Build(deps): Bump shiro.version from 2.2.1 to 3.0.0

[dependabot]

Bumps shiro.version from 2.2.1 to 3.0.0.
Updates org.apache.shiro:shiro-core from 2.2.1 to 3.0.0

Release notes

Sourced from org.apache.shiro:shiro-core's releases.

Apache Shiro 3.0.0

Minimum runtime Requirements

• JDK 17
• Jakarta EE 9/10/11+ (no javax.* namespace)
• Spring 6/7+ and SpringBoot 3/4+
• Guice 7/8+

Breaking Changes:

• Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)
• Removed setHost() and setStartTimestamp() from public API of SimpleSession to keep immutability

Security improvements:

• Case-insensitive path matching is now enabled by default (hardened by default)
• Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
• #2799 enh: warn if realm authentication fails by @​lprimak in apache/shiro#2798
• Web RememberMe and Guice Enhancements by @​lprimak in apache/shiro#2800
• Enable CORS preflight requests by default

Other Changes:

• Modernized Java code to JDK 17 baseline
• Added fluent API in MergableAuthenticationInfo class
• Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
• Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values
• Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25+
• Separated out ShiroFilterFactoryBeanPostProcessor to fix post processing warnings in Spring
• Using AssertJ for testing

Removals of deprecated artifacts

• Removed Shiro BOM - no longer necessary
• Removed EhCache module in favor of JCache
• Removed Hazelcast module in favor of JCache
• Removed deprecated SimplePrincipalCollection class
• Removed deprecated RandomSessionIdGenerator class
• Removed deprecated HttpSessionContext class
• Removed deprecated JavaEnvironment class
• Removed deprecated XmlSerializer.java class
• Removed JakartaTransformer class and it's jakartify() method
• Removed Spring/Boot ShiroUrlPathHelper class
• Removed Spring/Boot's remoting support
• Removed Spring/Boot deprecated ShiroRequestMappingConfig class
• Removed samples and tests associated with deprecated modules

Minimum build requirements

• JDK 21 (JDK 25 required to release)
• Jakarta EE 11 (build-time default)
• Spring 7/SpringBoot 4 (build-time default)
• Guice 8 (build-time default)

What's Changed

• #1584 Merge 3.x branch into main by @​lprimak in apache/shiro#2772

... (truncated)

Changelog

Sourced from org.apache.shiro:shiro-core's changelog.

Licensed to the Apache Software Foundation (ASF) under one

or more contributor license agreements. See the NOTICE file

distributed with this work for additional information

regarding copyright ownership. The ASF licenses this file

to you under the Apache License, Version 2.0 (the

"License"); you may not use this file except in compliance

with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,

software distributed under the License is distributed on an

"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

KIND, either express or implied. See the License for the

specific language governing permissions and limitations

under the License.

DEPRECATED

Currently Apache Shiro uses GitHub releases for release notes, so this file is no longer being updated. It will be removed in a future release.

DEPRECATED

This is not an official release notes document. It exists for Shiro developers to jot down their notes while working in the source code. These notes will be combined with Jira’s auto-generated release notes during a release for the total set.

###########################################################

2.0.0

###########################################################

Improvement

[SHIRO-290] Implement bcrypt and argon2 KDF algorithms

Backwards Incompatible Changes

• Changed default DefaultPasswordService.java algorithm to "Argon2id".
• PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. It was never specified how this method would behave.
• Made salt non-nullable.
• Removed methods in PasswordMatcher.

###########################################################

1.7.1

###########################################################

Bug

... (truncated)

Commits

• a0c53ad [maven-release-plugin] prepare release shiro-root-3.0.0
• ffba65f chore(deps): bump the maven-dependencies group with 2 updates (#2803)
• 63ebb6c chore(deps): bump actions/checkout (#2802)
• e441ea3 enh(web): rememberMe cookie expiration is checked on the server
• 42aa344 bugfix(guice-web): now matching paths with trailing slash stripped
• 8856874 chore: update Payara version and refactor port property names in configuratio...
• c7dc2a4 enh: warn if realm authentication fails due to system exceptions in multi-rea...
• d08a84c chore(deps-dev): bump com.flowlogix.depchain:integration-test (#2796)
• e45268b chore(dependabot): fix htmlunit major version pinning
• da75880 chore(deps): bump the maven-dependencies group across 1 directory with 2 upda...
• Additional commits viewable in compare view

Updates org.apache.shiro:shiro-web from 2.2.1 to 3.0.0

Release notes

Sourced from org.apache.shiro:shiro-web's releases.

Apache Shiro 3.0.0

Minimum runtime Requirements

• JDK 17
• Jakarta EE 9/10/11+ (no javax.* namespace)
• Spring 6/7+ and SpringBoot 3/4+
• Guice 7/8+

Breaking Changes:

• Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)
• Removed setHost() and setStartTimestamp() from public API of SimpleSession to keep immutability

Security improvements:

• Case-insensitive path matching is now enabled by default (hardened by default)
• Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
• #2799 enh: warn if realm authentication fails by @​lprimak in apache/shiro#2798
• Web RememberMe and Guice Enhancements by @​lprimak in apache/shiro#2800
• Enable CORS preflight requests by default

Other Changes:

• Modernized Java code to JDK 17 baseline
• Added fluent API in MergableAuthenticationInfo class
• Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
• Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values
• Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25+
• Separated out ShiroFilterFactoryBeanPostProcessor to fix post processing warnings in Spring
• Using AssertJ for testing

Removals of deprecated artifacts

• Removed Shiro BOM - no longer necessary
• Removed EhCache module in favor of JCache
• Removed Hazelcast module in favor of JCache
• Removed deprecated SimplePrincipalCollection class
• Removed deprecated RandomSessionIdGenerator class
• Removed deprecated HttpSessionContext class
• Removed deprecated JavaEnvironment class
• Removed deprecated XmlSerializer.java class
• Removed JakartaTransformer class and it's jakartify() method
• Removed Spring/Boot ShiroUrlPathHelper class
• Removed Spring/Boot's remoting support
• Removed Spring/Boot deprecated ShiroRequestMappingConfig class
• Removed samples and tests associated with deprecated modules

Minimum build requirements

• JDK 21 (JDK 25 required to release)
• Jakarta EE 11 (build-time default)
• Spring 7/SpringBoot 4 (build-time default)
• Guice 8 (build-time default)

What's Changed

• #1584 Merge 3.x branch into main by @​lprimak in apache/shiro#2772

... (truncated)

Changelog

Sourced from org.apache.shiro:shiro-web's changelog.

Licensed to the Apache Software Foundation (ASF) under one

or more contributor license agreements. See the NOTICE file

distributed with this work for additional information

regarding copyright ownership. The ASF licenses this file

to you under the Apache License, Version 2.0 (the

"License"); you may not use this file except in compliance

with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,

software distributed under the License is distributed on an

"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

KIND, either express or implied. See the License for the

specific language governing permissions and limitations

under the License.

DEPRECATED

Currently Apache Shiro uses GitHub releases for release notes, so this file is no longer being updated. It will be removed in a future release.

DEPRECATED

This is not an official release notes document. It exists for Shiro developers to jot down their notes while working in the source code. These notes will be combined with Jira’s auto-generated release notes during a release for the total set.

###########################################################

2.0.0

###########################################################

Improvement

[SHIRO-290] Implement bcrypt and argon2 KDF algorithms

Backwards Incompatible Changes

• Changed default DefaultPasswordService.java algorithm to "Argon2id".
• PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. It was never specified how this method would behave.
• Made salt non-nullable.
• Removed methods in PasswordMatcher.

###########################################################

1.7.1

###########################################################

Bug

... (truncated)

Commits

• a0c53ad [maven-release-plugin] prepare release shiro-root-3.0.0
• ffba65f chore(deps): bump the maven-dependencies group with 2 updates (#2803)
• 63ebb6c chore(deps): bump actions/checkout (#2802)
• e441ea3 enh(web): rememberMe cookie expiration is checked on the server
• 42aa344 bugfix(guice-web): now matching paths with trailing slash stripped
• 8856874 chore: update Payara version and refactor port property names in configuratio...
• c7dc2a4 enh: warn if realm authentication fails due to system exceptions in multi-rea...
• d08a84c chore(deps-dev): bump com.flowlogix.depchain:integration-test (#2796)
• e45268b chore(dependabot): fix htmlunit major version pinning
• da75880 chore(deps): bump the maven-dependencies group across 1 directory with 2 upda...
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lukaszlenart]

@dependabot rebase

[lukaszlenart]

Partially verified against main after #544, but not cleared for merge yet — flagging what I could and could not confirm.

Confirmed:

• shiro-basic compiles and resolves against Shiro 3.0.0 (so the Java API surface the example uses is unchanged)
• the two classes referenced as strings in web.xml — org.apache.shiro.web.env.EnvironmentLoaderListener and org.apache.shiro.web.servlet.ShiroFilter — both still exist in shiro-web-3.0.0.jar. These are the ones a compiler cannot check, and they are the usual breakage in a major Shiro bump.
• the app boots and ShiroFilter correctly redirects an unauthenticated request (302), with no exceptions at startup

Not confirmed:

• the actual login flow. My local attempt to authenticate against the shiro.ini realm was inconclusive due to a flaky test setup on my side, and I could not get a clean A/B against 2.2.1 to compare. Since shiro-basic has no automated tests, CI going green here only proves compilation — it will not catch a broken SecurityManager, realm, or session behaviour at runtime.

Given 2.x → 3.0.0 is a major release, I would suggest someone manually walk the login → welcome → logout path (e.g. lonestarr/vespa) before merging, rather than trusting a green build.

[lukaszlenart]

Followed up with a manual runtime test in a browser, as suggested above. The result reverses my earlier assessment: this PR is not a risky major bump — it is a required fix.

shiro-basic does not start on current main

Running mvn jetty:run on main (Shiro 2.2.1) fails at startup:

java.lang.ClassNotFoundException: javax.servlet.ServletContextListener

Shiro 2.2.1 is still built against javax servlet, while this project provides Jakarta Servlet 6.1. Confirmed directly in the jars:

• shiro-web-2.2.1.jar → EnvironmentLoaderListener references javax/servlet/ServletContext
• shiro-web-3.0.0.jar → references jakarta/servlet/ServletContext

So the EnvironmentLoaderListener declared in web.xml cannot load, and the context never deploys. With 3.0.0 the app starts in ~6s with no ClassNotFoundException/NoClassDefFoundError at all.

CI could never have caught this: shiro-basic has no tests, so mvn test only proves compilation, and the failure is a runtime classloading one.

But merging this alone will not make the example work

With 3.0.0 the app boots, yet the login flow is still broken by pre-existing configuration unrelated to the Shiro version:

1. shiroFilter is mapped to /*, and shiro.ini has no [main] or [urls] section, so Shiro falls back to its default loginUrl of /login.jsp.
2. There is no login.jsp at the webapp root — the actual form is pages/login.jsp. Every request therefore redirects to a page that redirects again: I measured an infinite redirect loop (50 redirects, still 302).
3. On a first visit with no session cookie, the redirect is URL-rewritten to .../login.jsp;jsessionid=..., and Jetty 11.0.18 rejects that URI with HTTP 400 Invalid request. With a cookie present the rewriting stops, so this one only bites the first request.

shiro.ini has not changed since the 2017 initial commit, so items 1 and 2 long predate this PR.

Suggestion

Merge this — it strictly improves the module (from "will not start" to "starts"), and 3.0.0 is the only version compatible with this project's Jakarta baseline. Then track the login-flow breakage separately: it needs a [main] section setting loginUrl = /pages/login.jsp (plus a [urls] chain definition), which is a different change from a dependency bump.