Apache Shiro 3.0.0 has been released, featuring JDK 17 as the minimum baseline, Jakarta EE support, and improved thread-safety. This major release marks the end-of-life for Shiro 1.x and 2.x.
# 3.0.0 available | Apache Shiro
Source: [https://shiro.apache.org/blog/2026/06/apache-shiro-300-released.html](https://shiro.apache.org/blog/2026/06/apache-shiro-300-released.html)
[](https://shiro.apache.org/index.html)Simple\. Java\. Security\.[](https://www.apache.org/events/current-event.html)
*Published by on the29th of June, 2026*
The Apache Shiro team is pleased to announce the release of Apache Shiro version 3\.0\.0\.
This release is available for download now\.
## Release Highlights
This is a new major release of Apache Shiro, with many new features and improvements, culminating more than two years of work\.
- JDK 17 is the new minimum baseline
- Jakarta EE 9/10/11\+ \(no javax\.\* namespace\)
- Spring 6/7\+ and SpringBoot 3/4\+
- Guice 7/8\+
- Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25\+
- Improved thread\-safety of Shiro\-native sessions \(SimpleSession, SimpleSessionFactory, CachingSessionDAO\)
## Breaking API Changes
- Made default implementation of PrincipalCollection immutable \(ImmutablePrincipalCollection\)
## Security Enhancements
- Case\-insensitive path matching is now enabled by default \(hardened by default\)
- Added NoAccessFilter and add it to the default filter chain \(breaking change, hardened\-by\-default\)
- Enable CORS preflight requests by default
## End\-of\-life notice
Apache Shiro 1\.x and 2\.x are now considered end\-of\-life\. If support for these versions is required, please check[Commercial Support](https://shiro.apache.org/commercial-support.html)
## Thank you to the following contributors\!
## All changes
## Download
## Documentation
Enjoy\!
The Apache Shiro Team
---
JDK 27 has been released as the Reference Implementation of Java SE Platform version 27, featuring updates like making G1 the default garbage collector and post-quantum hybrid key exchange for TLS 1.3.
Java 27 (JDK 27) is now generally available, featuring enhancements like making G1 the default garbage collector, post-quantum hybrid key exchange for TLS 1.3, and various preview features.
agent-shell 0.55 adds support for new AI agents like CodeBuddy, Hermes, and Kimi Code, emphasizing vendor-neutral ACP. The update also discusses ecosystem changes and calls for community support.