Apache Shiro 3.0.0 has been released, featuring JDK 17 as the minimum baseline, Jakarta EE support, and improved thread-safety. This major release marks the end-of-life for Shiro 1.x and 2.x.
# 3.0.0 available | Apache Shiro
Source: [https://shiro.apache.org/blog/2026/06/apache-shiro-300-released.html](https://shiro.apache.org/blog/2026/06/apache-shiro-300-released.html)
[](https://shiro.apache.org/index.html)Simple\. Java\. Security\.[](https://www.apache.org/events/current-event.html)
*Published by on the29th of June, 2026*
The Apache Shiro team is pleased to announce the release of Apache Shiro version 3\.0\.0\.
This release is available for download now\.
## Release Highlights
This is a new major release of Apache Shiro, with many new features and improvements, culminating more than two years of work\.
- JDK 17 is the new minimum baseline
- Jakarta EE 9/10/11\+ \(no javax\.\* namespace\)
- Spring 6/7\+ and SpringBoot 3/4\+
- Guice 7/8\+
- Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25\+
- Improved thread\-safety of Shiro\-native sessions \(SimpleSession, SimpleSessionFactory, CachingSessionDAO\)
## Breaking API Changes
- Made default implementation of PrincipalCollection immutable \(ImmutablePrincipalCollection\)
## Security Enhancements
- Case\-insensitive path matching is now enabled by default \(hardened by default\)
- Added NoAccessFilter and add it to the default filter chain \(breaking change, hardened\-by\-default\)
- Enable CORS preflight requests by default
## End\-of\-life notice
Apache Shiro 1\.x and 2\.x are now considered end\-of\-life\. If support for these versions is required, please check[Commercial Support](https://shiro.apache.org/commercial-support.html)
## Thank you to the following contributors\!
## All changes
## Download
## Documentation
Enjoy\!
The Apache Shiro Team
---
agent-shell 0.55 adds support for new AI agents like CodeBuddy, Hermes, and Kimi Code, emphasizing vendor-neutral ACP. The update also discusses ecosystem changes and calls for community support.
agent-shell 0.63 adds support for new AI agents (Oh My Pi, Grok Build) and improvements like preferred agent config, custom markdown renderers, and activity grouping for less chatty output.
Sentinel v0.3.0 is released, an out-of-band AI Agent security framework featuring Shield Sidecar, deterministic shadow sandbox, Red Team Engine with 34 vectors, and EU AI Act compliance reports.
Stalwart v0.16 is a major release featuring a complete architectural rebuild with a new WebUI, unified JMAP-based management replacing REST API, external OIDC authentication support, and a new CLI tool for administration and infrastructure-as-code workflows.