NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Maven Central · #1030 by repository stars
Last release 24 days ago
28 Aug 2026
Ships fairly regularly
a new release about every 3 months
Most releases are documented
notes for 20 of 30 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
36 releases · first in 2016
enh: added replay whitelist and blacklist check before resubmitting a… by @lprimak in #2826
Full Changelog: shiro-root-3.0.0...shiro-root-3.0.1
One column per quarter.
Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
Breaking Changes:
PrincipalCollection immutable (ImmutablePrincipalCollection)setHost() and setStartTimestamp() from public API of SimpleSession to keep immutabilitySecurity improvements:
shiro.ini-based configurations only (hardened by default)Other Changes:
MergableAuthenticationInfo classShiroFilterFactoryBeanPostProcessor to fix post processing warnings in SpringRemovals of deprecated artifacts
SimplePrincipalCollection classRandomSessionIdGenerator classHttpSessionContext classJavaEnvironment classXmlSerializer.java classJakartaTransformer class and it's jakartify() methodShiroUrlPathHelper classShiroRequestMappingConfig classFull Changelog: shiro-root-2.2.1...shiro-root-3.0.0
Fix deprecation warnings by @lprimak in #1630
Full Changelog: shiro-root-2.1.0...shiro-root-3.0.0-alpha-1
[ #2758 ] Deprecate RandomSessionIdGenerator due to insufficient entropy by @lprimak in #2770
message by @jbampton in #2717Full Changelog: shiro-root-2.2.0...shiro-root-2.2.1
chore: fixed deprecated methods in Hasher
codespell.txt by @jbampton in #2521persist-credentials: false by @jbampton in #2532manual stage pre-commit hook chmod for markdown permissions by @jbampton in #2586document-start rule checking by @jbampton in #2585Note truncated.
chore: fix vulnerabilities in tests reported by OpenSSF tool by @lprimak in #2411
.rdf by @jbampton in #2386type attributes from HTML script tags by @jbampton in #2382--color=always by @jbampton in #2407pre-commit autoupdate to update the hooks by @jbampton in #2486--show-diff-on-failure by @jbampton in #2487Full Changelog: shiro-root-2.0.6...shiro-root-2.1.0
[ #2186 ] change authorized user to return 403 by @OyvindLGjesdal in #2187
CONTRIBUTING.md by @jbampton in #2315codespell with pre-commit and fix typos by @jbampton in #2313groups for github-actions ecosystem by @jbampton in #2340gitleaks to check for secrets by @jbampton in #2336pom.xml by @jbampton in #2331yamllint and standardize YAML files by @jbampton in #2343actions by @jbampton in #2333markdownlint and clean Markdown files by @jbampton in #2338actionlint for GitHub Actions workflow files by @jbampton in #2342shellcheck and clean shell files by @jbampton in #2339Full Changelog: shiro-root-2.0.5...shiro-root-2.0.6
[ #1691 ] added the @Qualifier annotation to the RequestMappi… by @Suvrat1629 in #2147
@Qualifier annotation to the RequestMappi… by @Suvrat1629 in #2147pom.xml files by @jbampton in #2173pom.xml by @jbampton in #2168Full Changelog: shiro-root-2.0.4...shiro-root-2.0.5
[ #2081 ] bugfix: remove InheriableThreadLocal from ThreadContext as it was cau… by @lprimak in #2082
Full Changelog: shiro-root-2.0.3...shiro-root-2.0.4
bugfix(test): locking flaky failing Guice test by @lprimak in #1890
Note truncated.
Nothing published for this version
Nothing published for this version
[SHIRO-290] Implement bcrypt and argon2 KDF algorithms
###########################################################
Improvement
[SHIRO-290] Implement bcrypt and argon2 KDF algorithms
###########################################################
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
[SHIRO-797] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error
###########################################################
Bug
[SHIRO-797] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error
###########################################################
[SHIRO-767] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertow as web container [SHIRO-792] - ShiroWebFil
###########################################################
Bug
[SHIRO-767] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertow as web container
[SHIRO-792] - ShiroWebFilterConfiguration seems to conflict with other FilterRegistrationBean
New Feature
[SHIRO-789] - Also add cookie SameSite option to Spring
Improvement
[SHIRO-740] - SslFilter with HTTP Strict Transport Security (HSTS)
[SHIRO-794] - Add system property to enable backslash path normalization
[SHIRO-795] - Disable session path rewriting by default
Task
[SHIRO-793] - deleteMe cookie should use the defined "sameSite"
###########################################################
[SHIRO-610] - Incorrect filterchainResolver in 1.4.0-RC2 [SHIRO-762] - SecurityUtils.securityManager should be volatile [SHIRO-766] - ArrayIndexOutOfB
###########################################################
Bug
[SHIRO-610] - Incorrect filterchainResolver in 1.4.0-RC2
[SHIRO-762] - SecurityUtils.securityManager should be volatile
[SHIRO-766] - ArrayIndexOutOfBoundsException in Base64#decode
New Feature
[SHIRO-788] - Add support for Global Filters
Wish
[SHIRO-780] - NOTICE files of shiro components don't match NOTICE in source code repository
###########################################################
[SHIRO-530] - INI parser does not properly handled backslashes at end of values [SHIRO-751] - SimplePrincipalMap and SimplePrincipalCollection throw d
###########################################################
Bug
[SHIRO-530] - INI parser does not properly handled backslashes at end of values
[SHIRO-751] - SimplePrincipalMap and SimplePrincipalCollection throw different exceptions for the same problem
[SHIRO-753] - Regression in URI parsing in Shiro 1.5.2
Dependency upgrade
[SHIRO-754] - Upgrade to Apache Commons Codec 1.14
[SHIRO-755] - Upgrade to Hazelcast 3.12.6
[SHIRO-756] - Upgrade to Spring 5.2.5.RELEASE and Spring boot 2.2.6.RELEASE
[SHIRO-757] - Upgrade to Htmlunit 2.39.0
[SHIRO-758] - Upgrade to Jetty 9.4.27.v20200227
[SHIRO-759] - Upgrade to Karaf 4.2.8
###########################################################
[SHIRO-747] - FirstSuccessfulStrategy doesn't properly short circuit [SHIRO-749] - shiro-all jar is missing cache package
###########################################################
Bug
[SHIRO-747] - FirstSuccessfulStrategy doesn't properly short circuit
[SHIRO-749] - shiro-all jar is missing cache package
Improvement
[SHIRO-748] - Update Commons Configuration to 2.7
###########################################################
[SHIRO-736] - DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider [SHIRO-739] - Bean reflection property failed with
###########################################################
Bug
[SHIRO-736] - DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider
[SHIRO-739] - Bean reflection property failed with Enum values
[SHIRO-741] - Matching of / (root) is broken
[SHIRO-742] - fix throw exception when request uri is /
Dependency upgrade
[SHIRO-738] - Upgrade to Spring 5.2.3.RELEASE and Spring boot 2.2.4.RELEASE
###########################################################
[SHIRO-723] - Provide Minor Shiro Release that includes CVE-2019-10086 Fix
###########################################################
Notes: this release require a JRE 8 minimum.
Bug
[SHIRO-458] - Possible leaked timing information from DefaultPasswordService
[SHIRO-469] - Wrong description of JdbcRealm#setPermissionsQuery
[SHIRO-552] - JdbcRealm in SaltStyle.COLUMN assumes that password column is Base64 but salt column is utf8 bytes
[SHIRO-661] - Add check for the principal of subject whether is null
[SHIRO-682] - fix the potential threat when use "uri = uri + '/' " to bypassed shiro protect
[SHIRO-684] - INI parser keeps escape characters in keys and values
[SHIRO-685] - Potential NullPointerException if PermissionResolver return null/empty string
[SHIRO-687] - Additional Servlet Filters are not available to ShiroFilterFactorBean (unless using XML based beans)
New Feature
[SHIRO-694] - Adds BearerToken support
[SHIRO-722] - Add SameSite option to cookies
Improvement
[SHIRO-668] - Catch unexpected errors which can lead to oom
[SHIRO-669] - Included a boolean flag in FirstSuccessfulStrategy to break after first successful authentication
[SHIRO-670] - ByteSource Serializable
[SHIRO-681] - Upgrade to compiler Java 8
[SHIRO-693] - Update plugins
[SHIRO-700] - Minor spring updates
[SHIRO-706] - Switch to Guice4 by default in the build
[SHIRO-709] - Fix Shiro Spring feature
[SHIRO-710] - Update Commons Lang3 + remove older Commons Lang
[SHIRO-711] - Deprecate JavaEnvironment
[SHIRO-712] - Add BasicIniEnvironment
[SHIRO-715] - Remove old JSTL jars
[SHIRO-720] - Update Commons BeanUtils
[SHIRO-724] - Update Jetty, Spring, Spring Boot, Htmlunit dependencies
[SHIRO-726] - Add dynamic import package
[SHIRO-728] - Update Spring Boot to 2.1.10
[SHIRO-729] - Update Quartz
[SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService
[SHIRO-731] - Use OWasp Java Encoder to escape user supplied content to the logs
Test
[SHIRO-697] - Reduce shiro test logging level to INFO
Task
[SHIRO-690] - Validate JDK11 compatibility
[SHIRO-692] - Upgrade and enforce min build maven version to 3.5.0
[SHIRO-698] - Improve build with maven profile
[SHIRO-734] - Remove Spring-client sample
[SHIRO-735] - Shiro does not support servlet-3.1 void method(@Suspended AsyncResponse)
Dependency upgrade
[SHIRO-688] - Upgrade to commons-cli 1.4
[SHIRO-689] - Upgrade to commons-codec 1.12
[SHIRO-691] - Upgrade to maven-jar-plugin 3.1.1
[SHIRO-695] - Update Hazelcast
[SHIRO-696] - Update Jetty
[SHIRO-699] - Fix maven warning for exec-maven-plugin and upgrade to 1.6.0
[SHIRO-701] - Update logback
[SHIRO-702] - Upgrade to jacoco-maven-plugin 0.8.4
[SHIRO-703] - Update HSQL
[SHIRO-704] - Update Spring, Spring Boot, Hibernate
[SHIRO-705] - Update Easymock + Powermock
[SHIRO-707] - Misc dependency updates
[SHIRO-716] - Upgrade to commons-codec 1.13
[SHIRO-717] - Upgrade to maven-pmd-plugin 3.12.0
[SHIRO-718] - Upgrade to xmlsec 2.1.4
[SHIRO-719] - Upgrade to Karaf 4.2.6
Request
[SHIRO-723] - Provide Minor Shiro Release that includes CVE-2019-10086 Fix
###########################################################
[SHIRO-721] - RememberMe Padding Oracle Vulnerability
###########################################################
Bug
[SHIRO-721] - RememberMe Padding Oracle Vulnerability
Improvement
[SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService
###########################################################
[SHIRO-457] - Login without static VM security manager cause exception in debug [SHIRO-563] - shiro-aspectj karaf feature can't be installed [SHIRO-62
###########################################################
Bug
[SHIRO-457] - Login without static VM security manager cause exception in debug
[SHIRO-563] - shiro-aspectj karaf feature can't be installed
[SHIRO-624] - OSGI: commons configuration import should be optional
[SHIRO-626] - Bundle symbolic name conflict
[SHIRO-637] - Refresh cached session in HTTP request after user logs out
[SHIRO-650] - Shiro JAX-RS is not an OSGi bundle
[SHIRO-653] - Spring-boot registers shiro filter only on REQUEST dispatcher
[SHIRO-655] - shiro-core has an undesirable runtime OSGi dependency to spring-beans
[SHIRO-658] - Problems building shiro on openjdk-8 on current debian stable (9.6 "stretch")
[SHIRO-660] - Bug in FirstSuccessfulStrategy
[SHIRO-680] - Duplicate Bundle-SymbolicName for Different Shiro Modules
New Feature
[SHIRO-638] - Update osgi bundle manifest to support Spring 4.x
Improvement
[SHIRO-560] - Shiro-web feature can't be installed in karaf 4.0.4
[SHIRO-652] - Upgrade Shiro Feature to Karaf 4.x
[SHIRO-664] - Upgrade to Apache pom parent 21
[SHIRO-665] - Upgrade to maven-bundle-plugin 4.1.0
[SHIRO-667] - Upgrade to Spring 4.3.22-RELEASE
[SHIRO-672] - Upgrade to jacoco-maven-plugin 0.8.3
[SHIRO-673] - Upgrade to maven-compiler-plugin 3.8.0
[SHIRO-674] - Upgrade to maven-dependency-plugin to 3.1.1
[SHIRO-675] - Upgrade to maven-surefire-plugins 3.0.0-M3
[SHIRO-676] - Upgrade to maven-jar-plugin 3.1.0
[SHIRO-677] - Upgrade to versions-maven-plugin 2.7
[SHIRO-683] - Upgrade to spring-boot 1.5.19.RELEASE
Task
[SHIRO-662] - Constant Name Change in AuthenticationRealm
[SHIRO-663] - Clean up pom parent relative path
Dependency upgrade
[SHIRO-659] - Upgrade to OWASP dependency-check-maven plugin 4.0.0
###########################################################
[SHIRO-559] - shiro-guice violates the JEE specification [SHIRO-579] - Permission filter is validating last matched path [SHIRO-603] - Endless recursi
###########################################################
Bug
[SHIRO-559] - shiro-guice violates the JEE specification
[SHIRO-579] - Permission filter is validating last matched path
[SHIRO-603] - Endless recursion in ShiroSecurityContext.getUserPrincipal()
[SHIRO-605] - ShiroWebModule creates out of order filter chain.
[SHIRO-607] - AuthorizationAttributeSourceAdvisor ignores type-annotations
[SHIRO-608] - Use a ServiceLoader to discover WebEnvironments
[SHIRO-611] - Spring web module does not load correct SessionStorageEvaluator
Improvement
[SHIRO-596] - shiro-tools-hasher needs private salt option
[SHIRO-618] - Spring Boot Web Starter- Autoconfiguration for Realm and ShiroFilterChainDefinition
###########################################################
…[SHIRO-612] - Need to upgrade BeanUtils to avoid vulnerability
###########################################################
Bug
[SHIRO-493] - shiro-guice not working with the guice 4.x
[SHIRO-576] - Commons-beanutils dependency is not security compliant
[SHIRO-586] - Can't Search For Groups In Active Directory Without A System User
[SHIRO-587] - Can't Access Groups If userPrincipalName Doesn't Exist
[SHIRO-591] - Basic Auth Filter permissive mode does NOT work
[SHIRO-592] - ModularRealmAuthenticator causes log spam when one realm throws exception
[SHIRO-593] - Allow for IniWebEnvironment subclasses to specify defaults objects to ReflectionBuilder
[SHIRO-594] - Update Hazelcast version to latest supported version (3.7.2)
[SHIRO-595] - Allow for POST only logout requests
[SHIRO-612] - Need to upgrade BeanUtils to avoid vulnerability
New Feature
[SHIRO-501] - Add ability to set system properties in shiro.ini
[SHIRO-589] - Add Servlet 3.x fragment
[SHIRO-590] - Add Spring Boot support / starters
Improvement
[SHIRO-296] - Typo fixes
[SHIRO-301] - Call permissionResolver directly in AuthorizingRealm
[SHIRO-392] - Shiro Extension for JAX-RS
[SHIRO-599] - Fix file encoding warnings during maven build and reporting
###########################################################
Your coding agent can read these notes before it upgrades. Set up the MCP server →