Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 9, 2026

Bumps com.mikuac:shiro from 2.5.0 to 2.5.2.

Release notes

Sourced from com.mikuac:shiro's releases.

Shiro v2.5.2

改进

修复了在 bot 上报消息时,拦截器 BotMessageEventInterceptor 无法拦截 bot 自身发送消息的问题。新增默认的 bot 自身消息过滤机制:默认情况下将拦截并过滤 bot 发送的消息,除非开发者在 senders 中显式指定了对应的 bot ID,才会取消该过滤行为。调整构建配置 build.gradle.kts,在打包为 JAR 文件时添加 Manifest 属性(包含项目名称与项目版本),支持在运行时获取 Shiro 框架自身版本信息,用于数据展示或其他业务处理场景。#363 @​FlanChanXwO

Shiro v2.5.1

变化

Spring Boot 3.x → 4.x

升级建议:

  • 强烈建议执行完整的集成测试和回归测试
  • 确认所使用的第三方依赖已明确支持 Spring Boot 4

不保证与 Spring Boot 3.x 的运行时兼容性。

Jackson 2.x → 3.x

改进

  • 重构 PayloadSender 并发实现
  • 使用 CompletableFuture 替代 Lock / Condition,降低复杂度
  • 引入按 Session 粒度的锁机制,减少锁竞争并提升并发稳定性

修复

  • 在连接关闭时正确清理 SESSION_LOCKS,避免 Session 级资源泄漏
  • 在回调处理逻辑中增加 finally 清理逻辑,防止 callback map 内存泄漏
  • 提升并发异常场景下的资源释放可靠性
Commits
  • 249af83 🔖 RELEASE v2.5.2
  • ed82b4b ✨ Fix interceptor not capturing bot self-sent messages and add defau...
  • 722b2e7 🔖 RELEASE v2.5.1
  • d998643 ⬆️ Bump org.junit.jupiter:junit-jupiter from 6.0.1 to 6.0.2
  • eaaa03c 🚨 Fix linter warnings
  • 058532a ♻️ Use CompletableFuture instead of Lock/Condition in PayloadSender
  • fd6fadc 🐛 Add cleanup for SESSION_LOCKS when connection closes
  • ef83c4e 🐛 Add finally block to clean up callback map and prevent memory leaks
  • 07ce8c7 ♻️ Improve concurrency with per-session locks in PayloadSender
  • b0677a4 ⬆️ Bump org.apache.maven:maven-resolver-provider
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [com.mikuac:shiro](https://github.com/MisakaTAT/Shiro) from 2.5.0 to 2.5.2.
- [Release notes](https://github.com/MisakaTAT/Shiro/releases)
- [Commits](MisakaTAT/Shiro@v2.5.0...v2.5.2)

---
updated-dependencies:
- dependency-name: com.mikuac:shiro
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jan 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant