ParkGyeongTae opened a new pull request, #5293: URL: https://github.com/apache/zeppelin/pull/5293
### What is this PR for? Upgrades Apache Shiro from 1.13.0 to 2.0.6, the current stable release line with active security patches. Shiro 2.x strengthens default password hashing (Argon2id instead of MD5) and provides Jakarta EE 10 support, which aligns with the jakarta.* namespace already in use by this project. This PR also resolves a transitive BouncyCastle version conflict introduced by shiro-crypto-hash:2.0.6 pulling in bcprov-jdk18on:1.82, and fixes the two compile-breaking API changes between Shiro 1.x and 2.x. ### What type of PR is it? Improvement ### Todos * [x] Bump shiro.version 1.13.0 → 2.0.6 in pom.xml * [x] Bump bouncycastle.version 1.80 → 1.82 to resolve DependencyConvergence conflict * [x] Replace removed DefaultLdapContextFactory with JndiLdapContextFactory in ActiveDirectoryGroupRealm * [x] Update StringUtils import to org.apache.shiro.lang.util in LdapRealm * [x] Update LifecycleUtils import to org.apache.shiro.lang.util in AbstractShiroTest and ShiroAuthenticationServiceTest ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-6528 ### How should this be tested? 1. Build zeppelin-server module: ./mvnw compile -pl zeppelin-server -am -DskipTests 2. Run Shiro-related unit tests: ./mvnw test -pl zeppelin-server -Dtest="ShiroAuthenticationServiceTest,LdapRealmTest,LdapRealmDnInjectionTest,AnyOfRolesUserAuthorizationFilterTest" 3. Manually verify form login, LDAP authentication flows remain functional. ### Screenshots (if appropriate) N/A ### Questions: * Does the license files need to update? No * Is there breaking changes for older versions? No — API-level changes are confined to internal realm and test infrastructure classes. * Does this needs documentation? No -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
