid?

The latest version of @adonisjs/lucid is 22.4.2, released 2026-04-05.

Does @adonisjs/lucid have known vulnerabilities?

Yes. @adonisjs/lucid has 1 known vulnerabilities. See depscope.dev/pkg/npm/@adonisjs/lucid for details.

Is @adonisjs/lucid deprecated?

No, @adonisjs/lucid is actively maintained. Latest release: 22.4.2 (2026-04-05).

What are alternatives to @adonisjs/lucid?

Popular alternatives to @adonisjs/lucid in npm include: semver, minimatch, ansi-styles, debug, brace-expansion.

What license does @adonisjs/lucid use?

@adonisjs/lucid is licensed under MIT.

@adonisjs/lucid

npmv22.4.2

SQL ORM built on top of Active Record pattern

License MITpermissive186 versions3 maintainers15 deps86,028 weekly dl

adonisjs/lucid

/ 100

Health

update required

@adonisjs/[email protected] has vulnerabilities — update to latest

Update to >= 22.0.0-next.6 to fix known vulnerabilities

Moderate health score (60/100) — verify manually
1 high severity vulnerabilities

Health breakdown0 – 100

25/25

maintenance

10/20

popularity

20/25

security

15/15

maturity

9/15

community

Vulnerabilities

1 high

Advisories (1)

Severity	ID	Summary	Fixed in
high	CVE-2026-22814	Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State	22.0.0-next.6

Bundle & TypeScript

📦

Bundle Size

21.9 KBminified

9.3 KB gzipped

15 direct dependencies

side effectsscoped

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (15)

@adonisjs/presets @faker-js/faker @poppinss/hooks @poppinss/macroable @poppinss/qs @poppinss/utils deepmerge fast-deep-equal igniculus kleur knex knex-dynamic-connection pretty-hrtime slash tarn

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@adonisjs/lucid