PaperCut internal (Apache Derby) database deprecation

What’s happening?

The Apache Derby team is announcing the deprecation of the Derby database engine currently bundled with PaperCut NG and MF. As such, the PaperCut development team is transitioning the internal database to a new database type for future versions of the software.

H2 is a Java SQL database that will replace Apache Derby as the standard internal database option in PaperCut NG/MF.

Which customers are affected?

Customers using the default Derby database (also referred to as the internal database) will have the option to migrate to H2 in a future update of PaperCut NG/MF.

Customers currently using an external database will not be affected and can continue to use their current database after this transition occurs.

How can I tell if I’m using Derby?

In the PaperCut NG/MF admin console, head to About > System Info and look for the “Database:” field. If you’re using the default Derby database, that line will state “Internal”.

What will I need to do if I’m using Derby?

For most customers, no immediate action is required. You may continue using your current version of PaperCut NG/MF and wait for the H2 transition.

Customers with immediate concerns about continuing to use the Derby database can migrate to a supported external database at any time.

What is the timeline for these changes?

• Derby Deprecation Status: On October 10th, 2025, the Apache Derby development team placed Derby in a read-only state. It will continue to function in existing versions of PaperCut, but will be phased out in future releases.
• Transition work: Our development teams have identified H2 as the preferred replacement and are actively working through the migration framework and test plans required to safely move data from Derby to H2 with zero downtime or data loss.
• Targeted Completion: The transition to H2 is tentatively targeted for completion in the second half of 2026. (Subject to change)

Is Derby safe to use right now?

At the time of publication, we are aware of no outstanding vulnerabilities. (Check the NIST National Vulnerability Database for current info.) Concerned customers can at any time configure PaperCut to use another supported database type, which can be found here under “Database Servers”. Customers can also take these additional steps to secure their server.