This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro-site.git
commit 4eef7452c46b012a34b11c7e9272b69534a136f1 Author: lprimak <[email protected]> AuthorDate: Mon Jul 6 19:47:41 2026 -0500 enh: update docs, downloads to 3.x --- .../blog/2026/06/apache-shiro-300-released.adoc | 3 + src/site/content/dependency-chain.adoc | 66 +++++++++++++++- src/site/content/download.adoc | 4 +- src/site/content/jakarta-ee.adoc | 89 +--------------------- src/site/data/artifacts.yaml | 6 ++ src/site/data/releases.yaml | 26 ++++++- src/site/templates/download.ftl | 4 +- src/site/templates/macros/versions.ftl | 1 + 8 files changed, 104 insertions(+), 95 deletions(-) diff --git a/src/site/content/blog/2026/06/apache-shiro-300-released.adoc b/src/site/content/blog/2026/06/apache-shiro-300-released.adoc index 5dc2e019b..20f990b47 100644 --- a/src/site/content/blog/2026/06/apache-shiro-300-released.adoc +++ b/src/site/content/blog/2026/06/apache-shiro-300-released.adoc @@ -51,6 +51,9 @@ This is a new major release of Apache Shiro, with many new features and improvem * Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default) * Enable CORS preflight requests by default +== End-of-life notice +Apache Shiro 1.x and 2.x are now considered end-of-life. If support for these versions is required, please check link:/commercial-support.html[Commercial Support] + == Thank you to the following contributors! * https://github.com/janitza-mage[Martin Geisse] diff --git a/src/site/content/dependency-chain.adoc b/src/site/content/dependency-chain.adoc index 0bae58aee..9ce0a1f9b 100644 --- a/src/site/content/dependency-chain.adoc +++ b/src/site/content/dependency-chain.adoc @@ -9,12 +9,13 @@ Managing Apache Shiro dependencies in Jakarta EE projects can be simplified using the FlowLogix Dependency Chains. This approach provides a cleaner alternative to managing the BOM (Bill of Materials) directly, reducing configuration complexity and common errors. == Applicability -This guide is intended for Jakarta EE projects using Apache Shiro for security. +This guide is intended for Jakarta EE projects using Apache Shiro 2.x for security. +It is not applicable to Shiro 3.x [NOTE] ==== Dependency chains are not suitable for Spring or SpringBoot projects ==== -For Spring / SpringBoot projects, you need to use a link:jakarta-ee.html#bom_approach[traditional BOM approach] +For Spring / SpringBoot projects, you need to use a link:#bom_approach[traditional BOM approach] == What is the FlowLogix Dependency Chain? @@ -191,3 +192,64 @@ To migrate an existing project from the traditional BOM approach: 4. Remove any manually specified `jakarta` classifiers The dependency chain automatically handles classifier configuration and ensures all required components are included with compatible versions. + +[#bom_approach] +=== Traditional BOM with Individual Dependencies + +Alternatively, use the Shiro artifacts with Jakarta classifiers directly + +Import the Shiro BOM as seen below +[NOTE] +==== +Shiro BOM is a *necessary* step, unless you are using FlowLogix Depchain as described above. +The BOM is needed if you are using Spring / SpringBoot. +==== + +[source,xml] +---- +<dependencyManagement> + <dependencies> + <dependency> + <groupId>org.apache.shiro</groupId> + <artifactId>shiro-bom</artifactId> + <version>${versions.latestRelease}</version> + <scope>import</scope> + <type>pom</type> + </dependency> + </dependencies> +</dependencyManagement> +---- + +[source,xml] +---- +<dependency> + <groupId>org.apache.shiro</groupId> + <artifactId>shiro-jakarta-ee</artifactId> + <classifier>jakarta</classifier> +</dependency> + +<dependency> + <groupId>org.apache.shiro</groupId> + <artifactId>shiro-cdi</artifactId> + <classifier>jakarta</classifier> +</dependency> + +<dependency> + <groupId>org.apache.shiro</groupId> + <artifactId>shiro-core</artifactId> + <classifier>jakarta</classifier> +</dependency> + +<dependency> + <groupId>org.apache.shiro</groupId> + <artifactId>shiro-web</artifactId> + <classifier>jakarta</classifier> +</dependency> + +<dependency> + <groupId>org.omnifaces</groupId> + <artifactId>omnifaces</artifactId> + <!-- replace LATEST with a version number --> + <version>LATEST</version> +</dependency> +---- diff --git a/src/site/content/download.adoc b/src/site/content/download.adoc index a06e84fe7..168516e4f 100644 --- a/src/site/content/download.adoc +++ b/src/site/content/download.adoc @@ -4,11 +4,11 @@ :jbake-status: published :jbake-tags: download, installation, maven, gradle :jbake-description: Download Apache Shiro security framework. Get the latest stable release with Maven/Gradle dependencies and verify signatures. -:jbake-releases: {"versions":["shiro22x"]} +:jbake-releases: {"versions":["shiro30x"]} :idprefix: :icons: font -Apache Shiro ${versions.latestRelease} is the current stable release (Java 11+). +Apache Shiro ${versions.latestRelease} is the current stable release (Java 17+). To download Shiro please follow the instructions below. diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc index 1ad8c5fc7..7d2fd5614 100644 --- a/src/site/content/jakarta-ee.adoc +++ b/src/site/content/jakarta-ee.adoc @@ -11,7 +11,7 @@ Apache Shiro Jakarta EE module makes it transparent to use Shiro features in Jak with minimal configuration. It makes annotations such as `@RequiresRoles` available in Jakarta EE (CDI, EJB, etc.) code. NOTE: Jakarta EE integration is available in Shiro 2.0 or later. + -The module is compatible with Java EE 8 through Jakarta EE 10 or later. It may work with earlier versions of Jakarta EE but was not tested with those. +The module is compatible with Jakarta EE 10 through Jakarta EE 11 or later. It may work with earlier versions of Jakarta EE but was not tested with those. == Dependencies @@ -39,93 +39,6 @@ Jakarta EE module depends on CDI and Jax-RS submodules to fully integrate with t === Jakarta EE Security Annotations (JSR-250) In addition to all Shiro annotations, Jakarta EE module allows to specify Jakarta EE security annotations such as `@RolesAllowed`, `@DenyAll` and `@PermitAll` on your beans -=== How to use Jakarta 9+ (jakarta.* namespace) - -There are two approaches to include Shiro Jakarta EE dependencies in your project: - -==== Option 1: FlowLogix Dependency Chain (Recommended) -[NOTE] -==== -This option is applicable only to Jakarta EE, not Spring / SpringBoot. -==== - -The simplest approach is to use the FlowLogix dependency chain, which bundles all required Shiro Jakarta EE components in a single dependency: - -[source,xml] ----- -<dependencies> - <dependency> - <groupId>com.flowlogix.depchain</groupId> - <artifactId>shiro-jakarta</artifactId> - <!-- replace LATEST with a version number --> - <version>LATEST</version> - </dependency> -</dependencies> ----- - -This approach automatically includes all Shiro modules (`shiro-core`, `shiro-web`, `shiro-jakarta-ee`, `shiro-cdi`, `shiro-jaxrs`) with the correct Jakarta classifier, plus required dependencies like OmniFaces. See the link:dependency-chain.html[Dependency Chain Guide] for more details, Gradle examples, and migration instructions. - -[#bom_approach] -==== Option 2: Traditional BOM with Individual Dependencies - -Alternatively, use the Shiro artifacts with Jakarta classifiers directly - -Import the Shiro BOM as seen below -[NOTE] -==== -Shiro BOM is a *necessary* step, unless you are using FlowLogix Depchain as described above. -The BOM is needed if you are using Spring / SpringBoot. -==== - -[source,xml] ----- -<dependencyManagement> - <dependencies> - <dependency> - <groupId>org.apache.shiro</groupId> - <artifactId>shiro-bom</artifactId> - <version>${versions.latestRelease}</version> - <scope>import</scope> - <type>pom</type> - </dependency> - </dependencies> -</dependencyManagement> ----- - -[source,xml] ----- -<dependency> - <groupId>org.apache.shiro</groupId> - <artifactId>shiro-jakarta-ee</artifactId> - <classifier>jakarta</classifier> -</dependency> - -<dependency> - <groupId>org.apache.shiro</groupId> - <artifactId>shiro-cdi</artifactId> - <classifier>jakarta</classifier> -</dependency> - -<dependency> - <groupId>org.apache.shiro</groupId> - <artifactId>shiro-core</artifactId> - <classifier>jakarta</classifier> -</dependency> - -<dependency> - <groupId>org.apache.shiro</groupId> - <artifactId>shiro-web</artifactId> - <classifier>jakarta</classifier> -</dependency> - -<dependency> - <groupId>org.omnifaces</groupId> - <artifactId>omnifaces</artifactId> - <!-- replace LATEST with a version number --> - <version>LATEST</version> -</dependency> ----- - == Configuration No additional configuration is required to use Shiro Jakarta EE module. The module is bootstrapped automatically. + Only `shiro.ini` is needed and can be configured as described in link:web.html#web_ini[Web Configuration] + diff --git a/src/site/data/artifacts.yaml b/src/site/data/artifacts.yaml index a570d9889..2b4f1654b 100644 --- a/src/site/data/artifacts.yaml +++ b/src/site/data/artifacts.yaml @@ -57,6 +57,12 @@ artifacts: Shiro-CAS support is deprecated, support has been moved to the Apache Shiro based <a href='https://github.com/bujiio/buji-pac4j'>buji-pac4j</a> project. + shiroCache: + "g": "org.apache.shiro" + "a": "shiro-cache" + "type": "jar" + "description": 'Enables <a class="external-link" href="https://jcp.org/en/jsr/detail?id=107";>Java Cache</a>-based framework caching.' + shiroEhCache: "g": "org.apache.shiro" "a": "shiro-ehcache" diff --git a/src/site/data/releases.yaml b/src/site/data/releases.yaml index 279a7f854..36e67e7f3 100644 --- a/src/site/data/releases.yaml +++ b/src/site/data/releases.yaml @@ -1,9 +1,11 @@ --- # for each release, update this variable with the latest version. -latestRelease: "2.2.1" +latestRelease: "3.0.0" # also add or replace the latest version here. versionInfo: + '3.0.0': + releaseDate: 2026-06-29 '2.2.1': releaseDate: 2026-06-17 '2.2.0': @@ -387,3 +389,25 @@ releases: - shiroHasher hashes: - sha512 + + shiro30x: + version: 3.0.0 + artifacts: + - shiroCore + - shiroWeb + - shiroServletPlugin + - shiroCDI + - shiroJakartaEE + - shiroJaxrs + - shiroAspectJ + - shiroCas + - shiroCache + - shiroFeatures + - shiroGuice + - shiroQuartz + - shiroSpring + - shiroSpringBoot + - shiroSpringBootWeb + - shiroHasher + hashes: + - sha512 diff --git a/src/site/templates/download.ftl b/src/site/templates/download.ftl index 543a48227..ab220249c 100644 --- a/src/site/templates/download.ftl +++ b/src/site/templates/download.ftl @@ -15,13 +15,13 @@ <#assign displayReleases=((content.releases).versions)![] /> <#assign downloadUrl="https://www.apache.org/dyn/closer.lua/shiro/"; /> <#assign appendToGpg=".txt" /> - <#assign buildRequirements="The source bundle requires JDK 11+ and Maven 3.8+ to build:"/> + <#assign buildRequirements="The source bundle requires JDK 25+ and Maven 3.9+ to build:"/> <#else> <#-- if not releases are given using :jbake-release:, assume oldReleases (release-archive.html). --> <#assign displayReleases=versions.oldReleases /> <#assign downloadUrl="https://archive.apache.org/dist/shiro/"; /> <#assign appendToGpg="" /> - <#assign buildRequirements="The source bundle requires JDK 1.8 and Maven 3.0.3+ to build:"/> + <#assign buildRequirements="The source bundle requires JDK 11 and Maven 3.8+ to build:"/> </#if> <#assign downloadHashUrl="https://downloads.apache.org/shiro/"; /> diff --git a/src/site/templates/macros/versions.ftl b/src/site/templates/macros/versions.ftl index fdf46e01c..2f420ce8d 100644 --- a/src/site/templates/macros/versions.ftl +++ b/src/site/templates/macros/versions.ftl @@ -18,6 +18,7 @@ <div class="title">Shiro v1 version notice</div> <div class="paragraph"> <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p> + <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p> <#if (sourcepage)?? && (sourcepage)?is_string && (sourcepage) != "" && hasv2 == true> <p> <a href="./v2/${sourcepage}">Read this page in the v2 documentation</a>.
