In October 2025, Kùzu Inc. archived KuzuDB — the embedded graph database — with a one-line note: "Kuzu is working on something new." The npm package was deprecated, and its transitive dependencies (tar@6.2.1, npmlog, gauge) carried 5 high-severity vulnerabilities with no fix coming.
EngramGraph runs on an embedded graph database. That database was Kuzu.
EngramGraph 0.3.0 is the migration release — and the migration turned out to be far cheaper than expected. Here's why, and what we learned.
The fix: ryugraph
The community responded to KuzuDB's abandonment with several forks. We evaluated them and picked ryugraph (Predictable Labs):
