build(deps): bump shiro-version from 2.2.1 to 3.0.0

[dependabot]

Bumps shiro-version from 2.2.1 to 3.0.0.
Updates org.apache.shiro:shiro-core from 2.2.1 to 3.0.0

Release notes

Sourced from org.apache.shiro:shiro-core's releases.

Apache Shiro 3.0.0

Minimum runtime Requirements

• JDK 17
• Jakarta EE 9/10/11+ (no javax.* namespace)
• Spring 6/7+ and SpringBoot 3/4+
• Guice 7/8+

Breaking Changes:

• Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)

Security improvements:

• Case-insensitive path matching is now enabled by default (hardened by default)
• Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
• #2799 enh: warn if realm authentication fails by @​lprimak in apache/shiro#2798
• Web RememberMe and Guice Enhancements by @​lprimak in apache/shiro#2800
• Enable CORS preflight requests by default

Other Changes:

• Modernized Java code to JDK 17 baseline
• Added fluent API in MergableAuthenticationInfo class
• Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
• Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values
• Using Java Scoped for Subject and SecurityManager instead of ThreadLocals on JDK 25+
• Separated out ShiroFilterFactoryBeanPostProcessor to fix post processing warnings in Spring
• Using AssertJ for testing

Removals of deprecated artifacts

• Removed Shiro BOM - no longer necessary
• Removed EhCache module in favor of JCache
• Removed Hazelcast module in favor of JCache
• Removed deprecated SimplePrincipalCollection class
• Removed deprecated RandomSessionIdGenerator class
• Removed deprecated HttpSessionContext class
• Removed deprecated JavaEnvironment class
• Removed deprecated XmlSerializer.java class
• Removed JakartaTransformer class and it's jakartify() method
• Removed Spring/Boot ShiroUrlPathHelper class
• Removed Spring/Boot's remoting support
• Removed Spring/Boot deprecated ShiroRequestMappingConfig class
• Removed samples and tests associated with deprecated modules

Minimum build requirements

• JDK 21 (JDK 25 required to release)
• Jakarta EE 11 (build-time default)
• Spring 7/SpringBoot 4 (build-time default)
• Guice 8 (build-time default)

What's Changed

• #1584 Merge 3.x branch into main by @​lprimak in apache/shiro#2772

... (truncated)

Changelog

Sourced from org.apache.shiro:shiro-core's changelog.

Licensed to the Apache Software Foundation (ASF) under one

or more contributor license agreements. See the NOTICE file

distributed with this work for additional information

regarding copyright ownership. The ASF licenses this file

to you under the Apache License, Version 2.0 (the

"License"); you may not use this file except in compliance

with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,

software distributed under the License is distributed on an

"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

KIND, either express or implied. See the License for the

specific language governing permissions and limitations

under the License.

DEPRECATED

Currently Apache Shiro uses GitHub releases for release notes, so this file is no longer being updated. It will be removed in a future release.

DEPRECATED

This is not an official release notes document. It exists for Shiro developers to jot down their notes while working in the source code. These notes will be combined with Jira’s auto-generated release notes during a release for the total set.

###########################################################

2.0.0

###########################################################

Improvement

[SHIRO-290] Implement bcrypt and argon2 KDF algorithms

Backwards Incompatible Changes

• Changed default DefaultPasswordService.java algorithm to "Argon2id".
• PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. It was never specified how this method would behave.
• Made salt non-nullable.
• Removed methods in PasswordMatcher.

###########################################################

1.7.1

###########################################################

Bug

... (truncated)

Commits

• a0c53ad [maven-release-plugin] prepare release shiro-root-3.0.0
• ffba65f chore(deps): bump the maven-dependencies group with 2 updates (#2803)
• 63ebb6c chore(deps): bump actions/checkout (#2802)
• e441ea3 enh(web): rememberMe cookie expiration is checked on the server
• 42aa344 bugfix(guice-web): now matching paths with trailing slash stripped
• 8856874 chore: update Payara version and refactor port property names in configuratio...
• c7dc2a4 enh: warn if realm authentication fails due to system exceptions in multi-rea...
• d08a84c chore(deps-dev): bump com.flowlogix.depchain:integration-test (#2796)
• e45268b chore(dependabot): fix htmlunit major version pinning
• da75880 chore(deps): bump the maven-dependencies group across 1 directory with 2 upda...
• Additional commits viewable in compare view

Updates org.apache.shiro:shiro-spring from 2.2.1 to 3.0.0

Release notes

Sourced from org.apache.shiro:shiro-spring's releases.

Apache Shiro 3.0.0

Minimum runtime Requirements

• JDK 17
• Jakarta EE 9/10/11+ (no javax.* namespace)
• Spring 6/7+ and SpringBoot 3/4+
• Guice 7/8+

Breaking Changes:

• Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)

Security improvements:

• Case-insensitive path matching is now enabled by default (hardened by default)
• Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
• #2799 enh: warn if realm authentication fails by @​lprimak in apache/shiro#2798
• Web RememberMe and Guice Enhancements by @​lprimak in apache/shiro#2800
• Enable CORS preflight requests by default

Other Changes:

• Modernized Java code to JDK 17 baseline
• Added fluent API in MergableAuthenticationInfo class
• Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
• Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values
• Using Java Scoped for Subject and SecurityManager instead of ThreadLocals on JDK 25+
• Separated out ShiroFilterFactoryBeanPostProcessor to fix post processing warnings in Spring
• Using AssertJ for testing

Removals of deprecated artifacts

• Removed Shiro BOM - no longer necessary
• Removed EhCache module in favor of JCache
• Removed Hazelcast module in favor of JCache
• Removed deprecated SimplePrincipalCollection class
• Removed deprecated RandomSessionIdGenerator class
• Removed deprecated HttpSessionContext class
• Removed deprecated JavaEnvironment class
• Removed deprecated XmlSerializer.java class
• Removed JakartaTransformer class and it's jakartify() method
• Removed Spring/Boot ShiroUrlPathHelper class
• Removed Spring/Boot's remoting support
• Removed Spring/Boot deprecated ShiroRequestMappingConfig class
• Removed samples and tests associated with deprecated modules

Minimum build requirements

• JDK 21 (JDK 25 required to release)
• Jakarta EE 11 (build-time default)
• Spring 7/SpringBoot 4 (build-time default)
• Guice 8 (build-time default)

What's Changed

• #1584 Merge 3.x branch into main by @​lprimak in apache/shiro#2772

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Test Results

  351 files  ±0    351 suites  ±0   1h 17m 9s ⏱️ - 1m 28s
3 340 tests ±0  3 274 ✅ ±0  66 💤 ±0  0 ❌ ±0 
3 335 runs  +1  3 269 ✅ +1  66 💤 ±0  0 ❌ ±0 

Results for commit 3bad08c. ± Comparison against base commit 89838f6.