Apache Wicket 8.18.0 released
The Apache Wicket PMC is proud to announce Apache Wicket 8.18.0!
Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0.
New and noteworthy
- CVE-2026-43646 crafted URLs can bypass PackageResourceGuard
- CVE-2026-42509 crafted strings can break out of the JavaScript sequence
- CVE-2026-40010 possible session fixation using AuthenticatedWebSession
Using this release
With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):
<dependency>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-core</artifactId>
<version>8.18.0</version>
</dependency>Or download and build the distribution yourself, or use our convenience binary package you can find here:
- Download: http://wicket.apache.org/start/wicket-8.x.html#manually
Upgrading from earlier versions
If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at
- http://s.apache.org/wicket8migrate
Have fun!
— The Wicket team
========================================================================
The signatures for the source release artefacts:
Signature for apache-wicket-8.18.0.zip:
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE0a6YZHC1pJw+aieyh48B+qjTVuEFAmoAjhcACgkQh48B+qjT
VuEl7w//VcFIS7l+cujEpGHwykz+oUDdzlKrUMWDdrgj3SH3/STXooqaTyyO0vu8
lwilX/ZWHPP1AIMa0xRZAUN3ZPXCuqpWS7boKvbqZieKH1oVpmfQhp1gDJ4yuv3M
wF1PkDqap2+qDJOiD/bJarkwJfHLp4q5nBCObHNNwEcHNFiltZKqrBrSypONu6jR
xr9u04SdoMVvDmqggG3VqXneILzw/YJdrl/PKYEgCJAU75gIxpEr4a/9L3LdIJK/
bmehgvf+zr6mXqXnE3x5bM/4SsrnxdLlwJcVUbSae8q5jBO6vM9a5a4t5ntBvelD
+DHvOR51C0iDqbZO/dKTmIas2T/fE9LtW7e24Vwsq7xDIuDL2h7tjY2C/x82JgvC
6OP9VTCpmBUGNxCLdvZ5v9gTuDkqrQr9wUHluppI0RhErI7y/QLMPfZS2mnWYHkS
GEiSGuidKLgUj0pgS95VIQmJrAY42eGP5X8fx6gXw9vEj+Oz0L8K4fZrnDgWo0QU
WvW442dzD9FVM5N1wbC5Md8MWaQ2mzqA4wb7FKDsZchNiARsyGjflkRc+xFXr4O8
d0OaUCEq96UnRtiFV2ZGjm12D/ICNiK2D3cfXAn0RBVa6JfhwTA1wbUVsVQQO49d
Gm6DYGBOre7RByWg5drtRSMsY5kq0YAsTXcphRBsgvqaN5mH3do=
=qjtY
-----END PGP SIGNATURE-----
Signature for apache-wicket-8.18.0.tar.gz:
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE0a6YZHC1pJw+aieyh48B+qjTVuEFAmoAjhcACgkQh48B+qjT
VuG2cw//bIhw0+osmE563g7XFeEmmWkbZSTsbuPU2k7gAQQdBsl/wxqV2layc1J/
GD2/Y2pUhgYmOn9+zv/duW1b86LcIHAeoJ1F7LsxtP10nbxRm4rhOE6oGTTyh6OO
zbR9IKi0I7IOEexVvdhA1nrn4mXXTqOfefwA22qh4TEsanraBpABXvWCsIBYsbND
ssPnlHOES+wOOxADvNu99Z5JnuEUyEpQwv5eaM3aCZCa+moJZ4Ex5jPg8jrUsIke
aWGHEyAGPdGash7Chsb5xs9bfmr8Q5jFMYerz2x68U/zQtF2WIHVcwB/qVpPzvxr
UA2I+bPOPworDLXlopZIsavEcL0ASgDVpimtWnZ753JQkiODhAWUtyFJhhNbgW5c
GJE9GBlbVdvvN/wfT3Jpqh9JuwUpX/47zGnpKNb76NB4IoZYb4/RJTRqmxDoePEp
b6WHklV5p0jaZ7vQpvxU1p+eNgNlEv02o2vHzoj62pKp50/w/OAlXhwdtvacedwM
z2O2CXQFiiv3Hqr9LKafBn2m/b4cj74mASmyWt/ZH1UDJtzgj5rJqYdRb/4hkHeC
MR5c0b8b3K9d+4tFOGY+bkl6xSc2vjX2T4yA4DGsUQvNrZ3ThrhB6WHgcyNycTjh
DF8M4iwiVu1p91zgp1SQ+mXMzvX+2FNs/EXSgeZ89WhRJkwdSdQ=
=UZ5J
-----END PGP SIGNATURE-----
========================================================================