# What changed in drizzle-orm

> 4 changes in drizzle-orm 0.45 from its official release notes, upgrade guides and advisories: 2 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/drizzle-orm/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## drizzle-orm 0.45

### Security

- Drizzle ORM has SQL injection via improperly escaped SQL identifiers (0.45.2) — [security advisory](https://github.com/advisories/GHSA-GPJ5-G38J-94V9), [release notes](https://github.com/drizzle-team/drizzle-orm/releases/tag/0.45.2)
- Values passed to sql.as() are now properly escaped, fixing a possible SQL injection vulnerability. (0.45.2) — [release notes](https://github.com/drizzle-team/drizzle-orm/releases/tag/0.45.2)

### New APIs and options

- Adds a Netlify DB driver that can read NETLIFY_DB_URL and NETLIFY_DB_DRIVER, accept a database URL, or use an explicit client. (0.45.3) — [release notes](https://github.com/drizzle-team/drizzle-orm/releases/tag/0.45.3)

### Fixes and other changes

- Fixed postgres-js not using prepared queries when prepare is called with an explicit name. (0.45.4) — [release notes](https://github.com/drizzle-team/drizzle-orm/releases/tag/0.45.4)