3.0.0 available | Apache Shiro

-->

Fork me on GitHub

Simple. Java. Security.

3.0.0 available

Published by Lenny Primak on the<br>29th of June, 2026

The Apache Shiro team is pleased to announce the release of Apache Shiro version 3.0.0.

This release is available for download now.

Release Highlights

This is a new major release of Apache Shiro, with many new features and improvements, culminating more than two years of work.

JDK 17 is the new minimum baseline

Jakarta EE 9/10/11+ (no javax.* namespace)

Spring 6/7+ and SpringBoot 3/4+

Guice 7/8+

Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25+

Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)

Breaking API Changes

Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)

Security Enhancements

Case-insensitive path matching is now enabled by default (hardened by default)

Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)

Enable CORS preflight requests by default

End-of-life notice

Apache Shiro 1.x and 2.x are now considered end-of-life. If support for these versions is required, please check Commercial Support

Thank you to the following contributors!

Martin Geisse

Tim te Beek

Rui Ventura

Patrick (Gus) Heck

All changes

You can learn more on GitHub, Release 3.0.0.

Download

Download and verification instructions are available on our download page.

Documentation

For more information on Shiro, please read the documentation.

Enjoy!

The Apache Shiro Team