The Apache Wicket PMC is proud to announce Apache Wicket 10.11.0!
Apache Wicket is an open source Java component oriented web application
framework that powers thousands of web applications and web sites for
governments, stores, universities, cities, banks, email providers, and
more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor release of Wicket 10. We
use semantic versioning for the development of Wicket, and as such no
API breaks are present in this release compared to 10.0.0.
New and noteworthy
------------------
This release fixes the following CVE:
* CVE-2026-70449 Path traversal in resource style/variation/locale
* CVE-2026-71257 Configured file upload limits are not enforced when
the multipart request has already been parsed
* CVE-2026-71378 Cross-Site Request Forgery (CSRF) protection bypass
in ResourceIsolationRequestCycleListener
* CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via
IChoiceRenderer and defaultNullLabel
* CVE-2026-76982 XSS in Button via its model object
* CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
* CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
* CVE-2026-76985 XSS in Palette via getAdditionalAttributes
* CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
Using this release
------------------
With Apache Maven update your dependency to (and don't forget to
update any other dependencies on Wicket projects to the same version):
<dependency>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-core</artifactId>
<version>10.11.0</version>
</dependency>
Or download and build the distribution yourself, or use our
convenience binary package you can find here:
* Download: http://wicket.apache.org/start/wicket-10.x.html#manually
Upgrading from earlier versions
-------------------------------
If you upgrade from 10.y.z this release is a drop in replacement. If
you come from a version prior to 10.0.0, please read our Wicket 10
migration guide found at
* http://s.apache.org/wicket10migrate
Have fun!
— The Wicket team
========================================================================
CHANGELOG for 10.11.0:
** New Feature
* [WICKET-7196] - Allow unescaped wicket:label tags
** Improvement
* [WICKET-7192] - restrict SourcesPage to resources of the page's
own package
* [WICKET-7195] - Add tag type="search" to those supported by TextField
** Task
* [WICKET-7193] - Deprecate and remove IAuthenticationStrategy
