Last checked and updated on April 15, 2026What Is New in Apache Shiro 3.0?
The first alpha release of Shiro 3.0 marks a major step forward, focusing on modernizing the codebase and APIs for future development. This release sets the foundation with crucial internal changes.
| Category | Key Changes |
|---|---|
| New Foundation | Requires Java 11+, updates to JUnit 5, and introduces a new shiro-lang module for core utilities. |
| API Modernization | Begins replacing legacy org.apache.shiro.util.* classes with new interfaces in the lang module. |
| Module Updates | New shiro-lang module; shiro-core and other modules now depend on it. |
| Deprecations | Initial deprecation of older util classes to guide migration towards the new APIs. |
Why the jump to Java 11 and JUnit 5?
Shiro 3.0 alpha requires Java 11 or higher and uses JUnit 5 for testing. This move drops support for older Java versions, allowing the framework to use modern language features and a more powerful testing toolkit. In practice, this means your applications need to run on a recent JVM. It also simplifies the project's build and test infrastructure moving forward.
What's the deal with the new 'shiro-lang' module?
A new shiro-lang module is introduced to contain core, reusable utilities and interfaces. This module now serves as a foundational dependency for shiro-core and others. The goal is to centralize common language-level abstractions, clean up the old util package, and provide a stable base for future enhancements. You'll see its types used as replacements for deprecated classes.
Which APIs are changing and how do I adapt?
The initial changes target the org.apache.shiro.util.* package. Classes like StringUtils, CollectionUtils, and ClassUtils are being deprecated in favor of new interfaces and implementations in the shiro-lang module. For now, check the compiler warnings. Start planning to update imports from org.apache.shiro.util to the new equivalents in org.apache.shiro.lang.util or similar as the APIs stabilize.
// Legacy import (now deprecated)
import org.apache.shiro.util.StringUtils;
// New import (from shiro-lang)
import org.apache.shiro.lang.util.StringUtils;Is this alpha release production-ready?
No, this is an alpha release. Its purpose is to expose the new direction and foundational changes for early feedback from the community. You should not use it in production environments. Treat it as a preview to understand the coming migration path and to test your existing code against the new baseline.
FAQ
Can I upgrade my existing Shiro 1.x application directly to 3.0 alpha?
No, a direct upgrade is not recommended. This alpha is a first look at breaking changes. You should wait for a stable release and plan for a significant migration, starting by testing your app against this alpha to identify issues.
What happened to the old 'util' package classes I use everywhere?
They are marked as deprecated in this release. The new shiro-lang module provides their replacements. The deprecation warnings will guide you to the new classes, but the old ones still work in this alpha to ease testing.
Why should I care about this alpha if it's not stable?
If you are a library maintainer or have a large Shiro-based application, testing now helps the project identify real-world issues. Your feedback shapes the final 3.0 APIs, which saves you pain later.
Are there any new security features in this alpha?
This particular release focuses on foundational and API changes, not new security capabilities. The main security impact is the requirement to run on a supported Java version (11+), which itself addresses potential vulnerabilities in older JVMs.
Where can I report issues or give feedback on these changes?
Use the Apache Shiro project's official issue tracker on GitHub. Provide details about your use case and any migration problems you encounter. This matters because community input is crucial for a smooth final release.