What Is New in Apache Shiro 1.10
This release focuses on dependency upgrades, critical bug fixes, and internal cleanup to maintain stability. It's a maintenance update that keeps Shiro compatible with the latest libraries and frameworks.
| Category | Key Changes |
|---|---|
| Dependency Upgrades | Bumped versions for Ehcache, Hazelcast, Jedis, and Spring Framework. |
| Bug Fixes | Resolved issues with RememberMe services, CORS handling, and web.xml configuration. |
| Security | Patched a potential information disclosure vulnerability in the DefaultSubjectDAO. |
| Deprecations | Marked the legacy AbstractShiroFilter and its related configuration as deprecated. |
| Internal | Removed deprecated code and updated project infrastructure (Maven, Javadoc). |
Why did the dependency versions get updated?
The core driver for these updates was to ensure compatibility and resolve potential security vulnerabilities in older library versions. This is standard practice to keep the ecosystem secure and stable.
Key upgrades include Ehcache to 2.10.9.2, Hazelcast to 5.2.4, Jedis to 4.4.3, and Spring Framework to 5.3.27. In practice, this means your Shiro-integrated applications can work seamlessly with the latest patches from these projects without running into version conflict issues.
What security issues were addressed?
The main security fix patches an information disclosure flaw in the DefaultSubjectDAO. This class could potentially expose internal state via its toString() method, which might leak sensitive session or principal details in application logs.
This was fixed by overriding the toString() method to prevent accidental logging of sensitive data. It's a defensive change that matters because it reduces the risk of unintentionally exposing user identities in stack traces or debug logs.
Which deprecated features should I stop using?
The old AbstractShiroFilter and its related web.xml configuration style are now formally deprecated. The modern approach uses Shiro's Spring or Servlet container integration without needing web.xml entries.
If you're still configuring Shiro through web.xml, you should plan a migration. The newer methods are more flexible and align with contemporary Servlet-based application design patterns.
Were there any breaking changes in this release?
No, version 1.10 maintains full backward compatibility. The changes are primarily dependency bumps and internal cleanup that shouldn't affect your application's behavior.
The only noticeable difference might be if you were relying on the old DefaultSubjectDAO toString() behavior for debugging. That output is now sanitized, which is actually a improvement for production systems.
FAQ
Is the RememberMe service fix backward compatible?
Yes, the fix for the RememberMe service issue maintains full compatibility. It resolves a problem where the service wouldn't work correctly after a session timeout, but doesn't change the API or configuration.
Do I need to update my configuration for the CORS fix?
No, the CORS handling improvement works with existing configurations. It fixes an edge case where CORS headers weren't properly applied to Shiro-filtered requests.
What happens if I keep using the deprecated AbstractShiroFilter?
It will continue to work in 1.10, but you'll see deprecation warnings. You should migrate to the newer configuration style as the deprecated code will be removed in a future major release.
Were any caching backends significantly changed?
No, the Ehcache and Hazelcast updates are version bumps only. The APIs remain the same, so your existing cache configurations should work without modification.
Does this release require a specific Java version?
Shiro 1.10 maintains compatibility with Java 8 and above. The dependency updates don't introduce new Java version requirements.