Hi,
You need to use the Shiro BOM to not have to deal with the exclusions:
https://github.com/apache/shiro/blob/main/bom/pom.xml
regards,
François
On 11/03/2024 11:01, Emond Papegaaij wrote:
Hi all,
Our application uses Jakarta EE 10. We've been using transformed
artifacts for Shiro 1.x and now I'm trying to migrate to 2.0.0. Shiro
2.0.0 seems to have pre-transformed jars for jakarta with a different
classifier. This does not work at all. All dependencies (both from
third party libraries and internal between shiro modules) still
reference the artifacts without the classifiers. For example,
org.apache.shiro:shiro-web:2.0.0:jakarta depends on
org.apache.shiro:shiro-core:2.0.0 (without the jakarta). This forces
us to add exclusions all over the place and at the same time add extra
dependencies for the modules that are now missing.
I've tried to submit a ticket for this in Jira, but somehow I'm not
able to. Shiro is not in the list of projects, even though I do have a
valid Jira account. Do you have any plans to provide proper Jakarta
support, preferably without any transformation?
Also, Shiro seems to use apache commons configuation2. This library
still depends on the javax servlet API, and it seems it does not yet
support Jakarta. I don't know what Shiro uses this library for, but it
might fail if deployed on a JEE9+ server.
Best regards,
Emond
