Moving Derby JDBC driver to the Quarkiverse?

[Guillaume Smet]

Hi,

Derby has been more or less unmaintained and the version we are currently using has a CVE.

They released a new version that fixes the CVE but they now require Java 21+. And the future of it is quite uncertain.

I don't think we have many users of this extension and I think we should move it to the Quarkiverse, where it could require Java 21+ without it being a problem. And where people interested in its survival could maintain it directly.

Does anyone have concerns about this move?

Thanks.

-- 

Guillaume

[Ladislav Thon]

Looking at the Derby mailing list https://lists.apache.org/list.html?derb...@db.apache.org, Derby is getting retired. I would suggest we just drop it completely.

LT

pá 24. 10. 2025 v 16:44 odesílatel Guillaume Smet <guillau...@gmail.com> napsal:

--
You received this message because you are subscribed to the Google Groups "Quarkus Development mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to quarkus-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/quarkus-dev/CALt0%2Bo8%2BUv7symtssM0FaLGqjKS9h2Dg8t_w7Ar00es2ajwpBw%40mail.gmail.com.

[Alexey Loubyansky]

Which platform version would we do this in?

To view this discussion visit https://groups.google.com/d/msgid/quarkus-dev/CALbocOnAP-8AUkr1wevYsgkDQ3xX5pBrJwzue2rPyTsCuvdARQ%40mail.gmail.com.

[Guillaume Smet]

Hmmm, yeah, probably makes sense.

We could drop it and revive it as a Quarkiverse extension if somebody complains and has the willingness to maintain it.

@Alexey given they retired it, I would do it in our next minor. There's no point keeping something that is not maintained anymore.

On Fri, Oct 24, 2025 at 5:18 PM Ladislav Thon <lad...@gmail.com> wrote:

To view this discussion visit https://groups.google.com/d/msgid/quarkus-dev/CALbocOnAP-8AUkr1wevYsgkDQ3xX5pBrJwzue2rPyTsCuvdARQ%40mail.gmail.com.

[Cameron Scholes]

It is possible to use 10.16.1.2 version of Derby, but as this version hasn't been pushed to Maven Central (and likely won't be pushed) it would have to either be pulled from an alternative repository or the JAR files can be added directly to the project.
This is only necessary if Derby and JDK 17 support is required.
The alternative repository pull request can be seen here https://github.com/quarkusio/quarkus/pull/50706

[gegas...@gmail.com]

I guess the real question is who is going to maintain it?

--

[Robert Stupp]

The vote to retire Apache Derby passed about 2 weeks ago [1][2].
I guess it's best for Quarkus to move Derby JDBC to Quarkiverse, if
there are users.

[1] https://lists.apache.org/thread/q7xnvbyo818vvtyh2b5oljr8won4zjx7
[2] https://issues.apache.org/jira/browse/DERBY-7177

[Yoann Rodiere]

Hey,

+1 to move to Quarkiverse, or (probably more fitting?) just remove the extension in the next version of Quarkus.

FWIW, the future looks quite certain to me: retirement is in the project's plans. See https://issues.apache.org/jira/browse/DERBY-7177

Yoann Rodière
Hibernate team

--

[George Gastaldi]

Since Derby development seems to have been halted, I propose to mark it as deprecated and remove it in the next LTS. Moving to Quarkiverse only makes sense if there are people willing to maintain it. 

[Jean-Baptiste Onofré]

Hi

I provided the information about Derby to Robert.

Some Apache projects already started to replace Derby with something else (h2, ...) depending of "license/packaging" constraint.

Regarding Quarkus, I think we should deprecate Derby and remove later. Not sure it would make sense to move to Quarkiverse as the "core" code won't be maintained (at the ASF, it's always possible to revive a project, removing as TLP from attic).

We should just "document" some alternatives to the users.

Regards

JB

[George Gastaldi]

Because deleting code is fun, I created a draft PR removing it from our codebase: https://github.com/quarkusio/quarkus/pull/50715