The guice project follows a relaxed* form of semantic versioning in its package exports. So while the bundle version increases on each major release: 2, 3, 4 the exported package version only increases the minor segment: 1.2, 1.3, 1.4 to reflect that the API is still binary compatible - albeit with additional features.
(* relaxed because the same version is applied to all packages in the bundle)
This means that shiro-guice fails to resolve against the official guice bundle, because guice 3 is exporting com.google.inject with a version "1.3", but shiro-guice is importing com.google.inject with a range of "[3, 4)"
Solution is to either remove the version range on the import, or widen it to something like "1.3" (ie. provide a lower bound, but not an upper bound).