[deps] Pin Shiro to Java 8-compatible line (org.apache.shiro:shiro-* 2.1.0 -> 1.13.0)

[natechadwick-intsof]

Summary

The root pom.xml declares <jdk>1.8</jdk> / <java.source>1.8</java.source>, but the Shiro artifacts in modules/shindig-uber/pom.xml resolve to version 2.1.0, which is Java 11 bytecode (major version 55). Shiro 2.0+ requires Java 11; the highest Java 1.8 compatible line is 1.13.0 (major version 52).

This is the second half of the bytecode-mismatch bug originally tracked in #74. The BouncyCastle half was fixed by #77 (migrated to the bc*-jdk15to18 artifact line). This issue tracks the Shiro half, which is a clean version pin.

Affected artifacts

GAV	Current	Highest Java 1.8 compatible	Bytecode gap
org.apache.shiro:shiro-core	2.1.0 (major 55 = Java 11)	1.13.0 (major 52 = Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-web	2.1.0 (Java 11)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-spring	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-config-core	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-config-ogdl	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-lang	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-crypto-hash	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-crypto-cipher	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11
org.apache.shiro:shiro-event	(transitive)	1.13.0 (Java 8)	2.0+ = Java 11

Direct declaration

modules/shindig-uber/pom.xml declares org.apache.shiro:shiro-web directly at 2.1.0 (no property indirection). The other shiro-* artifacts come in transitively.

How to verify

JAR=~/.m2/repository/org/apache/shiro/shiro-core/2.1.0/shiro-core-2.1.0.jar
/usr/lib/jvm/java-8-openjdk/bin/javap -v -classpath "$JAR" $(unzip -l "$JAR" | awk '/\.class$/ {print $4; exit}' | sed 's|/|.|g; s|\.class$||') | grep 'major version'
# Expected (current):   major version: 55
# Expected (target):    major version: 52

Proposed fix

Two options:

Option A (minimal — matches #75's approach)

Add a <shiro.version> property to the root pom.xml at 1.13.0 and add the corresponding <dependencyManagement> entries for all shiro-* artifacts that flow in transitively. Then update modules/shindig-uber/pom.xml to use <version>${shiro.version}</version> instead of the hard-coded 2.1.0.

Option B (also acceptable)

Just update the one direct declaration in modules/shindig-uber/pom.xml from 2.1.0 to 1.13.0 and rely on Maven's nearest-version rule to pin the transitive Shiro artifacts to 1.13.0 as well. Smaller diff, but less explicit and the transitive shiro-* are still Java 11 bytecode unless an exclusion is added.

Acceptance criteria

• shiro-core, shiro-web, and any transitive shiro-* artifacts resolve at 1.13.0 or earlier
• ./mvn-env.sh clean install -DskipTests succeeds on a Java 1.8 JDK with no UnsupportedClassVersionError
• javap -v on the resolved shiro-core-1.13.0.jar reports major version: 52 (Java 8 bytecode)
• A full ./mvn-env.sh clean install -DskipTests still passes

Dependabot

org.apache.shiro* and org.apache.shiro:* are already in the .github/dependabot.yml full-ignore list (from before #75) so this won't get auto-bumped to 2.x in the future.

Out of scope

• The deeper question of whether the project should move to Java 11+ (parent epic [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73)
• BouncyCastle fix (already done in fix(deps): migrate BouncyCastle from bc*-jdk18on to bc*-jdk15to18 1.85 #77)

References

• Original bug: [bug] bouncycastle 1.83 and shiro 2.1.0 are Java 11 bytecode in a pom that targets Java 1.8 #74 (closed as superseded by fix(deps): migrate BouncyCastle from bc*-jdk18on to bc*-jdk15to18 1.85 #77 for the BC half)
• BC fix: fix(deps): migrate BouncyCastle from bc*-jdk18on to bc*-jdk15to18 1.85 #77 (closed as superseded)
• PR fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75 (closed as superseded; first attempt at pinning both BC and Shiro, before the BC-side was reworked into fix(deps): migrate BouncyCastle from bc*-jdk18on to bc*-jdk15to18 1.85 #77)
• Shiro 2.0 release notes: https://shiro.apache.org/news.html — 2.0 is the first version that requires Java 11

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.

[natechadwick-intsof]

Fixed by #80. Pin via <shiro.version>1.13.0\</shiro.version> in the root pom (matching the pattern from #77) plus 9 dependencyManagement entries so transitive shiro-* artifacts (incl. shiro-cache, shiro-crypto-core, shiro-lang) all land on 1.13.0 in lockstep. ./mvn-env.sh clean install -DskipTests passes on Java 1.8 in 3:56, every resolved shiro-*-1.13.0.jar reports major version 52, and no UnsupportedClassVersionError shows up in the build log. Dependabot already ignores org.apache.shiro* so this won't auto-bump to 2.x in the future. Closing as fixed.

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.