[#1584] Merge 3.x branch into main by lprimak · Pull Request #2772 · apache/shiro

lprimak · 2026-06-14T21:59:41Z

Minimum runtime Requirements:

JDK 17
Jakarta EE 9/10/11+ (no javax.* namespace)
Spring 6/7+ and SpringBoot 3/4+
Guice 7/8+

Minimum build requirements:

JDK 21 (JDK 25 required to release)
Jakarta EE 11 (build-time default)
Spring 7/SpringBoot 4 (build-time default)
Guice 8 (build-time default)

Breaking Changes:

Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)

Security improvements:

Case-insensitive path matching is now enabled by default (hardened by default)
Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)

Other Changes:

Modernized Java code to JDK 17 baseline
Added fluent API in MergableAuthenticationInfo class
Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values
Using Java Scoped for Subject and SecurityManager instead of ThreadLocals on JDK 25+
Separated out ShiroFilterFactoryBeanPostProcessor to fix post processing warnings in Spring
Enable CORS preflight requests by default
Using AssertJ for testing

Removals of deprecated artifacts

Removed Shiro BOM - no longer necessary
Removed EhCache module in favor of JCache
Removed Hazelcast module in favor of JCache
Removed deprecated SimplePrincipalCollection class
Removed deprecated RandomSessionIdGenerator class
Removed deprecated HttpSessionContext class
Removed deprecated JavaEnvironment class
Removed deprecated XmlSerializer.java class
Removed JakartaTransformer class and it's jakartify() method
Removed Spring/Boot ShiroUrlPathHelper class
Removed Spring/Boot's remoting support
Removed Spring/Boot deprecated ShiroRequestMappingConfig class
Removed samples and tests associated with deprecated modules

fixes #1584

Following this checklist to help us incorporate your contribution quickly and easily:

Make sure there is a GitHub issue filed
for the change (usually before you start working on it). Trivial changes like typos do not
require a GitHub issue. Your pull request should address just this issue, without pulling in other changes.
Format the pull request title like [#XXX] - Fixes bug in SessionManager,
where you replace #XXX with the appropriate GitHub issue. Best practice
is to use the GitHub issue title in the pull request title and in the first line of the commit message.
Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
add fixes #XXX if merging the PR should close a related issue.
Run mvn verify to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
Committers: Make sure a milestone is set on the PR
Committers: Use "Squash and Merge" to combine all commits into one when merging a PR when appropriate.

Trivial changes like typos do not require a GitHub issue (javadoc, comments...).
In this case, just format the pull request title like [DOC] - Add javadoc in SessionManager.

If this is your first contribution, you have to read the Contribution Guidelines

If your pull request is about ~20 lines of code you don't need to sign an Individual Contributor License Agreement
if you are unsure please ask on the developers list.

To make clear that you license your contribution under the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004
In any other case, please file an Apache Individual Contributor License Agreement.

…ded to be immutable; provide an immutable implementation including a builder class; deprecate the mutable implementation; use the immutable one in SimpleAuthenticationInfo for merging. Background: Merging AuthenticationInfo and the contained PrincipalCollections previously lead to one of the involved PrincipalCollections be selected by undefined means and being mutated, propagating the changes to other callers that did not expect such changes, including the authentication cache.

* chore(3.x): Migrate to jakarta EE 10 using OpenRewrite * chore(3.x): Remove the jakarta classifier from shiro artifacts * chore(3.x): Address checkstyle issues post-migration * chore(3.x): Remove `HttpSessionContext` references * chore(3.x): Remove duplicate jakarta jax-rs imports * chore(3.x): Temporarily disable some modules/samples * Revert "chore(3.x): Temporarily disable some modules/samples" This reverts commit 71de7ba. --------- Co-authored-by: lprimak <lenny@flowlogix.com>

* Update to 3.0.0 Includes version bumps: - Java: 11 -> 17 - Ehcache: 2.6 -> 3.10 - Guice: 6 -> 7 - Jetty: 9.4.56.v2024.. -> 12.0 - `org.eclipse.jetty` -> `org.eclipse.jetty.ee10` - Jakarta EE: 8 -> 10 - Activation: 1.2 -> 2.1 - Annotation: 1.3 -> 2.1 - Enterprise CDI API: 2.0 -> 4.0 - JSON API: 1.1 -> 2.1 - JSON Bind: 1.0 -> 3.0 - Servlet: 4.0 -> 6.0 - Servlet JSP API: 2.2 -> 3.1 - Validation API: 2.0 -> 3.0 - WS RS API: 2.1 -> 3.1 - XML Bind: 2.3 -> 4.0 - Omnifaces: 4.6.1 - CXF RT Client: 3.6 -> 4.0 - Glassfish JAXB RT: 2.3 -> 4.0 - Spring: 5.3 -> 6.2 - Spring Boot: 2.7 -> 3.4 - Hibernate: 5.6 -> 6.6 (sample project) Concerns: - Ehcache migration most certainly needs revision - CI untested (specially Jenkins CD) - `flowlogix`, `omnifaces`, and a few other libs I have no knowledge of, certainly need attention - Spring remoting seems to have been dropped from Spring Context, not sure if replaceable Known issues: - No immediate suitable replacement for `org.eclipse.jetty:apache-jstl` - Ehcache 3.10 is pulling earlier version of jaxb runtime -> conflicting - Added exclusion to circumvent woes - Some web integration tests aren't up to speed - Embedded jetty-based ITs fail, server reports 503 - Arquillian IT fails - Meecrowave support missing (solved in unreleased 2.0.0?) * Remove lingering guice3 IT pom.xml * Suppress unchecked cast warning * Revert ill merge in test case * Properly disable meecrowave-based IT * Remove Shiro Spring remoting test * Remove lingering jetty injection argument from IT test case * Restore dependency details lost in translation * Remove stray type for runtime type inference / reification attempt Shouldn't have included this 🤦 This was a miserable attempt to obtain the concrete `Class<?>` instance for the request key and value types for caches. Please excuse my desperation. * fix(lang): Fix resource retrieval as URL instead of stream * fix: Fix typos in schema locations Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix(javadoc): Fix jakarta servlet javadoc reference * jakarta-related cleanup * fixed ehcache.xml --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: lprimak <lenny@flowlogix.com>

…hain (#2461) * enh: Adds default NoAccess configuration to the default filter chain * added feature flag * chore: javax -> jakarta --------- Co-authored-by: Brian Demers <bdemers@apache.org>

fixes #1984

@disabled

* SHIRO #1585 - Jakarta namespaces - WIP - compiles, TESTS FAIL Also addresses #1629 and #2006 since Guice moves to 7.0.0 (EE9), Spring moves to 6.1.17 (EE10) and spring boot moves to 3.0.13 (EE10) Stuck on spring-boot autowire test. Also EasyMock -> 5.5 to support modern java class file formats Since Spring forces Java 17 * SHIRO #1585 - builds and all but 13 integration tests pass. Failures seem to center around test harness construction (marked with @disabled ) * fix: revert unnecessary changes * more reverts * more reverts * review comment * fixed compilation error * more reverts --------- Co-authored-by: lprimak <lenny@flowlogix.com>

…2517)

lprimak · 2026-06-15T22:18:57Z

I realize that this is way too much to review line-by-line.
Just any feedback is appreciated, especially if I glaringly forgot or messed something up :)
I wanted to make sure that every contributor is correctly reflected here, for example.
Thank you.

steinarb · 2026-06-16T14:33:00Z

  - package-ecosystem: 'maven'
    directory: '/'
    schedule:
      interval: 'weekly'


Just out of curiosity: why weekly

FWIW I have daily on my dependabot workflows (probably because that was in the examples I started out with).

Daily just produces too many PRs, too many workflow runs, just too much stuff to deal with on daily basis.

(hm... good point on the many PRs bit. At least for npm upgrades (of which shiro probably has none). Maybe I should move to weekly in my own stuff for the npm upgrades)

steinarb · 2026-06-16T14:34:17Z

@@ -1,128 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>


Does this mean no shiro BOM anymore? Or has it been moved? Or is it autogenerated by the release process?

Yup. No Shiro BOM. It's no longer necessary since javax support was removed. Just a simple dependency will work now. No tricks :)

steinarb · 2026-06-16T14:47:57Z

-        Set<String> values = new HashSet<String>();
-        NamingEnumeration ne = null;
+        Set<String> values = new HashSet<>();
+        NamingEnumeration<?> ne = null;


(but here you can't use var since you need to type the null in ne)

steinarb · 2026-06-16T14:48:27Z

    public static Collection<String> getAllAttributeValues(Attribute attr) throws NamingException {
-        Set<String> values = new HashSet<String>();
-        NamingEnumeration ne = null;
+        Set<String> values = new HashSet<>();


Since you're moving to new syntax anyway: why not var for all local variables where it is possible to use it?

Would be like this then:

var values = new HashSet<String>();

For example, here we want to use base class Set<> instead of HasSet<> hence, var would change functionality, so var is (arguably) not appropriate here

steinarb · 2026-06-16T14:49:32Z

        Object primary = null;
        if (!isEmpty(principals)) {
-            Collection thisPrincipals = principals.fromRealm(getName());
+            Collection<?> thisPrincipals = principals.fromRealm(getName());


But this one could probably use var and you could maybe also remove Collection from the imports (if not used directly in your code).

steinarb · 2026-06-16T14:54:31Z

 */
 package org.apache.shiro.aop;

+import static org.assertj.core.api.Assertions.assertThat;


steinarb · 2026-06-16T15:07:24Z

-    protected Class getMethodArgumentType(Method method) {
-        Class[] paramTypes = method.getParameterTypes();
+    protected Class<?> getMethodArgumentType(Method method) {
+        Class<?>[] paramTypes = method.getParameterTypes();


one place where var could be used

steinarb · 2026-06-16T15:09:57Z

-                pc.add(5, getName());
-                pc.add(new PropertyPrincipal(username), getName());
-                account = new SimpleAccount(pc, password, getName());
+                var principalBuilder = new ImmutablePrincipalCollection.Builder();


Ah! var in use!

var was introduced in JDK 11 so "var everywhere" isn't really in scope here since this is upgrade 11->17.

Also I am not a big fan of var everywhere, but of course it's useful in some places.

steinarb · 2026-06-16T16:15:56Z

@@ -57,7 +57,9 @@ public boolean accept(File dir, String name) {
            }
        });

-        assertEquals(1, warFiles.length, "Expected only one war file in target directory, run 'mvn clean' and try again");
+        assertThat(warFiles.length)


Why not hasSize(1)? Should work even if this is an array?

Feel free to change that once this is merged... great idea! This was done with an OpenRewrite recipe I guess it missed it :)

steinarb

LGTM! 👍

(Man!! That was massive!)

lprimak · 2026-06-16T17:51:05Z

2+ years of work :)

lprimak · 2026-06-16T18:42:34Z

Many contributors and ecosystem contributions!

github-actions Bot added github_actions Pull requests that update GitHub Actions code java Pull requests that update Java code tests groovy xml yaml documentation labels Jun 14, 2026

lprimak self-assigned this Jun 14, 2026

lprimak added this to the 3.0.0 milestone Jun 14, 2026

lprimak force-pushed the 3.x branch from 5f49566 to 73f2c58 Compare June 15, 2026 21:58

janitza-mage and others added 10 commits June 15, 2026 17:03

Refactor: AssertJ best practices by @timtebeek

d5982a8

Set pom version to 3.0.0-SNAPSHOT

9c5c36b

[project] Add 3.X change guidelines

253e4cf

enh[3.x]: Adds default NoAccess configuration to the default filter c…

20616c2

…hain (#2461) * enh: Adds default NoAccess configuration to the default filter chain * added feature flag * chore: javax -> jakarta --------- Co-authored-by: Brian Demers <bdemers@apache.org>

enh: introduce multi-release jar

f1e053e

fixes #1984

[support] Update Karaf feature and bundle maven plugin configuration (#…

0c723ce

…2517)

lprimak force-pushed the 3.x branch from 73f2c58 to 5b626dc Compare June 15, 2026 22:08

lprimak marked this pull request as ready for review June 15, 2026 22:09

lprimak requested review from bdemers, bmarwell, boris-petrov, fpapon, jbonofre and steinarb June 15, 2026 22:17

steinarb reviewed Jun 16, 2026

View reviewed changes

fpapon previously approved these changes Jun 16, 2026

View reviewed changes

steinarb reviewed Jun 16, 2026

View reviewed changes

lprimak dismissed fpapon’s stale review via 96ae1bb June 16, 2026 17:24

lprimak force-pushed the 3.x branch from 5b626dc to 96ae1bb Compare June 16, 2026 17:24

steinarb approved these changes Jun 16, 2026

View reviewed changes

lprimak force-pushed the main branch from a0af4ef to 4207abc Compare June 16, 2026 20:27

chore: additional and supporting updates

6ed7a36

lprimak force-pushed the 3.x branch from 96ae1bb to 6ed7a36 Compare June 16, 2026 20:34

lprimak requested a review from fpapon June 16, 2026 20:35

lprimak merged commit b381172 into main Jun 17, 2026
26 of 27 checks passed

lprimak deleted the 3.x branch June 17, 2026 13:00

Conversation

lprimak commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lprimak commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lprimak Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lprimak Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

steinarb left a comment

Choose a reason for hiding this comment

Uh oh!

lprimak commented Jun 16, 2026

Uh oh!

lprimak commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

lprimak commented Jun 14, 2026 •

edited

Loading

lprimak commented Jun 15, 2026 •

edited

Loading

lprimak Jun 16, 2026 •

edited

Loading

lprimak Jun 16, 2026 •

edited

Loading