lukaszlenart commented on PR #536: URL: https://github.com/apache/struts-examples/pull/536#issuecomment-5292946024
Partially verified against `main` after #544, but **not** cleared for merge yet — flagging what I could and could not confirm. Confirmed: - `shiro-basic` compiles and resolves against Shiro 3.0.0 (so the Java API surface the example uses is unchanged) - the two classes referenced as **strings** in `web.xml` — `org.apache.shiro.web.env.EnvironmentLoaderListener` and `org.apache.shiro.web.servlet.ShiroFilter` — both still exist in `shiro-web-3.0.0.jar`. These are the ones a compiler cannot check, and they are the usual breakage in a major Shiro bump. - the app boots and `ShiroFilter` correctly redirects an unauthenticated request (302), with no exceptions at startup Not confirmed: - **the actual login flow**. My local attempt to authenticate against the `shiro.ini` realm was inconclusive due to a flaky test setup on my side, and I could not get a clean A/B against 2.2.1 to compare. Since `shiro-basic` has no automated tests, CI going green here only proves compilation — it will not catch a broken `SecurityManager`, realm, or session behaviour at runtime. Given 2.x → 3.0.0 is a major release, I would suggest someone manually walk the login → welcome → logout path (e.g. `lonestarr`/`vespa`) before merging, rather than trusting a green build. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
