github.com/go-gorm/gorm
This package has a good security score with no known vulnerabilities.
Community Reviews
Powerful ORM with gentle learning curve, but watch for implicit behaviors
The real learning happens when you hit edge cases. GORM's "magic" can bite you - soft deletes are enabled by default if you include gorm.DeletedAt, associations preload differently than you'd expect, and zero values in updates get silently ignored unless you use Select or Updates with a map. Error messages have gotten better but sometimes fail silently in ways that require reading the source code to understand.
Debugging is manageable with the built-in logger that shows SQL queries, which is invaluable when behavior surprises you. The community is active on GitHub, though you'll often find issues closed with "working as intended" for behaviors that feel unintuitive. Once you internalize GORM's conventions, productivity is high, but budget time for the learning curve around implicit behaviors.
Best for: Teams building typical CRUD applications who want to reduce database boilerplate and can invest time learning GORM's conventions.
Avoid if: You need precise control over every SQL query, require predictable behavior without implicit magic, or are building high-performance systems where query overhead matters.
Powerful ORM with excellent conventions, but magic comes with surprises
The main friction comes from GORM's implicit behaviors. Silent failures are common - forgetting `db.Error` checks means bugs slip through. The distinction between `Find()` returning empty results versus errors requires vigilance. Complex queries sometimes generate unexpected SQL, and debugging requires enabling statement logging. Migration from v1 to v2 was painful due to breaking API changes, though v2 is much more stable.
Type safety is decent with generics in recent versions, but you lose compile-time guarantees compared to type-safe query builders. Error messages can be cryptic, especially with association loading failures. Despite these quirks, GORM remains highly productive for applications where the 80% use case aligns with its conventions.
Best for: Applications with conventional CRUD patterns, relational data with associations, and teams prioritizing development speed over query-level control.
Avoid if: You need guaranteed type safety at compile time, require complex analytical queries, or want explicit control over every SQL statement generated.
Powerful ORM with gentle learning curve, but hooks can surprise you
Where GORM shines is handling relationships. Belongs-to, has-many, and many-to-many associations work smoothly once you understand the tag syntax. Preloading related data with `Preload()` prevents N+1 queries effectively. Error handling follows Go conventions with `db.Error`, though you need to remember to check it after every operation.
The main gotcha is lifecycle hooks (BeforeCreate, AfterSave, etc.) which can execute unexpectedly and are hard to debug when they interfere with your logic. Raw SQL support is solid for when you need to drop down from the ORM layer. Stack Overflow has decent coverage for common issues, and the GitHub maintainers are reasonably responsive to bug reports.
Best for: Teams building CRUD-heavy applications who want productivity without sacrificing control over complex queries.
Avoid if: You need ultra-high performance with complete query transparency or have extremely complex domain models requiring full control over SQL generation.
Sign in to write a review
Sign In