dependabot[bot] opened a new pull request, #2158: URL: https://github.com/apache/activemq/pull/2158
Bumps `shiro-version` from 2.2.1 to 3.0.0. Updates `org.apache.shiro:shiro-core` from 2.2.1 to 3.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/shiro/releases";>org.apache.shiro:shiro-core's releases</a>.</em></p> <blockquote> <h2>Apache Shiro 3.0.0</h2> <h2>Minimum runtime Requirements</h2> <ul> <li>JDK 17</li> <li>Jakarta EE 9/10/11+ (no javax.* namespace)</li> <li>Spring 6/7+ and SpringBoot 3/4+</li> <li>Guice 7/8+</li> </ul> <p>Breaking Changes:</p> <ul> <li>Made default implementation of <code>PrincipalCollection</code> immutable (<code>ImmutablePrincipalCollection</code>)</li> </ul> <p>Security improvements:</p> <ul> <li>Case-insensitive path matching is now enabled by default (hardened by default)</li> <li>Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)</li> <li><a href="https://redirect.github.com/apache/shiro/issues/2799";>#2799</a> enh: warn if realm authentication fails by <a href="https://github.com/lprimak";><code>@lprimak</code></a> in <a href="https://redirect.github.com/apache/shiro/pull/2798";>apache/shiro#2798</a></li> <li>Web RememberMe and Guice Enhancements by <a href="https://github.com/lprimak";><code>@lprimak</code></a> in <a href="https://redirect.github.com/apache/shiro/pull/2800";>apache/shiro#2800</a></li> <li>Enable CORS preflight requests by default</li> </ul> <p>Other Changes:</p> <ul> <li>Modernized Java code to JDK 17 baseline</li> <li>Added fluent API in <code>MergableAuthenticationInfo</code> class</li> <li>Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)</li> <li>Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values</li> <li>Using Java Scoped for Subject and SecurityManager instead of ThreadLocals on JDK 25+</li> <li>Separated out <code>ShiroFilterFactoryBeanPostProcessor</code> to fix post processing warnings in Spring</li> <li>Using AssertJ for testing</li> </ul> <p>Removals of deprecated artifacts</p> <ul> <li>Removed Shiro BOM - no longer necessary</li> <li>Removed EhCache module in favor of JCache</li> <li>Removed Hazelcast module in favor of JCache</li> <li>Removed deprecated <code>SimplePrincipalCollection</code> class</li> <li>Removed deprecated <code>RandomSessionIdGenerator</code> class</li> <li>Removed deprecated <code>HttpSessionContext</code> class</li> <li>Removed deprecated <code>JavaEnvironment</code> class</li> <li>Removed deprecated <code>XmlSerializer.java</code> class</li> <li>Removed <code>JakartaTransformer</code> class and it's <code>jakartify()</code> method</li> <li>Removed Spring/Boot <code>ShiroUrlPathHelper</code> class</li> <li>Removed Spring/Boot's remoting support</li> <li>Removed Spring/Boot deprecated <code>ShiroRequestMappingConfig</code> class</li> <li>Removed samples and tests associated with deprecated modules</li> </ul> <h2>Minimum build requirements</h2> <ul> <li>JDK 21 (JDK 25 required to release)</li> <li>Jakarta EE 11 (build-time default)</li> <li>Spring 7/SpringBoot 4 (build-time default)</li> <li>Guice 8 (build-time default)</li> </ul> <h2>What's Changed</h2> <ul> <li><a href="https://redirect.github.com/apache/shiro/issues/1584";>#1584</a> Merge 3.x branch into main by <a href="https://github.com/lprimak";><code>@lprimak</code></a> in <a href="https://redirect.github.com/apache/shiro/pull/2772";>apache/shiro#2772</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/shiro/blob/main/RELEASE-NOTES";>org.apache.shiro:shiro-core's changelog</a>.</em></p> <blockquote> <h1>Licensed to the Apache Software Foundation (ASF) under one</h1> <h1>or more contributor license agreements. See the NOTICE file</h1> <h1>distributed with this work for additional information</h1> <h1>regarding copyright ownership. The ASF licenses this file</h1> <h1>to you under the Apache License, Version 2.0 (the</h1> <h1>"License"); you may not use this file except in compliance</h1> <h1>with the License. You may obtain a copy of the License at</h1> <h1></h1> <h1><a href="http://www.apache.org/licenses/LICENSE-2.0";>http://www.apache.org/licenses/LICENSE-2.0</a></h1> <h1></h1> <h1>Unless required by applicable law or agreed to in writing,</h1> <h1>software distributed under the License is distributed on an</h1> <h1>"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY</h1> <h1>KIND, either express or implied. See the License for the</h1> <h1>specific language governing permissions and limitations</h1> <h1>under the License.</h1> <h4>DEPRECATED</h4> <p>Currently Apache Shiro uses GitHub releases for release notes, so this file is no longer being updated. It will be removed in a future release.</p> <h4>DEPRECATED</h4> <p>This is not an official release notes document. It exists for Shiro developers to jot down their notes while working in the source code. These notes will be combined with Jira’s auto-generated release notes during a release for the total set.</p> <p>###########################################################</p> <h1>2.0.0</h1> <p>###########################################################</p> <p>Improvement</p> <pre><code>[SHIRO-290] Implement bcrypt and argon2 KDF algorithms </code></pre> <h2>Backwards Incompatible Changes</h2> <ul> <li>Changed default DefaultPasswordService.java algorithm to "Argon2id".</li> <li>PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. It was never specified how this method would behave.</li> <li>Made salt non-nullable.</li> <li>Removed methods in PasswordMatcher.</li> </ul> <p>###########################################################</p> <h1>1.7.1</h1> <p>###########################################################</p> <p>Bug</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/shiro/commit/a0c53adc82dbd81536573230f7f1fd4237d90238";><code>a0c53ad</code></a> [maven-release-plugin] prepare release shiro-root-3.0.0</li> <li><a href="https://github.com/apache/shiro/commit/ffba65f7c9615497a6bb12e770d28e674a8cc7b6";><code>ffba65f</code></a> chore(deps): bump the maven-dependencies group with 2 updates (<a href="https://redirect.github.com/apache/shiro/issues/2803";>#2803</a>)</li> <li><a href="https://github.com/apache/shiro/commit/63ebb6cfce80acaa259e1594e4c47550398f208a";><code>63ebb6c</code></a> chore(deps): bump actions/checkout (<a href="https://redirect.github.com/apache/shiro/issues/2802";>#2802</a>)</li> <li><a href="https://github.com/apache/shiro/commit/e441ea37009a426b122c53b0120ae5879d00e354";><code>e441ea3</code></a> enh(web): rememberMe cookie expiration is checked on the server</li> <li><a href="https://github.com/apache/shiro/commit/42aa34467ad30f085fc8e003042db0c397fe8d57";><code>42aa344</code></a> bugfix(guice-web): now matching paths with trailing slash stripped</li> <li><a href="https://github.com/apache/shiro/commit/88568741eaed457e2b07f0908fd71e30f117ebc3";><code>8856874</code></a> chore: update Payara version and refactor port property names in configuratio...</li> <li><a href="https://github.com/apache/shiro/commit/c7dc2a4d0f205f34b950247e5b82e7de24f56263";><code>c7dc2a4</code></a> enh: warn if realm authentication fails due to system exceptions in multi-rea...</li> <li><a href="https://github.com/apache/shiro/commit/d08a84c3211d05c58b386d7145b3fb948c46ece8";><code>d08a84c</code></a> chore(deps-dev): bump com.flowlogix.depchain:integration-test (<a href="https://redirect.github.com/apache/shiro/issues/2796";>#2796</a>)</li> <li><a href="https://github.com/apache/shiro/commit/e45268bef27349e8de0687c25b262c3c7bb4d196";><code>e45268b</code></a> chore(dependabot): fix htmlunit major version pinning</li> <li><a href="https://github.com/apache/shiro/commit/da75880badf6f5ff425413f0777ebb0783753308";><code>da75880</code></a> chore(deps): bump the maven-dependencies group across 1 directory with 2 upda...</li> <li>Additional commits viewable in <a href="https://github.com/apache/shiro/compare/shiro-root-2.2.1...shiro-root-3.0.0";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.shiro:shiro-spring` from 2.2.1 to 3.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/shiro/releases";>org.apache.shiro:shiro-spring's releases</a>.</em></p> <blockquote> <h2>Apache Shiro 3.0.0</h2> <h2>Minimum runtime Requirements</h2> <ul> <li>JDK 17</li> <li>Jakarta EE 9/10/11+ (no javax.* namespace)</li> <li>Spring 6/7+ and SpringBoot 3/4+</li> <li>Guice 7/8+</li> </ul> <p>Breaking Changes:</p> <ul> <li>Made default implementation of <code>PrincipalCollection</code> immutable (<code>ImmutablePrincipalCollection</code>)</li> </ul> <p>Security improvements:</p> <ul> <li>Case-insensitive path matching is now enabled by default (hardened by default)</li> <li>Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)</li> <li><a href="https://redirect.github.com/apache/shiro/issues/2799";>#2799</a> enh: warn if realm authentication fails by <a href="https://github.com/lprimak";><code>@lprimak</code></a> in <a href="https://redirect.github.com/apache/shiro/pull/2798";>apache/shiro#2798</a></li> <li>Web RememberMe and Guice Enhancements by <a href="https://github.com/lprimak";><code>@lprimak</code></a> in <a href="https://redirect.github.com/apache/shiro/pull/2800";>apache/shiro#2800</a></li> <li>Enable CORS preflight requests by default</li> </ul> <p>Other Changes:</p> <ul> <li>Modernized Java code to JDK 17 baseline</li> <li>Added fluent API in <code>MergableAuthenticationInfo</code> class</li> <li>Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)</li> <li>Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values</li> <li>Using Java Scoped for Subject and SecurityManager instead of ThreadLocals on JDK 25+</li> <li>Separated out <code>ShiroFilterFactoryBeanPostProcessor</code> to fix post processing warnings in Spring</li> <li>Using AssertJ for testing</li> </ul> <p>Removals of deprecated artifacts</p> <ul> <li>Removed Shiro BOM - no longer necessary</li> <li>Removed EhCache module in favor of JCache</li> <li>Removed Hazelcast module in favor of JCache</li> <li>Removed deprecated <code>SimplePrincipalCollection</code> class</li> <li>Removed deprecated <code>RandomSessionIdGenerator</code> class</li> <li>Removed deprecated <code>HttpSessionContext</code> class</li> <li>Removed deprecated <code>JavaEnvironment</code> class</li> <li>Removed deprecated <code>XmlSerializer.java</code> class</li> <li>Removed <code>JakartaTransformer</code> class and it's <code>jakartify()</code> method</li> <li>Removed Spring/Boot <code>ShiroUrlPathHelper</code> class</li> <li>Removed Spring/Boot's remoting support</li> <li>Removed Spring/Boot deprecated <code>ShiroRequestMappingConfig</code> class</li> <li>Removed samples and tests associated with deprecated modules</li> </ul> <h2>Minimum build requirements</h2> <ul> <li>JDK 21 (JDK 25 required to release)</li> <li>Jakarta EE 11 (build-time default)</li> <li>Spring 7/SpringBoot 4 (build-time default)</li> <li>Guice 8 (build-time default)</li> </ul> <h2>What's Changed</h2> <ul> <li><a href="https://redirect.github.com/apache/shiro/issues/1584";>#1584</a> Merge 3.x branch into main by <a href="https://github.com/lprimak";><code>@lprimak</code></a> in <a href="https://redirect.github.com/apache/shiro/pull/2772";>apache/shiro#2772</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apache/shiro/compare/shiro-root-2.2.1...shiro-root-3.0.0";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information, visit: https://activemq.apache.org/contact
