Moving Derby JDBC driver to the Quarkiverse?

45 views
Skip to first unread message

Guillaume Smet

unread,
Oct 24, 2025, 10:45:00 AM (6 days ago) Oct 24
to Quarkus Development mailing list
Hi,

Derby has been more or less unmaintained and the version we are currently using has a CVE.

They released a new version that fixes the CVE but they now require Java 21+. And the future of it is quite uncertain.

I don't think we have many users of this extension and I think we should move it to the Quarkiverse, where it could require Java 21+ without it being a problem. And where people interested in its survival could maintain it directly.

Does anyone have concerns about this move?

Thanks.

-- 
Guillaume

Ladislav Thon

unread,
Oct 24, 2025, 11:18:22 AM (6 days ago) Oct 24
to quark...@googlegroups.com
Looking at the Derby mailing list https://lists.apache.org/list.html?derb...@db.apache.org, Derby is getting retired. I would suggest we just drop it completely.

LT

pá 24. 10. 2025 v 16:44 odesílatel Guillaume Smet <guillau...@gmail.com> napsal:
--
You received this message because you are subscribed to the Google Groups "Quarkus Development mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to quarkus-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/quarkus-dev/CALt0%2Bo8%2BUv7symtssM0FaLGqjKS9h2Dg8t_w7Ar00es2ajwpBw%40mail.gmail.com.

Alexey Loubyansky

unread,
Oct 24, 2025, 11:36:55 AM (6 days ago) Oct 24
to quark...@googlegroups.com
Which platform version would we do this in?

Guillaume Smet

unread,
Oct 24, 2025, 12:10:23 PM (6 days ago) Oct 24
to quark...@googlegroups.com
Hmmm, yeah, probably makes sense.

We could drop it and revive it as a Quarkiverse extension if somebody complains and has the willingness to maintain it.

@Alexey given they retired it, I would do it in our next minor. There's no point keeping something that is not maintained anymore.

On Fri, Oct 24, 2025 at 5:18 PM Ladislav Thon <lad...@gmail.com> wrote:

Cameron Scholes

unread,
Oct 24, 2025, 1:07:21 PM (6 days ago) Oct 24
to Quarkus Development mailing list
It is possible to use 10.16.1.2 version of Derby, but as this version hasn't been pushed to Maven Central (and likely won't be pushed) it would have to either be pulled from an alternative repository or the JAR files can be added directly to the project.
This is only necessary if Derby and JDK 17 support is required.
The alternative repository pull request can be seen here https://github.com/quarkusio/quarkus/pull/50706

gegas...@gmail.com

unread,
Oct 24, 2025, 1:07:28 PM (6 days ago) Oct 24
to quark...@googlegroups.com

I guess the real question is who is going to maintain it?

--

Robert Stupp

unread,
Oct 24, 2025, 1:07:35 PM (6 days ago) Oct 24
to quark...@googlegroups.com
The vote to retire Apache Derby passed about 2 weeks ago [1][2].
I guess it's best for Quarkus to move Derby JDBC to Quarkiverse, if
there are users.

[1] https://lists.apache.org/thread/q7xnvbyo818vvtyh2b5oljr8won4zjx7
[2] https://issues.apache.org/jira/browse/DERBY-7177

Yoann Rodiere

unread,
Oct 24, 2025, 1:07:41 PM (6 days ago) Oct 24
to quark...@googlegroups.com
Hey,

+1 to move to Quarkiverse, or (probably more fitting?) just remove the extension in the next version of Quarkus.

FWIW, the future looks quite certain to me: retirement is in the project's plans. See https://issues.apache.org/jira/browse/DERBY-7177

Yoann Rodière
Hibernate team


--

George Gastaldi

unread,
Oct 24, 2025, 1:07:46 PM (6 days ago) Oct 24
to Quarkus Development mailing list
Since Derby development seems to have been halted, I propose to mark it as deprecated and remove it in the next LTS. Moving to Quarkiverse only makes sense if there are people willing to maintain it. 

Jean-Baptiste Onofré

unread,
Oct 25, 2025, 1:01:50 AM (6 days ago) Oct 25
to Quarkus Development mailing list
Hi

I provided the information about Derby to Robert.
Some Apache projects already started to replace Derby with something else (h2, ...) depending of "license/packaging" constraint.

Regarding Quarkus, I think we should deprecate Derby and remove later. Not sure it would make sense to move to Quarkiverse as the "core" code won't be maintained (at the ASF, it's always possible to revive a project, removing as TLP from attic).
We should just "document" some alternatives to the users.

Regards
JB

George Gastaldi

unread,
Oct 25, 2025, 1:29:32 AM (6 days ago) Oct 25
to Quarkus Development mailing list
Because deleting code is fun, I created a draft PR removing it from our codebase: https://github.com/quarkusio/quarkus/pull/50715
Reply all
Reply to author
Forward
0 new messages