Simple. Java. Security. 2026-02-27T22:02:07Z Les Hazlewood https://twitter.com/@lhazlewood Benjamin Marwell https://twitter.com/@bmarwell Lenny Primak https://twitter.com/@lprimak François Papon https://twitter.com/@fpapon2 Richard Zowalla https://twitter.com/@zowalla Brian Demers https://twitter.com/@briandemers https://shiro.apache.org/ JBake.org /images/favicon128.png /images/apache-shiro-logo.png https://shiro.apache.org/blog/2026/02/apache-shiro-3-alpha-1-released.html 2026-02-27T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 3.0.0-alpha-1.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="ulist"> <ul> <li> <p>Java 17 is the minimum requirement</p> </li> <li> <p>Using Scoped values instead of ThreadLocals on JDK 25+</p> </li> <li> <p>Jakarta EE 11, Spring 7 and SpringBoot 4 without classifiers, dropped support for Jakarta EE 8, SpringBoot 2 and javax namespace</p> </li> <li> <p>Removed many deprecations</p> </li> <li> <p>Refactored code to use Java 17+ features</p> </li> </ul> </div> <div class="paragraph"> <p>The reason this is still an Alpha release is because we are still unsure of further API stability, but the release is in a good enough state to try out with your current projects.</p> </div> <div class="paragraph"> <p>We have new contributors!</p> </div> <div class="ulist"> <ul> <li> <p><a href="https://github.com/janitza-mage">@janitza-mage</a></p> </li> <li> <p><a href="https://github.com/Himakar">@Himakar</a></p> </li> <li> <p><a href="https://github.com/rgcv">@rgcv</a></p> </li> <li> <p><a href="https://github.com/nsoft">@nsoft</a></p> </li> <li> <p><a href="https://github.com/iampratap7997-dot">@iampratap7997-dot</a></p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-3.0.0-alpha-1">GitHub, Release 3.0.0-alpha-1</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2026/02/apache-shiro-210-released.html 2026-02-08T00:00:00Z Francois Papon <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.1.0.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is a maintenance release that includes several bug fixes, improvements and dependency updates. It is recommended for all users to upgrade to this version.</p> </div> <div class="paragraph"> <p>We have new contributors!</p> </div> <div class="ulist"> <ul> <li> <p><a href="https://github.com/celikfatih">@celikfatih</a></p> </li> <li> <p><a href="https://github.com/haster">@haster</a></p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.1.0">GitHub, Release 2.1.0</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2025/11/apache-shiro-206-released.html 2025-11-07T00:00:00Z Francois Papon <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.6.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is a maintenance release that includes several bug fixes, improvements and dependency updates. It is recommended for all users to upgrade to this version.</p> </div> <div class="paragraph"> <p>We have new contributors!</p> </div> <div class="ulist"> <ul> <li> <p><a href="https://github.com/OyvindLGjesdal">@OyvindLGjesdal</a></p> </li> <li> <p><a href="https://github.com/ntolppi">@ntolppi</a></p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.6">GitHub, Release 2.0.6</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2025/07/apache-shiro-205-released.html 2025-07-07T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.5.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is a maintenance release that includes several bug fixes, improvements and dependency updates. It is recommended for all users to upgrade to this version.</p> </div> <div class="ulist"> <ul> <li> <p>Fixes several issues with Spring Boot integration, including Actuator compatibility. See <a href="https://github.com/apache/shiro/issues/1879">#1879</a> and <a href="https://github.com/apache/shiro/issues/1691">#1691</a> for details.</p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.5">GitHub, Release 2.0.5</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2025/04/apache-shiro-204-released.html 2025-04-20T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.4.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is a maintenance release that includes several bug fixes, improvements and dependency updates. It is recommended for all users to upgrade to this version.</p> </div> <div class="ulist"> <ul> <li> <p>Fixes a possible ThreadLocal variable leak when Servlet starts threads</p> </li> <li> <p>Fixes issues with Remember Me functionality in Apache Karaf and OSGi environments</p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.4">GitHub, Release 2.0.4</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2025/04/apache-shiro-203-released.html 2025-04-06T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.3.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is a maintenance release that includes several bug fixes and improvements, and many dependency updates. It is recommended for all users to upgrade to this version.</p> </div> <div class="ulist"> <ul> <li> <p>Clean up invalid Javadoc syntax and broken references</p> </li> <li> <p>Clean up comments and make log messages in AuthenticatingRealm consistent</p> </li> <li> <p>Catch IllegalStateException in validate() and do not log incorrect error messages</p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.3">GitHub, Release 2.0.3</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2024/11/apache-shiro-202-released.html 2024-11-13T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.2.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is a maintenance release that includes several bug fixes and improvements, and many dependency updates. It is recommended for all users to upgrade to this version.</p> </div> <div class="ulist"> <ul> <li> <p>Fix creating subjects from a SubjectFactory that disables session-creation</p> </li> <li> <p>Follow desired request scheme when doing redirection</p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.2">GitHub, Release 2.0.2</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2024/05/apache-shiro-201-released.html 2024-05-30T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.1.</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="ulist"> <ul> <li> <p>Added a supported way to decorate Shiro SecurityManager</p> </li> <li> <p>Better compatibility with OSGi for Jakarta EE jakarta namespace</p> </li> <li> <p>Fixed exception handling bugs in Jax-Rs integration module</p> </li> <li> <p>Fixed a bug in Jakarta Faces integration</p> </li> <li> <p>Better compatibility when building with Maven 4.x</p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.1">GitHub, Release 2.0.1</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2024/02/apache-shiro-200-released.html 2024-02-28T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.0. This is the first major release for Shiro 2.x</p> </div> <div class="paragraph"> <p>This release is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="release_highlights">Release Highlights</h2> <div class="sectionbody"> <div class="ulist"> <ul> <li> <p>Java 11 is the minimum supported JVM version</p> </li> <li> <p>Stronger default password hashing algorithms (Argon2 and BCrypt)</p> </li> <li> <p>Jakarta EE 10 support (Java/Jakarta EE 8 is also supported)</p> </li> <li> <p>New Jakarta EE integration module (see <a href="https://shiro.apache.org/jakarta-ee.html">Jakarta EE Integration</a> for more information)</p> </li> <li> <p>SpringBoot 3.x support (SpringBoot 2.x is also supported)</p> </li> <li> <p>Automatic form resubmission when session expired (Jakarta EE only)</p> </li> </ul> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-2.0.0">GitHub, Release 2.0.0</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2023/11/10/apache-shiro-1130-released.html 2023-11-10T00:00:00Z Francois Papon <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 1.13.0. This is a feature release for 1.x.</p> </div> <div class="paragraph"> <p>This release solves 2 issues since the 1.13.0 release and is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://github.com/apache/shiro/releases/tag/shiro-root-1.13.0">GitHub, Release 1.13.0</a>.</p> </div> <div class="sect2"> <h3 id="cve_2023_46750"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46750">CVE-2023-46750</a></h3> <div class="paragraph"> <p>URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.</p> </div> <div class="paragraph"> <p><strong>Mitigation:</strong> Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.</p> </div> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2023/07/18/apache-shiro-1120-released.html 2023-07-18T00:00:00Z Francois Papon <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 1.12.0. This is a feature release for 1.x.</p> </div> <div class="paragraph"> <p>This release solves 2 issues since the 1.12.0 release and is available for download now.</p> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://issues.apache.org/jira/projects/SHIRO/versions/12353403">Jira, Release 1.12.0</a>.</p> </div> <div class="sect2"> <h3 id="cve_2023_34478"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34478">CVE-2023-34478</a></h3> <div class="paragraph"> <p>Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.</p> </div> <div class="paragraph"> <p><strong>Mitigation:</strong> Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+.</p> </div> <div class="paragraph"> <p><strong>Credit:</strong> Apache Shiro would like to thank <strong>swifty tk</strong> for reporting this issue.</p> </div> </div> <div class="sect2"> <h3 id="improvement">Improvement</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-816">SHIRO-816</a>] - Update shiro-hazelcast to support Hazelcast 5.x</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="task">Task</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-849">SHIRO-849</a>] - Add support for JCache</p> </li> </ul> </div> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div> https://shiro.apache.org/blog/2023/05/04/apache-shiro-200-alpha-1-released.html 2023-05-04T00:00:00Z Lenny Primak <div id="preamble"> <div class="sectionbody"> <div class="paragraph"> <p>The Apache Shiro team is pleased to announce the release of Apache Shiro version 2.0.0-alpha.</p> </div> </div> </div> <div class="sect1"> <h2 id="all_changes">All changes</h2> <div class="sectionbody"> <div class="paragraph"> <p>You can learn more on <a href="https://issues.apache.org/jira/projects/SHIRO/versions/12315455">Jira, Release 2.0.0-alpha</a>.</p> </div> <div class="paragraph"> <p>Release Notes - Shiro - Version 2.0.0-alpha</p> </div> <div class="sect2"> <h3 id="sub_tasks">Sub-tasks</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-772">SHIRO-772</a>] - PowerMock blocks JDK 11+ builds</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-773">SHIRO-773</a>] - Outdated Groovy version does not work with JDK14</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-775">SHIRO-775</a>] - Excessive logging in jetty ContainerITs</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="bugs">Bugs</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-349">SHIRO-349</a>] - Security: Byte arrays (and other memory) holding sensitive data (even temporarily) should be zerod-out</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-512">SHIRO-512</a>] - Race condition in Shiro&#8217;s web container session timeout handling</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-537">SHIRO-537</a>] - Class load issue in OSGI in ClassUtils</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-610">SHIRO-610</a>] - Incorrect filterchainResolver in 1.4.0-RC2</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-632">SHIRO-632</a>] - org.apache.felix:maven-bundle-plugin causing duplicate class problems between core and lang</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-646">SHIRO-646</a>] - Unable to login a DelegatingSubject on a DefaultWebSecurityManager</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-654">SHIRO-654</a>] - Multiple shiro OSGi bundles export the same packages</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-678">SHIRO-678</a>] - Strings garbled when POST without JSESSIONID cookie</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-761">SHIRO-761</a>] - Bad OSGi import for javax.annotation in shiro-guice</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-762">SHIRO-762</a>] - SecurityUtils.securityManager should be volatile</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-766">SHIRO-766</a>] - ArrayIndexOutOfBoundsException in Base64#decode</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-767">SHIRO-767</a>] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertown as web container</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-774">SHIRO-774</a>] - Remove wrong usage of prerequisites in pom.xml</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-778">SHIRO-778</a>] - onInit method on AuthenticatingRealm is called twice</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-792">SHIRO-792</a>] - ShiroWebFilterConfiguration seems to conflict with other FilterRegistrationBean</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-797">SHIRO-797</a>] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-812">SHIRO-812</a>] - Key value separator in config is broken with escape char</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-817">SHIRO-817</a>] - CommonsInterpolator does not follow javadoc</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-818">SHIRO-818</a>] - JAX-RS ExceptionMapper returns wrong status code</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-819">SHIRO-819</a>] - Hasher Utility not executable</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-825">SHIRO-825</a>] - Trailing slash in URI results in "IllegalArgumentException: There is no configured chain under the name/key"</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-845">SHIRO-845</a>] - Dependencies for test-jars missing</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-899">SHIRO-899</a>] - Jakarta 9+ fails with Shiro native sessions</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-902">SHIRO-902</a>] - Separator conflict between PermissionUtils.resolveDelimitedPermissions() and WildcardPermission.SUBPART_DIVIDER_TOKEN</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="epic">Epic</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-897">SHIRO-897</a>] - Group all Jakarta-EE related issues here</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="new_features">New Features</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-206">SHIRO-206</a>] - Support for JSF/Facelets</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-290">SHIRO-290</a>] - Create a BCrypt Hash implementation</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-337">SHIRO-337</a>] - adding support for CDI</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-789">SHIRO-789</a>] - Also add cookie SameSite option to Spring</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-898">SHIRO-898</a>] - Migrate Jakarta EE support from FlowLogix to Shiro</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="improvements">Improvements</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-216">SHIRO-216</a>] - Add @Documented to Shiro authorization annotations</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-398">SHIRO-398</a>] - Inconsistent name for session validation interval property in different implementations</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-478">SHIRO-478</a>] - Upgrade dependencies on trunk</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-551">SHIRO-551</a>] - DelegatingSubject should implement toString()</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-671">SHIRO-671</a>] - Add support for javax.annotation.security.RolesAllowed, PermitAll, and DenyAll</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-679">SHIRO-679</a>] - Shiro modules have split packages</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-708">SHIRO-708</a>] - Remove deprecated shiro-cas module</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-740">SHIRO-740</a>] - SslFilter with HTTP Strict Transport Security (HSTS)</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-750">SHIRO-750</a>] - Migrate to jakarta APIs</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-764">SHIRO-764</a>] - Add IpFilter for restricting access IP ranges</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-770">SHIRO-770</a>] - Remove Base64</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-771">SHIRO-771</a>] - Add OpenJDK-OpenJ9 travis builds</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-795">SHIRO-795</a>] - Disable session path rewriting by default</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-804">SHIRO-804</a>] - Avoid conflicts with spring boot aop</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-806">SHIRO-806</a>] - Remove deprecated DefaultLdapContextFactory</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-807">SHIRO-807</a>] - Remove deprecated getLdapContext(String username, String password)</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-811">SHIRO-811</a>] - Convert AuthorizationFilterTest to using Mockito</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-836">SHIRO-836</a>] - Delete jsecurty-sample.jks</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-838">SHIRO-838</a>] - Create SHA512-Hashes</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-840">SHIRO-840</a>] - Java 17 compatibility</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-846">SHIRO-846</a>] - Creation of site takes very long time</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-848">SHIRO-848</a>] - Relative Path in pom.xml is not needed</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-850">SHIRO-850</a>] - The profile name jdk19-plus is misleading</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-851">SHIRO-851</a>] - Handling properties for compile/encoding vs. default configurations of plugins</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-852">SHIRO-852</a>] - Configuration for maven-release-plugin prepationGoal should be changed</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-853">SHIRO-853</a>] - Versions of maven-surefire/failsafe/report plugin are not in sync</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-854">SHIRO-854</a>] - Konfiguration includes/excludes maven-failsafe-plugin can be reduced to default</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-860">SHIRO-860</a>] - update logback to 1.2.10</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-862">SHIRO-862</a>] - Replace Google Analytics with Matomo for new Javadocs</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-871">SHIRO-871</a>] - ActiveDirectoryRealm - append suffix only if missing from username</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-872">SHIRO-872</a>] - fix Reproducible Builds issues</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-884">SHIRO-884</a>] - fix source jar Reproducible Builds issue</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-885">SHIRO-885</a>] - Use OWASP Java Encoder with OSGi manifest</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-889">SHIRO-889</a>] - Provide Jakarta jar modules</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-890">SHIRO-890</a>] - Avoid another proxy creator when @EnableAspectJAutoProxy enabled</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-900">SHIRO-900</a>] - Refactor of root POM (and update groovy to apache)</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="tests">Tests</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-776">SHIRO-776</a>] - JUnit update to version 5</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-777">SHIRO-777</a>] - Remove PowerMock and update the enforcer exclusion list</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="wishe">Wishe</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-780">SHIRO-780</a>] - NOTICE files of shiro components don&#8217;t match NOTICE in source code repository</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="tasks">Tasks</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-39">SHIRO-39</a>] - JEE integration</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-573">SHIRO-573</a>] - Remove shiro-cas from master (2.0)</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-768">SHIRO-768</a>] - Remove the shiro-all module</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-793">SHIRO-793</a>] - deleteMe cookie should use the defined "sameSite"</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-805">SHIRO-805</a>] - Spelling</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-841">SHIRO-841</a>] - NullPointerException from SessionsSecurityManager.start()</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-849">SHIRO-849</a>] - Add support for JCache</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-904">SHIRO-904</a>] - Make JDK 11 base compatibility in Shiro 2.0</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="dependency_upgrades">Dependency upgrades</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-765">SHIRO-765</a>] - Upgrade to Apache Pom Parent 23</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-785">SHIRO-785</a>] - Upgrade to maven-bundle-plugin 5.1.1</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-786">SHIRO-786</a>] - Upgrade to Spring 5.2.8.RELEASE and Spring boot 2.3.2.RELEASE</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-828">SHIRO-828</a>] - aspectj-maven-plugin 1.14.0</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-842">SHIRO-842</a>] - shiro-web depends on older log4j</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-878">SHIRO-878</a>] - Update Spring Dependencies to 5.2.20</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-882">SHIRO-882</a>] - Upgrade to apache pom parent 26</p> </li> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-886">SHIRO-886</a>] - Upgrade to commons configuration 2.8.0</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="question">Question</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-784">SHIRO-784</a>] - Error creating bean with name 'org.apache.shiro.spring.web.config.ShiroWebFilterConfiguration': Unsatisfied dependency expressed through field 'filterMap';</p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="dependency">Dependency</h3> <div class="ulist"> <ul> <li> <p>[<a href="https://issues.apache.org/jira/browse/SHIRO-881">SHIRO-881</a>] - pom.xml in samples/web may lack dependency</p> </li> </ul> </div> </div> </div> </div> <div class="sect1"> <h2 id="download">Download</h2> <div class="sectionbody"> <div class="paragraph"> <p>Download and verification instructions are available <a href="/download.html">on our download page</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="documentation">Documentation</h2> <div class="sectionbody"> <div class="paragraph"> <p>For more information on <a href="/documentation.html">Shiro, please read the documentation.</a></p> </div> <div class="paragraph"> <p>Enjoy!</p> </div> <div class="paragraph"> <p>The Apache Shiro Team</p> </div> </div> </div>