What Is New in Apache Shiro 1.12
This release focuses on dependency upgrades, security fixes, and a handful of improvements to keep the framework stable and modern. The table below summarizes the key changes.
| Category | Key Changes |
|---|---|
| Security Updates | Addresses CVE-2023 -34478 and CVE-2023-34479 related to SNI hostname verification. |
| Dependency Upgrades | Bumps critical dependencies like BouncyCastle, Jedis, Hazelcast, and various Jakarta specs. |
| Bug Fixes | Fixes for session timezone handling, Hazelcast serialization, and RememberMe cookie logic. |
| Improvements | Enhanced SLF4J usage, removal of deprecated code, and cleanup of test dependencies. |
| Deprecated/Removed | The shiro-spring-boot-starter module is now deprecated. |
Why are the security fixes for TLS/SNI important?
They patch vulnerabilities that could allow an attacker to bypass hostname verification during TLS handshakes. In practice, this matters if your Shiro-integrated application makes secure connections to external services. The fixes ensure the SNI extension is properly validated, closing a potential man-in-the-middle vector.
Details on the CVEs
The release addresses CVE-2023-34478 and CVE-2023-34479. These were in the BouncyCastle library, which Shiro uses for crypto operations. Upgrading the dependency to version 1.75 is the primary mitigation.
What dependencies were upgraded in Shiro 1.12?
Several core libraries were updated for security, compatibility, and to drop older versions. This is standard maintenance to keep your projects free of known bugs in transitive dependencies.
- BouncyCastle: Upgraded to 1.75 for the TLS/SNI fixes.
- Jedis: Updated to 5.1.0 for Redis session support.
- Hazelcast: Bumped to 5.3.5 for distributed caching.
- Jakarta Specifications: Updated Servlet API to 6.0.0 and JSTL to 3.0.0 for modern application server compatibility.
You'll also find updates to test scoped dependencies like JUnit and Mockito. This cleanup simplifies the build and reduces potential conflicts.
Which bugs were fixed in this version?
The fixes target session management and serialization edge cases that could cause runtime errors. They're the kind of issues you might hit under specific configurations.
Session and Cookie Handling
A fix corrects how session timestamps are converted when a timezone shift occurs, preventing invalid expiration calculations. Another fix ensures the RememberMe cookie's maxAge property is correctly set to a negative value for session-cookie behavior, aligning with Servlet specs.
Serialization Issues
For teams using Hazelcast for distributed sessions, a serialization problem with the SimpleSession class was resolved. This prevents ClassCastException errors when sessions are stored across the cluster.
Is the Shiro Spring Boot starter still supported?
No, the shiro-spring-boot-starter module is now officially deprecated. The community-maintained starter was moved into the Shiro codebase in a previous release but hasn't seen active upkeep.
In practice, this means you should look for alternative Spring Boot integration methods or be prepared to maintain the configuration yourself. The module will likely be removed in a future major release. Check the release notes for the exact deprecation warning.
FAQ
Should I upgrade to Shiro 1.12 immediately?
Yes, primarily for the BouncyCastle security fixes if your application handles TLS connections. For others, it's a recommended maintenance upgrade for newer dependencies and minor bug fixes.
What's the impact of the Hazelcast serialization fix?
If you use Hazelcast (HazelcastSessionDAO) for distributed HTTP sessions, upgrading prevents potential ClassCastException errors during session deserialization, which would cause login failures.
Does the Jakarta Servlet 6.0 update break compatibility with Tomcat 9?
Potentially. Tomcat 10+ implements Jakarta Servlet 6.0. If you're on Tomcat 9 (which uses Java EE), you may need to stick with Shiro 1.11 or ensure your deployment includes the appropriate compatibility libraries.
I use the Shiro Spring Boot starter. What now?
Start planning to migrate away from it. Look at community alternatives or implement Shiro configuration directly in your Spring Boot application. The deprecated starter won't receive new features or fixes.
Are there any behavioral changes in session timeout handling?
Yes, but only for edge cases. The fix for session timezone conversion ensures expiration calculations are accurate across servers with different system time settings. Most users won't notice a difference.