Our graph database was abandoned upstream — here's the 6-line migration (EngramGraph 0.3.0)

In October 2025, Kùzu Inc. archived KuzuDB — the embedded graph database — with a one-line note: "Kuzu is working on something new." The npm package was deprecated, and its transitive dependencies (tar@6.2.1, npmlog, gauge) carried 5 high-severity vulnerabilities with no fix coming.

EngramGraph runs on an embedded graph database. That database was Kuzu.

EngramGraph 0.3.0 is the migration release — and the migration turned out to be far cheaper than expected. Here's why, and what we learned.

The fix: ryugraph

The community responded to KuzuDB's abandonment with several forks. We evaluated them and picked ryugraph (Predictable Labs):

• MIT licensed, actively maintained, published on npm
• Designed as a drop-in Kuzu replacement — and in our experience, it actually is
• Same storage format lineage: existing .engram/graph.db files keep working

The core API — prepare(), execute(), query(), getAll() — is signature-identical to kuzu. Our entire test suite (69 tests) passed on the first run after the swap.

Why the migration was 6 lines

One architectural decision from day one paid for itself here: every raw database call goes through a single thin wrapper (GraphConnection, ~80 lines). The other 20+ call sites in the codebase only ever see the wrapper.

So the migration was:

1. package.json: kuzu → ryugraph
2. connection.ts: one import line
3. Two type-only imports (KuzuValue → RyuValue)

That's it. If your project wraps its native dependencies behind one interface, an upstream abandonment becomes an afternoon, not a quarter.

The leftover CVEs (and the override trick)

Swapping kuzu killed the deprecated-toolchain CVEs, but ryugraph itself pins cmake-js@^7.3.0, whose tar@6.2.1 carries known path-traversal CVEs. The fix exists upstream (cmake-js@8 uses a patched tar) — ryugraph just hasn't bumped yet.

npm overrides to the rescue:

"overrides": { "cmake-js": "^8.0.0" }

npm audit: 5 high → 0.

One caveat worth knowing: npm overrides don't propagate to downstream consumers. If you depend on engramgraph (or anything that depends on ryugraph), add the same override to your own package.json until ryugraph bumps cmake-js upstream.

---

AI disclosure: I wrote this with AI assistance for English phrasing and structure. The migration, the CVE work, and the wrapper decision that made it six lines are my own — the AI did not supply the technical judgement.

Comments

[Frank]

What prompted the decision to migrate to EngramGraph specifically, and were there any particular challenges in integrating its query language?

[AsiaOstrich]

Thanks Frank — one clarification first: the migration wasn't to EngramGraph.
EngramGraph is the project; what changed was the embedded graph database
underneath it, from Kuzu to ryugraph.

And it wasn't really a decision. In October 2025, Kùzu Inc. archived KuzuDB and
deprecated the npm package, leaving its transitive dependencies (tar@6.2.1,
npmlog, and gauge) carrying five high-severity CVEs with no upstream fix
coming. Staying put wasn't really an option; the only question was which fork
best fit my constraints. ryugraph checked the three boxes that mattered: MIT
licensing, active maintenance, and—most importantly—the same storage-format
lineage, so existing .engram/graph.db files kept working with no data
migration.

On the integration side, it was surprisingly close to frictionless—but I don't
think ryugraph deserves all the credit for that. The core API (prepare(),
execute(), query(), and getAll()) is signature-compatible with Kuzu, and
all 69 tests passed on the first run after the swap. The only code change
outside the wrapper was a type rename: KuzuValue → RyuValue.

The bigger reason the migration was cheap goes back much further. Every database
call already went through a single ~80-line GraphConnection wrapper, and the
rest of the codebase only talked to that abstraction. When the upstream project
disappeared, the migration touched six lines instead of 20+ call sites. If I'd
been calling the driver directly throughout the codebase, it would have been a
very different week.

One thing worth mentioning if you're considering the same move: ryugraph
currently pins cmake-js@^7.3.0, whose bundled tar dependency still carries
known path-traversal CVEs. Adding an npm overrides entry for cmake-js@^8.0.0
brings npm audit from five high-severity issues down to zero. Just note that
published packages don't propagate overrides, so downstream consumers won't
inherit that fix unless they add the same override themselves.