Apache Wicket 8.19.0 released

30 Aug 2026

The Apache Wicket PMC is proud to announce Apache Wicket 8.19.0!

Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org

This release marks another minor release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0.

New and noteworthy

This release fixes the following CVE:

  • CVE-2026-70449 Path traversal in resource style/variation/locale
  • CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
  • CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
  • CVE-2026-76982 XSS in Button via its model object
  • CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
  • CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
  • CVE-2026-76985 XSS in Palette via getAdditionalAttributes
  • CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.19.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

  • Download: http://wicket.apache.org/start/wicket-8.x.html#manually

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at

  • http://s.apache.org/wicket8migrate

Have fun!

— The Wicket team

========================================================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.19.0.zip:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE0a6YZHC1pJw+aieyh48B+qjTVuEFAmqMMPcACgkQh48B+qjT
VuFTog/8CX/sJw1hcXQpF07qwgqHkViAOLkZP+PL73wy/tyk9O+QrogD0BjCzaRX
x1Ow7Y1epIteKPGJDFcCA6JZcfzt2z+hOdU8pUlDioPihgerhhiSGPlTIoFUKdbV
Rzpdn9n3N/nUlXMhi0fP+lB5aX+aLFDkpeoXLiuCpyY6AaHaPqT6i+8SOesGH/XB
QDtCytaeiPhDyvieeGfh82uycigieM0575ICXlnf2fel0jV0N3LknU4TGNwLDsUG
LKSytfNSEhbGwmgE6GjVxWC9FhF3T3kGnpxIY+rftumIqYBEpXLRRe6lmh2lnAIp
Uum38G/UiA6unuzsIqv8GXLypWmlM8Ug4aJ0R09+5Ahm3MVnZOgWIAc0/yragGWm
9JHUiefOS1N6ca/nv1cX8BSVHnacl6hOmzNNYbQfEIAbRGsF9ZwZMiSHDzI5dNki
7MYXyk0NCuIH/Whf1kuSMWzalcvLyD0kS4lLHmpyhbiSPHSG0LmU/T+Sg7oAtF44
m7xbt67qs6dy7usoVpSJ5HesYuOFPGZXON8ddt130n+We+EQp4NXNF/dwxqH5p1Q
LIS47/moeoHfe8MEtH/UZQQjuQLZfZnNDFQlnaKxe24fV6AGDl2oawVzgoXAzePM
Cjsp/WTS05tZj3QYert/l1oeovsOnvc8shJUU0kDooevyb0oNXA=
=TAPz
-----END PGP SIGNATURE-----

Signature for apache-wicket-8.19.0.tar.gz:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE0a6YZHC1pJw+aieyh48B+qjTVuEFAmqMMPcACgkQh48B+qjT
VuEqpxAAsfL8KdYP3mnQHdHZH+dVahvWQOJJdKx+P7/cY3af7Sp/7Eg6UvSrRnen
j2gvr8i4pQbebFIwS1PFjVwsYnCBLSsOT33BX06pHIbgcEFkYMbTXrzPde4potuy
w0u92GxOAUvJmAfFeL9bo/46yFcg++DZ3fXQz5B2mGyKEmXIn8WyoyhtGXdw0XpR
PMk1EXCvKpfW2Zp7CLTd2Q712DDRDAhhjJ3XqZDYmgi+QVovZyNBKRhSzHi9JWqX
Sq2JqJYTuN7/MpxiU5Ccp//qnDuLED8NwQ5U3rlEwVKvgAJQpEURCpGXOceEv8R7
i/UBXRWfY3dxKaJ50N2UKVWTYPzal/3tzlOE0tyik5bJZi8ZiNBOH5RXColpPtuK
gNtAqSFIXmma5iAM+KqceCL1euVuTxyiwUh1y59jbh5uWSqPio8gIA8cofuGk1Nq
HkO/J+9mGKU6HKnFiHvma6pcLgS7YbkiejLA9vph0fk5Lr0sJha7wP11KIcZ/AfT
sQHNOyEbehzYOJDs7CAo6YWvV0D53LezCaJ04NwrRX9/6ooAXLJdNcX8aB9k6Qc3
QeNLL6fpAGxKsGG6ZRBXwNOpse73fvcsebHCCjytaVzhskwtoujdqSINimWzKHON
N9pZFDkCLSpCU1RYKo1Zo78TO7FW/+/AtDD5GO8A6gajQx/n0ls=
=jPYU
-----END PGP SIGNATURE-----

========================================================================

This Release

CHANGELOG for 8.19.0:

Task
  • [WICKET-7193] - Deprecate and remove IAuthenticationStrategy