org.apache.shiro:xxx:1.x versions not updated when using ...migrate.jakarta.JakartaEE10

[jepsar]

I ran

mvn -U org.openrewrite.maven:rewrite-maven-plugin:run \
    -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-migrate-java:RELEASE \
    -Drewrite.activeRecipes=org.openrewrite.java.migrate.jakarta.JakartaEE10

and found that the dependencies

    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-core</artifactId>
      <version>1.x</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-web</artifactId>
      <version>1.x</version>
    </dependency>

were not updated to the EE10 compatible version (you will need to add the classifier as well)

    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-core</artifactId>
      <version>2.0.2</version>
      <classifier>jakarta</classifier>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-web</artifactId>
      <version>2.0.2</version>
      <classifier>jakarta</classifier>
    </dependency>

CC @melloware

Shiro has several artifactIds which can probably all be bumped to the same version

https://shiro.apache.org/jakarta-ee.html

[jepsar]

@melloware let me do some further testing first please. Using <classifier>jakarta</classifier> is also an option here. I'll first see if 2.0.2 works without migrating the config for example.

[melloware]

ok let me know

[jepsar]

Strangely you will need to add the jakarta classifier, even on 2.x. I was not able to test my application yet (issue with EclipseLink), but at least it compiles now.

[melloware]

so should i bump to 2X with the jakarta classifier?

[jepsar]

I think that would be safe to do. As we discussed on Discord, maybe add the link https://shiro.apache.org/jakarta-ee.html in a comment. In my case some class was moved to a different package and dependency. So it's not a blind migration per se.

[melloware]

PR submitted

[melloware]

Usually we upgrade the dependencies and developers fix that last 5% of changes.