Pangram verdict · v3.3
We believe that this document is fully human-written
AI likelihood · overall
HumanArticle text · 171 words · 1 segments analyzed
Simple. Java. Security.
Published by Lenny Primak on the 29th of June, 2026
The Apache Shiro team is pleased to announce the release of Apache Shiro version 3.0.0.
This release is available for download now.
Release Highlights
This is a new major release of Apache Shiro, with many new features and improvements, culminating more than two years of work.
JDK 17 is the new minimum baseline
Jakarta EE 9/10/11+ (no javax.* namespace)
Spring 6/7+ and SpringBoot 3/4+
Guice 7/8+
Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25+
Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
Breaking API Changes
Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)
Security Enhancements
Case-insensitive path matching is now enabled by default (hardened by default)
Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
Enable CORS preflight requests by default
End-of-life notice
Apache Shiro 1.x and 2.x are now considered end-of-life. If support for these versions is required, please check Commercial Support
Documentation
Enjoy! The Apache Shiro Team