The Apache Shiro team is pleased to announce the release of Apache Shiro 3.0.2.
Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. It can be used to secure any application, from the command line to mobile apps to large web and enterprise applications. This is a maintenance release that includes security fixes, a new feature, improvements, and bug fixes. All users are encouraged to upgrade. Highlights: * Form data can now be saved and replayed without requiring a sign-in page * Superclass and interface annotation processing is harmonized across integrations * Default settings of ShiroFilterFactoryBean and NoAccessFilter are aligned with other components * Support for Spring Boot 4.2+ * Several bug fixes in Spring configuration, permission handling, and Faces form replay * Many more security fixes Release notes: https://github.com/apache/shiro/releases/tag/shiro-root-3.0.2 Blog post: https://shiro.apache.org/blog/2026/11/apache-shiro-302-released.html Download: https://shiro.apache.org/download.html Migration guide: https://shiro.apache.org/migration-guide.html Maven artifacts are available on Maven Central under the group ID org.apache.shiro. Thanks to everyone who contributed to this release. Regards, Lenny Primak Apache Shiro PMC
