Op ma 11 mrt 2024 om 13:37 schreef Francois Papon < [email protected]>:
> Most of the dependencies are linked to Shiro-core, this is why we didn't > add exclusion on this one: > > > https://github.com/apache/shiro/blob/36cad481dd1f58f7f0263981d7f4a61dd39dbd8c/bom/pom.xml#L36 > Yes, I noticed, but this still requires multiple dependencies in your project. For example, shiro-spring depends on shiro-web and shiro-core. To use shiro-spring with jakarta, you now need to add 3 dependencies, not just 1. This is the reason why we at Topicus decided to publish transformed artifacts under a different version, not with a classifier. Its very easy to manage the version of dependencies, without breaking the transitive dependencies. > For the shiro-lang javax dependencies, it's not normal, we missed it > (issue and PR are welcome). > Unfortunately I cannot create tickets on your Jira, even though I do have a valid Jira account (being a commiter on Apache Wicket). Shiro does not show up in the list of projects I can create issues on. I don't know why. A PR will be difficult as I do not know what this dependency is for and what resolution would be desired. > About the jakarta move, we are discussing about it and the next major > release will bring it without jakarta classifier. > That would be great. The world is moving on and many open source projects are already dropping support for JEE8. PS. It seems something went wrong with the dependency on commons-configuration2. It currently is a required dependency of shiro-core. Everything in the code seems to suggest this was supposed to be an optional dependency. Best regards, Emond
