From 5c681c4007a1121a3d1e1b86e98eed0647f3d403 Mon Sep 17 00:00:00 2001
From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:20:39 -0400
Subject: [PATCH] fix(deps): pin Shiro to Java 8-compatible line (1.13.0)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switches all org.apache.shiro:shiro-* artifacts from the 2.x line to
1.13.0, the last Java 1.8 compatible release (1.x is EOL but the
2.0.0 release dropped Java 8 support). 1.13.0 ships Java 8 bytecode
(major version 52) and the shiro.* API surface is unchanged for the
ways this project uses it (web auth + JEE filter chain).

Why not just one direct version pin?
  - 1.13.0 also pulls in shiro-cache and shiro-crypto-core transitively
    from shiro-core, and the spring/config/lang/crypto/event artifacts
    each have their own release line. Pinning shiro-core in
    dependencyManagement is not enough on its own; some modules
    resolved 2.1.0 for transitive artifacts (e.g. shiro-lang in
    shindig-uber) before this fix. The 9 dependencyManagement entries
    + the shiro.version property pin the whole shiro-* family in
    lockstep.

Touched files (artifact ID / version only, no code changes):
  - pom.xml (root):
      + <shiro.version>1.13.0</shiro.version> in <properties>
      + 9 <dependencyManagement> entries: shiro-core, shiro-web,
        shiro-spring, shiro-lang, shiro-event, shiro-config-core,
        shiro-config-ogdl, shiro-crypto-hash, shiro-crypto-cipher
  - modules/shindig-uber/pom.xml:
      ~ <version>2.1.0</version> -> <version>${shiro.version}</version>
        on the only direct shiro-web declaration

Verification:
  - ./mvn-env.sh clean install -DskipTests: BUILD SUCCESS (3:56)
  - javap -v on every resolved shiro-*-1.13.0.jar: major version 52
    (covers shiro-core, shiro-web, shiro-spring, shiro-lang,
     shiro-event, shiro-config-core, shiro-config-ogdl,
     shiro-crypto-hash, shiro-crypto-cipher, shiro-cache,
     shiro-crypto-core — 11 jars, all Java 8 bytecode)
  - No UnsupportedClassVersionError in the build log

Dependabot:
  - org.apache.shiro* and org.apache.shiro:* are already in the
    .github/dependabot.yml full-ignore list (added before #75), so
    this won't get auto-bumped to 2.x in the future.

Notes:
  - The maven-shade-plugin exclusions on shiro-web and shiro-core in
    modules/shindig-uber/pom.xml are kept as-is. They exclude these
    two jars from the shaded uber-jar; that decision predates this
    PR and is independent of the bytecode-version fix. Re-evaluating
    whether to shade them in is a separate conversation.
  - This is the second half of the bytecode-mismatch bug originally
    tracked in #74. BouncyCastle half was fixed by #77.

Fixes #78

> Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
---
 modules/shindig-uber/pom.xml |  2 +-
 pom.xml                      | 47 ++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/modules/shindig-uber/pom.xml b/modules/shindig-uber/pom.xml
index 2484980024..c8f42f299a 100644
--- a/modules/shindig-uber/pom.xml
+++ b/modules/shindig-uber/pom.xml
@@ -171,7 +171,7 @@
         <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-web</artifactId>
-            <version>2.1.0</version>
+            <version>${shiro.version}</version>
             <scope>compile</scope>
         </dependency>
         <dependency>
diff --git a/pom.xml b/pom.xml
index ecbdd3458e..3b29b559d9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -191,6 +191,7 @@
         <saxon.version>6.5.3</saxon.version>
         <servlet.spec>4.0.1</servlet.spec>
         <shindig.version>1.1-BETA5-incubating</shindig.version>
+        <shiro.version>1.13.0</shiro.version>
         <simplexml.version>2.7.1</simplexml.version>
         <sitemap4j.version>1.1.2</sitemap4j.version>
         <skipITs>true</skipITs>
@@ -1223,6 +1224,52 @@
                 <artifactId>poi-ooxml-schemas</artifactId>
                 <version>${poi.version}</version>
             </dependency>
+            <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-core -->
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-core</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-web</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-spring</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-lang</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-event</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-config-core</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-config-ogdl</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-crypto-hash</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.shiro</groupId>
+                <artifactId>shiro-crypto-cipher</artifactId>
+                <version>${shiro.version}</version>
+            </dependency>
             <!-- https://mvnrepository.com/artifact/commons-betwixt/commons-betwixt -->
             <dependency>
                 <groupId>commons-betwixt</groupId>