Shiro has a long-standing constraints about releases:
- Apache projects at least 3 PMV votes for a release
- Shiro follows (and and enforce) strict Semver-compliant releases.
What that means in practice is that once a major version is released, any minor version needs to be
both API and binary compatible with the major version. We don’t want to release a major version too early,
since if the API changes, we may need to bump the major version again.
For 3.x, we bumped the base JDK to 17, Jakarta EE to 11 (although 9/10 are still compatible) and SpringBoot to 4.x
Have you tried 3.0.0-alpha-1 yet?
On Apr 10, 2026, at 3:33 AM, Andreas Reichel <[email protected]> wrote:
Greetings Lenny and Team,
thank you so much for all your work and effort.
To us, Shiro is one of the great Whisps working endlessly in the background w/o ever been seen or acknowledged gratefully.
From my very personal opinion, I recommend just to release more often (w/o much voting) by increasing the minor version. We atmanticore-projects.comtake the latest minor version anyway and update the major versions only based on CVEs and or JDK requirements. Only when an issue was found we would roll back to the latest known working minor version.
In short: throw it into the cold water and let see if it swims. A 3.0 out, followed by fast 3.0.1 and 3.0.2 will work wonders. Blame me for any issues caused 😄
