Nobody regrets an ORM's feature list. They regret its escape hatch.
Start here
- TypeScript, and you like SQL → Drizzle or Kysely
- TypeScript, and you want the most finished experience → Prisma
- Python → SQLAlchemy with Alembic. One decision, not two.
- JVM, and you want the ORM → Hibernate
- JVM, and you want typed SQL → jOOQ
- Go → sqlc if the team likes SQL, GORM if it wants an ORM, Ent if your model is a graph
- Rust → Diesel for compile-time checking, SeaORM for async-first
- Migrations only → Flyway for plain SQL, Liquibase for cross-engine, Atlas for schema-as-code
This category is three different tools
Most "best ORM" lists put all three in one table and rank them against each other, which is how people end up choosing Flyway when they needed Drizzle.
| Kind | What it does | Products |
|---|---|---|
| ORMs | Map rows to objects, generate SQL | Prisma, SQLAlchemy, Sequelize, TypeORM, MikroORM, Doctrine, Django ORM, Hibernate, GORM, Ent, Diesel, SeaORM, Ecto, Dapper, Objection.js |
| Query builders | Keep you writing SQL, add types | Kysely, Knex.js, jOOQ, sqlc, MyBatis, Drizzle |
| Migration tools | Version your schema, no querying | Alembic, Flyway, Liquibase, Atlas |
The escape hatch test
Three questions, before you look at anything else.
Can I drop to raw SQL without leaving the tool? SQLAlchemy can: Core sits underneath the ORM as a first-class API, not a trapdoor. Drizzle and Kysely assume you will. Prisma historically made this harder, which is the most common reason teams move off it.
Who owns my migrations? This is where the lock-in lives. Queries are rewritable in a week; migration history is years of state a new tool cannot reconstruct. Plain-SQL migrations are portable, proprietary changelog formats are not.
What happens if the project stops? Of the 25 here, two are commercial products with an open-source core. The rest are community or foundation projects with very different bus factors.
TypeScript and JavaScript
The most crowded group, and the only one where our adoption data is complete enough to compare on.
| Tool | Type | Licence | Stars | Shipped | Advisories (12m) |
|---|---|---|---|---|---|
| Prisma | ORM | Apache-2.0 core | 47,599 | 2026-09-09 | 0 (0) |
| Drizzle ORM | SQL-first | See note | 35,734 | 2026-06-27 | 1 (1), HIGH |
| TypeORM | ORM | MIT | 36,653 | 2026-09-01 | 0 (0) |
| Sequelize | ORM | MIT | 30,364 | 2026-03-07 | 19 (2), CRITICAL |
| Knex.js | Query builder | MIT | 20,341 | 2026-06-26 | 2 (0), CRITICAL |
| Kysely | Query builder | MIT | 14,214 | 2026-08-10 | 4 (4), HIGH |
| MikroORM | ORM | MIT | 9,213 | 2026-09-07 | 2 (2), CRITICAL |
| Objection.js | ORM on Knex | MIT | 7,341 | Not recorded | 1 (0), CRITICAL |
Prisma
Apache-2.0 core, commercial platform from $10/month. Free tier: 500MB, 200k operations/month. Paid $49 and $129. Score 78.8, confidence 0.75. The only entry here with an active SOC 2.
Pricing transparency scores 100, which is rarer than it should be.
Pick it ifyou want the most finished developer experience and can accept a vendor in your data layer. Avoid it if you will need to reach past the query API often.
Drizzle ORM
35,734 stars. Shipped 2026-06-27. One HIGH advisory this year. Score 69.0.
Pick it ifyou like SQL and want the escape hatch to be "just write SQL".
Sequelize
MIT. 30,364 stars. 193,226 dependent repos. Shipped 2026-03-07. 19 advisories, 2 this year, CRITICAL.
A high count partly reflects age and a mature disclosure process, and Sequelize predates most of this list.
Avoid it for something new without a clear reason: combined with the longest release gap among the active JavaScript tools, it is the one entry here that needs justifying.
Kysely
MIT. 14,214 stars. Shipped 2026-08-10. 4 advisories, all 4 in the last 12 months, HIGH.
That reads differently from Sequelize's nineteen accumulated over a decade. For a query builder with a small surface, worth understanding before adoption rather than after.
Python
| Tool | Type | Licence | Stars | Shipped | Advisories |
|---|---|---|---|---|---|
| SQLAlchemy | ORM + Core | MIT | 12,147 | 2026-09-08 | 3 (0), CRITICAL |
| Alembic | Migrations | MIT | 4,386 | 2026-09-04 | 0 (0) |
| Django ORM | ORM | BSD-3-Clause | 90,354 | Not recorded | See note |
SQLAlchemy and Alembic are one decision: same author, and Alembic is the migration tool SQLAlchemy assumes. Its Core layer is the escape hatch, which is why the regret rate is low.
The Django ORM figure needs a caveat we would rather state than bury. Our security data counts advisories against the Django framework, not the ORM: 100 known, 30 in the last twelve months. Django is a full web framework with a large attack surface and a rigorous disclosure process, so that number says almost nothing about the ORM and should not be compared with the figures above.
JVM, Go, Rust and the rest
| Tool | Ecosystem | Licence | Stars | Dependents | Shipped |
|---|---|---|---|---|---|
| Hibernate ORM | JVM | Apache-2.0 | 6,469 | 145,451 | 2026-08-30 |
| MyBatis | JVM | Apache-2.0 | 20,441 | 87,034 | 2025-01-02 |
| jOOQ | JVM | Dual, see note | 6,785 | 4,667 | 2026-09-04 |
| GORM | Go | MIT | 39,952 | 22,361 | 2026-06-25 |
| sqlc | Go | MIT | 18,271 | 1 | 2026-04-22 |
| Ent | Go | Apache-2.0 | 17,199 | 808 | 2026-03-23 |
| Diesel | Rust | Apache-2.0 | 14,175 | 3,691 | 2026-09-04 |
| SeaORM | Rust | Apache-2.0 | 9,890 | 429 | 2026-08-12 |
| Doctrine | PHP | MIT | 10,170 | 87,805 | 2026-09-07 |
| Dapper | .NET | Not recorded | 18,384 | 477 | 2026-05-16 |
| Ecto | Elixir | Apache-2.0 | 6,495 | 12,249 | See note |
Star counts mislead badly here. Hibernate has 6,469 stars and 145,451 dependent repositories. GitHub stars do not measure Java adoption.
jOOQ is the other commercial product. Free for open-source databases, from 99 euros per developer workstation per year for Oracle, SQL Server and DB2, with a 30-day trial. Your licence cost is a function of which database you run.
Diesel carries 6 advisories, 4 in the last twelve months, CRITICAL, the highest recent rate in this group. MyBatis last released 2025-01-02, the oldest among the widely deployed. Ecto has not cut a GitHub Release since 2020, which sounds alarming and is not: it tags without publishing releases, and its current tag is v3.14.2. Judge it on tags, not our date.
sqlc inverts the relationship: you write SQL, it generates Go. If your team is comfortable in SQL that removes an entire abstraction layer and the escape-hatch question disappears.
Migration and schema tools
| Tool | Licence model | Dependents | Shipped |
|---|---|---|---|
| Flyway | Apache-2.0 core, Enterprise edition | 30,708 | 2026-09-10 |
| Liquibase | Free Community, Secure edition on request | 29,346 | 2026-09-11 |
| Atlas | Open core, Pro and Cloud | 593 | 2026-08-02 |
| Alembic | MIT | 52,456 | 2026-09-04 |
Flyway's model is plain SQL files in a directory, which is the most portable migration history you can have and the reason to choose it even over tools with more features. If you leave, your migrations are still just SQL.
Liquibase's Secure edition is priced on request, which counts against pricing transparency: you cannot budget for a number nobody publishes.
Cost, briefly
23 of 25 are free. Two are commercial: Prisma (from $10/month) and jOOQ (from 99 euros per developer per year for commercial databases). Three more are open-core: Flyway, Liquibase, Atlas.
So cost is almost never the deciding factor here, which is unusual. The real costs are migration lock-in and the hours your team spends fighting an abstraction that does not fit. An ORM that costs nothing and wastes a week per engineer per quarter is the expensive option.
How we scored this
Signals are properties of the software: licence, release cadence, published advisories, integrations, pricing transparency. No reviews, no company size, no web traffic, no vendor ad spend. Facts retrieved 2026-09-11, refreshed 2026-09-14. Full method · Independence
We are not publishing a cross-ecosystem ranking, and you should not infer one from the tables above. Our composite is a weighted average over signals we have evidence for, shrunk toward a neutral 50 in proportion to coverage, with confidence dropping accordingly. Our heaviest signal is package downloads, and we ingest npm and PyPI but not Maven, crates.io, NuGet, Go modules, Hex or Packagist. So the shrink falls almost entirely on the ecosystems we measure least well:
| Tool | Published | On present evidence | Confidence |
|---|---|---|---|
| Django ORM | 62.1 | 71.5 | 0.32 |
| Diesel | 63.4 | 70.6 | 0.43 |
| Hibernate | 61.8 | 68.7 | 0.40 |
| SeaORM | 58.9 | 65.5 | 0.34 |
| Prisma | 78.8 | 78.9 | 0.75 |
Read on the evidence we hold, Hibernate places 8th rather than 12th. Neither number is wrong: the published figure says what we can support, the second says what the evidence shows. Compare within an ecosystem until Maven and the others land.
One figure excluded: we record TypeORM at 5 dependent repositories; the source returns 51,340. We checked six other entries here against the live source and all six matched, so this is an isolated error. Dependency counts are not used in any comparison above.