Aias00 opened a new issue, #6607:
URL: https://github.com/apache/shenyu/issues/6607
## Description
All three `@Deprecated` ("do not use … for authentication with raw
passwords"). The impl still calls the mapper directly. `PasswordHashService` is
the replacement but the raw-password entry point remains on a public service
interface with no removal version.
## Location
```
shenyu-admin/.../mapper/DashboardUserMapper.java:69
.../service/DashboardUserService.java:91
.../service/impl/DashboardUserServiceImpl.java:266
```
## Impact
Misleading API surface; security-sensitive deprecation without removal
target.
## Suggested fix
Set a removal version; gate the impl to delegate to `PasswordHashService`;
or remove the public method.
## Related existing issue(s)
Adjacent to #5255/#4602 (closed password-security tasks) but this is the
lingering deprecated public surface.
_Identified during the 2026-08-02 audit; full list in
[`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
