Re: [ANNOUNCE] Apache Wicket 8.18.0 released
Thank you for your words. Really appreciated. Andrea Del Bene. Apache Wicket committer. On Fri, 15 May 2026, 17:13 Mihir Chhaya, wrote: > Dear Apache Wicket Team, > > Thank you for making these releases available so quickly; the team is doing > amazing work. I truly appreciate the efficiency and speed with which these > updates are provided. > > Best regards, > > - Mihir > > > On Fri, May 15, 2026, 7:01 AM Andrea Del Bene wrote: > > > The Apache Wicket PMC is proud to announce Apache Wicket 8.18.0! > > > > Apache Wicket is an open source Java component oriented web application > > framework that powers thousands of web applications and web sites for > > governments, stores, universities, cities, banks, email providers, and > > more. You can find more about Apache Wicket at https://wicket.apache.org > > > > This release marks another minor release of Wicket 8. We > > use semantic versioning for the development of Wicket, and as such no > > API breaks are present in this release compared to 8.0.0. > > > > New and noteworthy > > -- > > * CVE-2026-43646 crafted URLs can bypass PackageResourceGuard > > * CVE-2026-42509 crafted strings can break out of the JavaScript > sequence > > * CVE-2026-40010 possible session fixation using AuthenticatedWebSession > > > > Using this release > > -- > > > > With Apache Maven update your dependency to (and don't forget to > > update any other dependencies on Wicket projects to the same version): > > > > > > org.apache.wicket > > wicket-core > > 8.18.0 > > > > > > Or download and build the distribution yourself, or use our > > convenience binary package you can find here: > > > > * Download: http://wicket.apache.org/start/wicket-8.x.html#manually > > > > Upgrading from earlier versions > > --- > > > > If you upgrade from 8.y.z this release is a drop in replacement. If > > you come from a version prior to 8.0.0, please read our Wicket 8 > > migration guide found at > > > > * http://s.apache.org/wicket8migrate > > > > Have fun! > > > > — The Wicket team > > > > > > > > > > CHANGELOG for 8.18.0: > > > > - > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > >
Re: [ANNOUNCE] Apache Wicket 8.18.0 released
Dear Apache Wicket Team, Thank you for making these releases available so quickly; the team is doing amazing work. I truly appreciate the efficiency and speed with which these updates are provided. Best regards, - Mihir On Fri, May 15, 2026, 7:01 AM Andrea Del Bene wrote: > The Apache Wicket PMC is proud to announce Apache Wicket 8.18.0! > > Apache Wicket is an open source Java component oriented web application > framework that powers thousands of web applications and web sites for > governments, stores, universities, cities, banks, email providers, and > more. You can find more about Apache Wicket at https://wicket.apache.org > > This release marks another minor release of Wicket 8. We > use semantic versioning for the development of Wicket, and as such no > API breaks are present in this release compared to 8.0.0. > > New and noteworthy > -- > * CVE-2026-43646 crafted URLs can bypass PackageResourceGuard > * CVE-2026-42509 crafted strings can break out of the JavaScript sequence > * CVE-2026-40010 possible session fixation using AuthenticatedWebSession > > Using this release > -- > > With Apache Maven update your dependency to (and don't forget to > update any other dependencies on Wicket projects to the same version): > > > org.apache.wicket > wicket-core > 8.18.0 > > > Or download and build the distribution yourself, or use our > convenience binary package you can find here: > > * Download: http://wicket.apache.org/start/wicket-8.x.html#manually > > Upgrading from earlier versions > --- > > If you upgrade from 8.y.z this release is a drop in replacement. If > you come from a version prior to 8.0.0, please read our Wicket 8 > migration guide found at > > * http://s.apache.org/wicket8migrate > > Have fun! > > — The Wicket team > > > > > CHANGELOG for 8.18.0: > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
[ANNOUNCE] Apache Wicket 8.18.0 released
The Apache Wicket PMC is proud to announce Apache Wicket 8.18.0! Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org This release marks another minor release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0. New and noteworthy -- * CVE-2026-43646 crafted URLs can bypass PackageResourceGuard * CVE-2026-42509 crafted strings can break out of the JavaScript sequence * CVE-2026-40010 possible session fixation using AuthenticatedWebSession Using this release -- With Apache Maven update your dependency to (and don't forget to update any other dependencies on Wicket projects to the same version): org.apache.wicket wicket-core 8.18.0 Or download and build the distribution yourself, or use our convenience binary package you can find here: * Download: http://wicket.apache.org/start/wicket-8.x.html#manually Upgrading from earlier versions --- If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at * http://s.apache.org/wicket8migrate Have fun! — The Wicket team CHANGELOG for 8.18.0: - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
