Why Drizzle ORM couldn't publish new versions to NPM for a month
Drizzle ORM was unable to publish new versions to NPM for a month because its packument (package metadata) exceeded NPM's size limits, caused by automatically generated TypeScript declaration files bloating the manifest. The issue highlights how large packuments can silently block package updates on NPM.
Background
- **Drizzle ORM** is a popular TypeScript database toolkit (like Prisma) that lets developers query databases with typed objects instead of raw SQL.
- **npm** is the default package registry for JavaScript/TypeScript. Every published package has a "packument" — a JSON metadata file listing all versions, dependencies, and info. This file grows with each new version.
- npm has a soft limit (~4 MB) and a hard limit (~10 MB) on packument size. Drizzle's packument exceeded the soft limit because its build process generated many internal entries, causing npm to silently reject publishes for a month.
- The issue stems from npm's CouchDB-based registry architecture, which is poorly documented and brittle for large packages. Drizzle fixed it by restructuring their package to reduce metadata entries.
- This matters because more complex JavaScript packages may hit this obscure limit with no clear debugging path.