This is an automated email from the ASF dual-hosted git repository.
bitstorm pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/wicket-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new ffffc18c Added announce for 9.23.0
ffffc18c is described below
commit ffffc18c23c63e7d3b0199996d453b643e90b668
Author: Andrea Del Bene <[email protected]>
AuthorDate: Wed May 13 18:12:38 2026 +0200
Added announce for 9.23.0
---
2026/_posts/2026-05-13-wicket-9.23.0-released.md | 70 ++++++
_config.yml | 4 +-
content/archetype-catalog.xml | 8 +-
content/atom.xml | 156 +++++++-------
content/feed.xml | 138 ++++++------
content/index.html | 51 +++--
content/learn/index.html | 6 +-
.../news/2026/05/13/wicket-9.23.0-released.html | 234 +++++++++++++++++++++
content/news/2026/05/index.html | 11 +
content/news/index.html | 7 +
content/start/download.html | 2 +-
content/start/quickstart.html | 4 +-
content/start/wicket-9.x.html | 30 +--
13 files changed, 525 insertions(+), 196 deletions(-)
diff --git a/2026/_posts/2026-05-13-wicket-9.23.0-released.md
b/2026/_posts/2026-05-13-wicket-9.23.0-released.md
new file mode 100644
index 00000000..d670cbb3
--- /dev/null
+++ b/2026/_posts/2026-05-13-wicket-9.23.0-released.md
@@ -0,0 +1,70 @@
+---
+layout: post
+title: Apache Wicket 9.23.0 released
+---
+The Apache Wicket PMC is proud to announce Apache Wicket 9.23.0!
+
+Apache Wicket is an open source Java component oriented web application
+framework that powers thousands of web applications and web sites for
+governments, stores, universities, cities, banks, email providers, and
+more. You can find more about Apache Wicket at https://wicket.apache.org
+
+This release marks another minor release of Wicket 9. We
+use semantic versioning for the development of Wicket, and as such no
+API breaks are present in this release compared to 9.0.0.
+
+New and noteworthy
+------------------
+
+This release fixes the following security issue:
+
+ * CVE-2026-43646 crafted URLs can bypass PackageResourceGuard
+ * CVE-2026-42509 crafted strings can break out of the JavaScript sequence
+ * CVE-2026-40010 possible session fixation using AuthenticatedWebSession
+ * CVE-2026-43975 Possible malicious path traversal in FolderUploadsFileManager
+
+Using this release
+------------------
+
+With Apache Maven update your dependency to (and don't forget to
+update any other dependencies on Wicket projects to the same version):
+
+{% highlight xml%}
+<dependency>
+ <groupId>org.apache.wicket</groupId>
+ <artifactId>wicket-core</artifactId>
+ <version>9.23.0</version>
+</dependency>
+{% endhighlight%}
+
+Or download and build the distribution yourself, or use our
+convenience binary package you can find here:
+
+ * Download: http://wicket.apache.org/start/wicket-9.x.html#manually
+
+<!--more-->
+
+Upgrading from earlier versions
+-------------------------------
+
+If you upgrade from 9.y.z this release is a drop in replacement. If
+you come from a version prior to 9.0.0, please read our Wicket 9
+migration guide found at
+
+ * http://s.apache.org/wicket9migrate
+
+Have fun!
+
+— The Wicket team
+
+
+========================================================================
+
+### This Release
+
+#### CHANGELOG for 9.23.0:
+
+##### Bug
+
+ * [WICKET-7174] - DefaultSecureRandomSupplier does not work for FIPS
+
diff --git a/_config.yml b/_config.yml
index 0764fb6b..0e79a70b 100644
--- a/_config.yml
+++ b/_config.yml
@@ -16,7 +16,7 @@ sass:
sass_dir: _sass
wicket:
version: 10.9.0
- version_90: 9.22.0
+ version_90: 9.23.0
version_10: 10.9.0
version_80: 8.17.0
version_70: 7.18.0
@@ -25,7 +25,7 @@ wicket:
version_14: 1.4.23
version_13: 1.3.7
released: 2026-05-5
- versions: [6.30.0, 1.5.16, 1.4.23, 7.18.0, 8.17.0, 9.22.0, 10.9.0,
1.5-SNAPSHOT, 6.31.0-SNAPSHOT, 7.19.0-SNAPSHOT, 8.18.0-SNAPSHOT,
9.23.0-SNAPSHOT, 10.10.0-SNAPSHOT]
+ versions: [6.30.0, 1.5.16, 1.4.23, 7.18.0, 8.17.0, 9.23.0, 10.9.0,
1.5-SNAPSHOT, 6.31.0-SNAPSHOT, 7.19.0-SNAPSHOT, 8.18.0-SNAPSHOT,
9.24.0-SNAPSHOT, 10.10.0-SNAPSHOT]
live_examples_url: http://examples10x.wicket.apache.org/
diff --git a/content/archetype-catalog.xml b/content/archetype-catalog.xml
index 1fbd31de..be2b87c2 100644
--- a/content/archetype-catalog.xml
+++ b/content/archetype-catalog.xml
@@ -12,8 +12,8 @@
<archetype>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-archetype-quickstart</artifactId>
- <version>9.23.0-SNAPSHOT</version>
- <description>Wicket 9.23.0-SNAPSHOT
Quickstart</description>
+ <version>9.24.0-SNAPSHOT</version>
+ <description>Wicket 9.24.0-SNAPSHOT
Quickstart</description>
</archetype>
<archetype>
@@ -54,8 +54,8 @@
<archetype>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-archetype-quickstart</artifactId>
- <version>9.22.0</version>
- <description>Wicket 9.22.0 Quickstart</description>
+ <version>9.23.0</version>
+ <description>Wicket 9.23.0 Quickstart</description>
</archetype>
<archetype>
diff --git a/content/atom.xml b/content/atom.xml
index 33c81eaa..293ba516 100644
--- a/content/atom.xml
+++ b/content/atom.xml
@@ -3,7 +3,7 @@
<title>Apache Wicket</title>
<link href="http://wicket.apache.org/atom.xml"; rel="self"/>
<link href="http://wicket.apache.org/"/>
- <updated>2026-05-05T08:36:32+00:00</updated>
+ <updated>2026-05-13T16:11:54+00:00</updated>
<id>http://wicket.apache.org/</id>
<author>
<name>Apache Wicket</name>
@@ -11,6 +11,82 @@
</author>
+ <entry>
+ <title>Apache Wicket 9.23.0 released</title>
+ <link
href="http://wicket.apache.org/news/2026/05/13/wicket-9.23.0-released.html"/>
+ <updated>2026-05-13T00:00:00+00:00</updated>
+
<id>http://wicket.apache.org/news/2026/05/13/wicket-9.23.0-released</id>
+ <content type="html"><p>The Apache Wicket PMC is proud to
announce Apache Wicket 9.23.0!</p>
+
+<p>Apache Wicket is an open source Java component oriented web
application
+framework that powers thousands of web applications and web sites for
+governments, stores, universities, cities, banks, email providers, and
+more. You can find more about Apache Wicket at
https://wicket.apache.org</p>
+
+<p>This release marks another minor release of Wicket 9. We
+use semantic versioning for the development of Wicket, and as such no
+API breaks are present in this release compared to 9.0.0.</p>
+
+<h2 id="new-and-noteworthy">New and noteworthy</h2>
+
+<p>This release fixes the following security issue:</p>
+
+<ul>
+ <li>CVE-2026-43646 crafted URLs can bypass
PackageResourceGuard</li>
+ <li>CVE-2026-42509 crafted strings can break out of the JavaScript
sequence</li>
+ <li>CVE-2026-40010 possible session fixation using
AuthenticatedWebSession</li>
+ <li>CVE-2026-43975 Possible malicious path traversal in
FolderUploadsFileManager</li>
+</ul>
+
+<h2 id="using-this-release">Using this release</h2>
+
+<p>With Apache Maven update your dependency to (and don’t forget to
+update any other dependencies on Wicket projects to the same
version):</p>
+
+<figure class="highlight"><pre><code
class="language-xml" data-lang="xml"><span
class="nt">&lt;dependency&gt;</span>
+ <span
class="nt">&lt;groupId&gt;</span>org.apache.wicket<span
class="nt">&lt;/groupId&gt;</span>
+ <span
class="nt">&lt;artifactId&gt;</span>wicket-core<span
class="nt">&lt;/artifactId&gt;</span>
+ <span
class="nt">&lt;version&gt;</span>9.23.0<span
class="nt">&lt;/version&gt;</span>
+<span
class="nt">&lt;/dependency&gt;</span></code></pre></figure>
+
+<p>Or download and build the distribution yourself, or use our
+convenience binary package you can find here:</p>
+
+<ul>
+ <li>Download:
http://wicket.apache.org/start/wicket-9.x.html#manually</li>
+</ul>
+
+<!--more-->
+
+<h2 id="upgrading-from-earlier-versions">Upgrading from
earlier versions</h2>
+
+<p>If you upgrade from 9.y.z this release is a drop in replacement. If
+you come from a version prior to 9.0.0, please read our Wicket 9
+migration guide found at</p>
+
+<ul>
+ <li>http://s.apache.org/wicket9migrate</li>
+</ul>
+
+<p>Have fun!</p>
+
+<p>— The Wicket team</p>
+
+<p>========================================================================</p>
+
+<h3 id="this-release">This Release</h3>
+
+<h4 id="changelog-for-9230">CHANGELOG for 9.23.0:</h4>
+
+<h5 id="bug">Bug</h5>
+
+<ul>
+ <li>[WICKET-7174] - DefaultSecureRandomSupplier does not work for
FIPS</li>
+</ul>
+
+</content>
+ </entry>
+
<entry>
<title>Apache Wicket 10.9.0 released</title>
<link
href="http://wicket.apache.org/news/2026/05/05/wicket-10.9.0-released.html"/>
@@ -733,84 +809,6 @@ migration guide found at</p>
<li>[WICKET-7139] - Update OSGi imports for Wicket 9.x</li>
</ul>
-</content>
- </entry>
-
- <entry>
- <title>Apache Wicket 10.4.0 released</title>
- <link
href="http://wicket.apache.org/news/2025/01/24/wicket-10.4.0-released.html"/>
- <updated>2025-01-24T00:00:00+00:00</updated>
-
<id>http://wicket.apache.org/news/2025/01/24/wicket-10.4.0-released</id>
- <content type="html"><p>The Apache Wicket PMC is proud to
announce Apache Wicket 10.4.0!</p>
-
-<p>Apache Wicket is an open source Java component oriented web
application
-framework that powers thousands of web applications and web sites for
-governments, stores, universities, cities, banks, email providers, and
-more. You can find more about Apache Wicket at
https://wicket.apache.org</p>
-
-<p>This release marks another minor release of Wicket 10. We
-use semantic versioning for the development of Wicket, and as such no
-API breaks are present in this release compared to 10.0.0.</p>
-
-<h2 id="using-this-release">Using this release</h2>
-
-<p>With Apache Maven update your dependency to (and don’t forget to
-update any other dependencies on Wicket projects to the same
version):</p>
-
-<figure class="highlight"><pre><code
class="language-xml" data-lang="xml"><span
class="nt">&lt;dependency&gt;</span>
- <span
class="nt">&lt;groupId&gt;</span>org.apache.wicket<span
class="nt">&lt;/groupId&gt;</span>
- <span
class="nt">&lt;artifactId&gt;</span>wicket-core<span
class="nt">&lt;/artifactId&gt;</span>
- <span
class="nt">&lt;version&gt;</span>10.4.0<span
class="nt">&lt;/version&gt;</span>
-<span
class="nt">&lt;/dependency&gt;</span></code></pre></figure>
-
-<p>Or download and build the distribution yourself, or use our
-convenience binary package you can find here:</p>
-
-<ul>
- <li>Download:
http://wicket.apache.org/start/wicket-10.x.html#manually</li>
-</ul>
-
-<!--more-->
-
-<h2 id="upgrading-from-earlier-versions">Upgrading from
earlier versions</h2>
-
-<p>If you upgrade from 10.y.z this release is a drop in replacement. If
-you come from a version prior to 10.0.0, please read our Wicket 10
-migration guide found at</p>
-
-<ul>
- <li>http://s.apache.org/wicket10migrate</li>
-</ul>
-
-<p>Have fun!</p>
-
-<p>— The Wicket team</p>
-
-<p>========================================================================</p>
-
-<h3 id="this-release">This Release</h3>
-
-<h4 id="changelog-for-1040">CHANGELOG for 10.4.0:</h4>
-
-<h5 id="bug">Bug</h5>
-
-<ul>
- <li>[WICKET-7140] - Form submit triggered by pressing return in
textareas</li>
-</ul>
-
-<h5 id="improvement">Improvement</h5>
-
-<ul>
- <li>[WICKET-7137] - Make resource URL sanitization
extendable</li>
- <li>[WICKET-7138] - Support URL fragment with PageParameters
class</li>
-</ul>
-
-<h5 id="task">Task</h5>
-
-<ul>
- <li>[WICKET-7139] - Update OSGi imports for Wicket 9.x</li>
-</ul>
-
</content>
</entry>
diff --git a/content/feed.xml b/content/feed.xml
index 3dbd50e3..098691a4 100644
--- a/content/feed.xml
+++ b/content/feed.xml
@@ -1,4 +1,70 @@
-<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link href="http://0.0.0.0:4000/feed.xml";
rel="self" type="application/atom+xml" /><link href="http://0.0.0.0:4000/";
rel="alternate" type="text/html"
/><updated>2026-05-05T08:36:32+00:00</updated><id>http://0.0.0.0:4000/feed.xml</id><title
type="html">Apache Wicket</title><entry><title type="html">Apache Wicket
10.9.0 released</title><l [...]
+<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link href="http://0.0.0.0:4000/feed.xml";
rel="self" type="application/atom+xml" /><link href="http://0.0.0.0:4000/";
rel="alternate" type="text/html"
/><updated>2026-05-13T16:11:54+00:00</updated><id>http://0.0.0.0:4000/feed.xml</id><title
type="html">Apache Wicket</title><entry><title type="html">Apache Wicket
9.23.0 released</title><l [...]
+
+<p>Apache Wicket is an open source Java component oriented web application
+framework that powers thousands of web applications and web sites for
+governments, stores, universities, cities, banks, email providers, and
+more. You can find more about Apache Wicket at https://wicket.apache.org</p>
+
+<p>This release marks another minor release of Wicket 9. We
+use semantic versioning for the development of Wicket, and as such no
+API breaks are present in this release compared to 9.0.0.</p>
+
+<h2 id="new-and-noteworthy">New and noteworthy</h2>
+
+<p>This release fixes the following security issue:</p>
+
+<ul>
+ <li>CVE-2026-43646 crafted URLs can bypass PackageResourceGuard</li>
+ <li>CVE-2026-42509 crafted strings can break out of the JavaScript
sequence</li>
+ <li>CVE-2026-40010 possible session fixation using
AuthenticatedWebSession</li>
+ <li>CVE-2026-43975 Possible malicious path traversal in
FolderUploadsFileManager</li>
+</ul>
+
+<h2 id="using-this-release">Using this release</h2>
+
+<p>With Apache Maven update your dependency to (and don’t forget to
+update any other dependencies on Wicket projects to the same version):</p>
+
+<figure class="highlight"><pre><code class="language-xml"
data-lang="xml"><span class="nt"><dependency></span>
+ <span class="nt"><groupId></span>org.apache.wicket<span
class="nt"></groupId></span>
+ <span class="nt"><artifactId></span>wicket-core<span
class="nt"></artifactId></span>
+ <span class="nt"><version></span>9.23.0<span
class="nt"></version></span>
+<span class="nt"></dependency></span></code></pre></figure>
+
+<p>Or download and build the distribution yourself, or use our
+convenience binary package you can find here:</p>
+
+<ul>
+ <li>Download: http://wicket.apache.org/start/wicket-9.x.html#manually</li>
+</ul>
+
+<!--more-->
+
+<h2 id="upgrading-from-earlier-versions">Upgrading from earlier versions</h2>
+
+<p>If you upgrade from 9.y.z this release is a drop in replacement. If
+you come from a version prior to 9.0.0, please read our Wicket 9
+migration guide found at</p>
+
+<ul>
+ <li>http://s.apache.org/wicket9migrate</li>
+</ul>
+
+<p>Have fun!</p>
+
+<p>— The Wicket team</p>
+
+<p>========================================================================</p>
+
+<h3 id="this-release">This Release</h3>
+
+<h4 id="changelog-for-9230">CHANGELOG for 9.23.0:</h4>
+
+<h5 id="bug">Bug</h5>
+
+<ul>
+ <li>[WICKET-7174] - DefaultSecureRandomSupplier does not work for FIPS</li>
+</ul>]]></content><author><name></name></author><category term="2026"
/><summary type="html"><![CDATA[The Apache Wicket PMC is proud to announce
Apache Wicket 9.23.0! Apache Wicket is an open source Java component oriented
web application framework that powers thousands of web applications and web
sites for governments, stores, universities, cities, banks, email providers,
and more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor releas [...]
<p>Apache Wicket is an open source Java component oriented web application
framework that powers thousands of web applications and web sites for
@@ -633,72 +699,4 @@ migration guide found at</p>
<ul>
<li>[WICKET-7139] - Update OSGi imports for Wicket 9.x</li>
-</ul>]]></content><author><name></name></author><category term="2025"
/><summary type="html"><![CDATA[The Apache Wicket PMC is proud to announce
Apache Wicket 9.20.0! Apache Wicket is an open source Java component oriented
web application framework that powers thousands of web applications and web
sites for governments, stores, universities, cities, banks, email providers,
and more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor releas [...]
-
-<p>Apache Wicket is an open source Java component oriented web application
-framework that powers thousands of web applications and web sites for
-governments, stores, universities, cities, banks, email providers, and
-more. You can find more about Apache Wicket at https://wicket.apache.org</p>
-
-<p>This release marks another minor release of Wicket 10. We
-use semantic versioning for the development of Wicket, and as such no
-API breaks are present in this release compared to 10.0.0.</p>
-
-<h2 id="using-this-release">Using this release</h2>
-
-<p>With Apache Maven update your dependency to (and don’t forget to
-update any other dependencies on Wicket projects to the same version):</p>
-
-<figure class="highlight"><pre><code class="language-xml"
data-lang="xml"><span class="nt"><dependency></span>
- <span class="nt"><groupId></span>org.apache.wicket<span
class="nt"></groupId></span>
- <span class="nt"><artifactId></span>wicket-core<span
class="nt"></artifactId></span>
- <span class="nt"><version></span>10.4.0<span
class="nt"></version></span>
-<span class="nt"></dependency></span></code></pre></figure>
-
-<p>Or download and build the distribution yourself, or use our
-convenience binary package you can find here:</p>
-
-<ul>
- <li>Download: http://wicket.apache.org/start/wicket-10.x.html#manually</li>
-</ul>
-
-<!--more-->
-
-<h2 id="upgrading-from-earlier-versions">Upgrading from earlier versions</h2>
-
-<p>If you upgrade from 10.y.z this release is a drop in replacement. If
-you come from a version prior to 10.0.0, please read our Wicket 10
-migration guide found at</p>
-
-<ul>
- <li>http://s.apache.org/wicket10migrate</li>
-</ul>
-
-<p>Have fun!</p>
-
-<p>— The Wicket team</p>
-
-<p>========================================================================</p>
-
-<h3 id="this-release">This Release</h3>
-
-<h4 id="changelog-for-1040">CHANGELOG for 10.4.0:</h4>
-
-<h5 id="bug">Bug</h5>
-
-<ul>
- <li>[WICKET-7140] - Form submit triggered by pressing return in
textareas</li>
-</ul>
-
-<h5 id="improvement">Improvement</h5>
-
-<ul>
- <li>[WICKET-7137] - Make resource URL sanitization extendable</li>
- <li>[WICKET-7138] - Support URL fragment with PageParameters class</li>
-</ul>
-
-<h5 id="task">Task</h5>
-
-<ul>
- <li>[WICKET-7139] - Update OSGi imports for Wicket 9.x</li>
-</ul>]]></content><author><name></name></author><category term="2025"
/><summary type="html"><![CDATA[The Apache Wicket PMC is proud to announce
Apache Wicket 10.4.0! Apache Wicket is an open source Java component oriented
web application framework that powers thousands of web applications and web
sites for governments, stores, universities, cities, banks, email providers,
and more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor releas [...]
\ No newline at end of file
+</ul>]]></content><author><name></name></author><category term="2025"
/><summary type="html"><![CDATA[The Apache Wicket PMC is proud to announce
Apache Wicket 9.20.0! Apache Wicket is an open source Java component oriented
web application framework that powers thousands of web applications and web
sites for governments, stores, universities, cities, banks, email providers,
and more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor releas [...]
\ No newline at end of file
diff --git a/content/index.html b/content/index.html
index 644ec4d5..749bfcac 100644
--- a/content/index.html
+++ b/content/index.html
@@ -424,18 +424,18 @@
<div class="l-two-third">
<article>
- <h2>Apache Wicket 10.9.0 released</h2>
- <small>05 May 2026</small>
- <p>The Apache Wicket PMC is proud to announce Apache Wicket
10.9.0!</p>
+ <h2>Apache Wicket 9.23.0 released</h2>
+ <small>13 May 2026</small>
+ <p>The Apache Wicket PMC is proud to announce Apache Wicket
9.23.0!</p>
<p>Apache Wicket is an open source Java component oriented web application
framework that powers thousands of web applications and web sites for
governments, stores, universities, cities, banks, email providers, and
more. You can find more about Apache Wicket at https://wicket.apache.org</p>
-<p>This release marks another minor release of Wicket 10. We
+<p>This release marks another minor release of Wicket 9. We
use semantic versioning for the development of Wicket, and as such no
-API breaks are present in this release compared to 10.0.0.</p>
+API breaks are present in this release compared to 9.0.0.</p>
<h2 id="new-and-noteworthy">New and noteworthy</h2>
@@ -456,24 +456,24 @@ update any other dependencies on Wicket projects to the
same version):</p>
<figure class="highlight"><pre><code class="language-xml"
data-lang="xml"><span class="nt"><dependency></span>
<span class="nt"><groupId></span>org.apache.wicket<span
class="nt"></groupId></span>
<span class="nt"><artifactId></span>wicket-core<span
class="nt"></artifactId></span>
- <span class="nt"><version></span>10.9.0<span
class="nt"></version></span>
+ <span class="nt"><version></span>9.23.0<span
class="nt"></version></span>
<span class="nt"></dependency></span></code></pre></figure>
<p>Or download and build the distribution yourself, or use our
convenience binary package you can find here:</p>
<ul>
- <li>Download: http://wicket.apache.org/start/wicket-10.x.html#manually</li>
+ <li>Download: http://wicket.apache.org/start/wicket-9.x.html#manually</li>
</ul>
- <a href="/news/2026/05/05/wicket-10.9.0-released.html">Read
more...</a>
+ <a href="/news/2026/05/13/wicket-9.23.0-released.html">Read
more...</a>
</article>
<article>
- <h2>Apache Wicket 10.8.0 released</h2>
- <small>21 Dec 2025</small>
- <p>The Apache Wicket PMC is proud to announce Apache Wicket
10.8.0!</p>
+ <h2>Apache Wicket 10.9.0 released</h2>
+ <small>05 May 2026</small>
+ <p>The Apache Wicket PMC is proud to announce Apache Wicket
10.9.0!</p>
<p>Apache Wicket is an open source Java component oriented web application
framework that powers thousands of web applications and web sites for
@@ -484,6 +484,17 @@ more. You can find more about Apache Wicket at
https://wicket.apache.org</p>
use semantic versioning for the development of Wicket, and as such no
API breaks are present in this release compared to 10.0.0.</p>
+<h2 id="new-and-noteworthy">New and noteworthy</h2>
+
+<p>This release fixes the following security issue:</p>
+
+<ul>
+ <li>CVE-2026-43646 crafted URLs can bypass PackageResourceGuard</li>
+ <li>CVE-2026-42509 crafted strings can break out of the JavaScript
sequence</li>
+ <li>CVE-2026-40010 possible session fixation using
AuthenticatedWebSession</li>
+ <li>CVE-2026-43975 Possible malicious path traversal in
FolderUploadsFileManager</li>
+</ul>
+
<h2 id="using-this-release">Using this release</h2>
<p>With Apache Maven update your dependency to (and don’t forget to
@@ -492,7 +503,7 @@ update any other dependencies on Wicket projects to the
same version):</p>
<figure class="highlight"><pre><code class="language-xml"
data-lang="xml"><span class="nt"><dependency></span>
<span class="nt"><groupId></span>org.apache.wicket<span
class="nt"></groupId></span>
<span class="nt"><artifactId></span>wicket-core<span
class="nt"></artifactId></span>
- <span class="nt"><version></span>10.8.0<span
class="nt"></version></span>
+ <span class="nt"><version></span>10.9.0<span
class="nt"></version></span>
<span class="nt"></dependency></span></code></pre></figure>
<p>Or download and build the distribution yourself, or use our
@@ -503,7 +514,7 @@ convenience binary package you can find here:</p>
</ul>
- <a href="/news/2025/12/21/wicket-10.8.0-released.html">Read
more...</a>
+ <a href="/news/2026/05/05/wicket-10.9.0-released.html">Read
more...</a>
</article>
</div>
@@ -520,6 +531,13 @@ convenience binary package you can find here:</p>
<ul>
+ <li>
+ <h3>Apache Wicket 10.9.0 released</h3>
+ <small>05 May 2026</small>
+ The Apache Wicket PMC is proud to announce Apache Wicket
10.9.0! Apache Wicket is an open source Java component oriented web application
framework that powers...
+ <a
href="/news/2026/05/05/wicket-10.9.0-released.html">more</a>
+ </li>
+
<li>
<h3>Apache Wicket 10.8.0 released</h3>
<small>21 Dec 2025</small>
@@ -548,13 +566,6 @@ convenience binary package you can find here:</p>
<a
href="/news/2025/07/12/wicket-10.6.0-released.html">more</a>
</li>
- <li>
- <h3>Apache Wicket 9.21.0 released</h3>
- <small>25 Apr 2025</small>
- The Apache Wicket PMC is proud to announce Apache Wicket
9.21.0! Apache Wicket is an open source Java component oriented web application
framework that powers...
- <a
href="/news/2025/04/25/wicket-9.21.0-released.html">more</a>
- </li>
-
</ul>
</div>
</div>
diff --git a/content/learn/index.html b/content/learn/index.html
index c5f2bfcf..88ccf43a 100644
--- a/content/learn/index.html
+++ b/content/learn/index.html
@@ -167,13 +167,13 @@ We also publish a news item on our website with the
announcement, and it is also
<ul>
<li>
- <p><a href="/news/2026/05/05/wicket-10.9.0-released.html">Apache Wicket
10.9.0 released</a> <small>05 May 2026</small></p>
+ <p><a href="/news/2026/05/13/wicket-9.23.0-released.html">Apache Wicket
9.23.0 released</a> <small>13 May 2026</small></p>
</li>
<li>
- <p><a href="/news/2025/12/21/wicket-10.8.0-released.html">Apache Wicket
10.8.0 released</a> <small>21 Dec 2025</small></p>
+ <p><a href="/news/2026/05/05/wicket-10.9.0-released.html">Apache Wicket
10.9.0 released</a> <small>05 May 2026</small></p>
</li>
<li>
- <p><a href="/news/2025/12/19/wicket-9.22.0-released.html">Apache Wicket
9.22.0 released</a> <small>19 Dec 2025</small></p>
+ <p><a href="/news/2025/12/21/wicket-10.8.0-released.html">Apache Wicket
10.8.0 released</a> <small>21 Dec 2025</small></p>
</li>
</ul>
diff --git a/content/news/2026/05/13/wicket-9.23.0-released.html
b/content/news/2026/05/13/wicket-9.23.0-released.html
new file mode 100644
index 00000000..bba96639
--- /dev/null
+++ b/content/news/2026/05/13/wicket-9.23.0-released.html
@@ -0,0 +1,234 @@
+<!DOCTYPE html>
+<html lang="en">
+ <head>
+ <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
+ <meta charset="utf-8">
+
+
+
+ <title>Apache Wicket 9.23.0 released | Apache Wicket</title>
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
+
+ <link rel="shortcut icon" href="/favicon.ico"
type="image/vnd.microsoft.icon" />
+ <link rel="stylesheet" href="/css/style.css" type="text/css"
media="screen" />
+ <link href="/css/font-awesome.min.css" rel="stylesheet" />
+
+ <script src="/javascript/jquery-3.7.1.min.js"></script>
+
+
+ </head>
+ <body class="">
+ <div class="header default">
+ <div class="l-container">
+
+<nav class="mainmenu">
+ <div class="nav-logo">
+ <a href="/"><img src="/img/logo-apachewicket.svg" alt="Apache Wicket"></a>
+</div>
+
+ <div class="nav-container">
+
+
+
+
+
+ <!-- /start/quickstart.html ||
/news/2026/05/13/wicket-9.23.0-released.html -->
+
+
+
+ <a href="/start/quickstart.html" class=" nav-items">Quick Start</a>
+
+
+
+
+
+ <!-- /start/download.html ||
/news/2026/05/13/wicket-9.23.0-released.html -->
+
+
+
+ <a href="/start/download.html" class=" nav-items">Download</a>
+
+
+
+
+
+ <!-- /learn || /news/2026/05/13/wicket-9.23.0-released.html -->
+
+
+
+ <a href="/learn" class=" nav-items">Documentation</a>
+
+
+
+
+
+ <!-- /help || /news/2026/05/13/wicket-9.23.0-released.html -->
+
+
+
+ <a href="/help" class=" nav-items">Support</a>
+
+
+
+
+
+ <!-- /contribute ||
/news/2026/05/13/wicket-9.23.0-released.html -->
+
+
+
+ <a href="/contribute" class=" nav-items">Contribute</a>
+
+
+
+
+
+ <!-- /community || /news/2026/05/13/wicket-9.23.0-released.html
-->
+
+
+
+ <a href="/community" class=" nav-items">Community</a>
+
+
+
+
+
+ <!-- /apache || /news/2026/05/13/wicket-9.23.0-released.html -->
+
+
+
+ <a href="/apache" class=" nav-items">Apache</a>
+
+ </div>
+ <div class="nav-container ">
+ <a href="https://github.com/apache/wicket"; rel="noreferrer noopener
noreferrer" target="_blank"><i class="fa fa-github nav-items"></i></a>
+ <a href="https://builtwithwicket.tumblr.com"; rel="noreferrer noopener
noreferrer" target="_blank"><i class="fa fa-tumblr nav-items"></i></a>
+ </div>
+</nav>
+
+ </div>
+</div>
+<main>
+ <div class="l-container">
+ <header class="l-full preamble">
+ <h1>Apache Wicket 9.23.0 released</h1>
+
+
+
+ </header>
+ <section class="toc left post ">
+ <div id="toc" class="toc">
+<div id="toc-title"><h2>Table of Contents</h2></div>
+<ul>
+<li class="toc--level-1 toc--section-1"><a href="#new-and-noteworthy"><span
class="toc-number">1</span> <span class="toc-text">New and
noteworthy</span></a></li>
+<li class="toc--level-1 toc--section-2"><a href="#using-this-release"><span
class="toc-number">2</span> <span class="toc-text">Using this
release</span></a></li>
+<li class="toc--level-1 toc--section-3">
+<a href="#upgrading-from-earlier-versions"><span class="toc-number">3</span>
<span class="toc-text">Upgrading from earlier versions</span></a><ul><li
class="toc--level-2 toc--section-4"><a href="#this-release"><span
class="toc-number">3.1</span> <span class="toc-text">This
Release</span></a></li></ul>
+</li>
+</ul>
+</div>
+ </section>
+ <section>
+ <div class="l-full">
+ <p class="meta">13 May 2026</p>
+ <p>The Apache Wicket PMC is proud to announce Apache Wicket 9.23.0!</p>
+
+<p>Apache Wicket is an open source Java component oriented web application
+framework that powers thousands of web applications and web sites for
+governments, stores, universities, cities, banks, email providers, and
+more. You can find more about Apache Wicket at https://wicket.apache.org</p>
+
+<p>This release marks another minor release of Wicket 9. We
+use semantic versioning for the development of Wicket, and as such no
+API breaks are present in this release compared to 9.0.0.</p>
+
+<h2 id="new-and-noteworthy">New and noteworthy</h2>
+
+<p>This release fixes the following security issue:</p>
+
+<ul>
+ <li>CVE-2026-43646 crafted URLs can bypass PackageResourceGuard</li>
+ <li>CVE-2026-42509 crafted strings can break out of the JavaScript
sequence</li>
+ <li>CVE-2026-40010 possible session fixation using
AuthenticatedWebSession</li>
+ <li>CVE-2026-43975 Possible malicious path traversal in
FolderUploadsFileManager</li>
+</ul>
+
+<h2 id="using-this-release">Using this release</h2>
+
+<p>With Apache Maven update your dependency to (and don’t forget to
+update any other dependencies on Wicket projects to the same version):</p>
+
+<figure class="highlight"><pre><code class="language-xml"
data-lang="xml"><span class="nt"><dependency></span>
+ <span class="nt"><groupId></span>org.apache.wicket<span
class="nt"></groupId></span>
+ <span class="nt"><artifactId></span>wicket-core<span
class="nt"></artifactId></span>
+ <span class="nt"><version></span>9.23.0<span
class="nt"></version></span>
+<span class="nt"></dependency></span></code></pre></figure>
+
+<p>Or download and build the distribution yourself, or use our
+convenience binary package you can find here:</p>
+
+<ul>
+ <li>Download: http://wicket.apache.org/start/wicket-9.x.html#manually</li>
+</ul>
+
+<!--more-->
+
+<h2 id="upgrading-from-earlier-versions">Upgrading from earlier versions</h2>
+
+<p>If you upgrade from 9.y.z this release is a drop in replacement. If
+you come from a version prior to 9.0.0, please read our Wicket 9
+migration guide found at</p>
+
+<ul>
+ <li>http://s.apache.org/wicket9migrate</li>
+</ul>
+
+<p>Have fun!</p>
+
+<p>— The Wicket team</p>
+
+<p>========================================================================</p>
+
+<h3 id="this-release">This Release</h3>
+
+<h4 id="changelog-for-9230">CHANGELOG for 9.23.0:</h4>
+
+<h5 id="bug">Bug</h5>
+
+<ul>
+ <li>[WICKET-7174] - DefaultSecureRandomSupplier does not work for FIPS</li>
+</ul>
+
+
+</div>
+
+
+ </section>
+ </div>
+</main>
+
+ <footer>
+ <div class="l-container l-flex">
+ <div class="l-one-third left">
+ <a href="https://www.apache.org"; target="_blank" rel="noopener
noreferrer">Apache</a><br>
+ <a href="https://www.apache.org/licenses/"; target="_blank"
rel="noopener noreferrer">License</a><br>
+ <a href="https://events.apache.org/x/current-event"; target="_blank"
rel="noopener noreferrer">Events</a><br>
+ </div>
+ <div class="l-one-third">
+ <a href="https://www.apache.org/foundation/sponsorship";
target="_blank" rel="noopener noreferrer">Sponsorships</a><br>
+ <a href="https://www.apache.org/foundation/thanks"; target="_blank"
rel="noopener noreferrer">Thanks</a><br>
+ </div>
+ <div class="l-one-third">
+ <a href="https://www.apache.org/security"; target="_blank"
rel="noopener noreferrer">Security</a><br>
+ <a
href="https://privacy.apache.org/policies/privacy-policy-public.html";
target="_blank" rel="noopener noreferrer">Privacy</a><br>
+ </div>
+</div>
+<div class="l-container">
+ <div class="left">
+ <img src="https://www.apache.org/img/asf_logo.png"; style="height:90px;
float:left; margin-right:10px;">
+ <div style="margin-top:12px;">Copyright © 2025 — The Apache Software
Foundation. Apache Wicket, Wicket, Apache, the Apache feather logo, and the
Apache Wicket project logo are trademarks of The Apache Software Foundation.
All other marks mentioned may be trademarks or registered trademarks of their
respective owners.</div>
+ </div>
+</div>
+
+ </footer>
+ </body>
+</html>
diff --git a/content/news/2026/05/index.html b/content/news/2026/05/index.html
index c5270859..edf085a7 100644
--- a/content/news/2026/05/index.html
+++ b/content/news/2026/05/index.html
@@ -129,6 +129,17 @@ governments...</p>
<a href="/news/2026/05/05/wicket-10.9.0-released.html">more</a>
</div>
+<div class="news">
+ <h3>Apache Wicket 9.23.0 released</h3>
+ <p><small>13 May 2026</small></p>
+ <p>The Apache Wicket PMC is proud to announce Apache Wicket 9.23.0!</p>
+
+<p>Apache Wicket is an open source Java component oriented web application
+framework that powers thousands of web applications and web sites for
+governments...</p>
+ <a href="/news/2026/05/13/wicket-9.23.0-released.html">more</a>
+</div>
+
</div>
<div class="l-one-third">
diff --git a/content/news/index.html b/content/news/index.html
index befc26d8..ea9e8011 100644
--- a/content/news/index.html
+++ b/content/news/index.html
@@ -124,6 +124,13 @@
<p>This section contains all news items published in <a
href="/news/2026">2026</a>.</p>
+ <article>
+ <h3 id="/news/2026/05/13/wicket-9.23.0-released.html">Apache Wicket
9.23.0 released</h3>
+ <small>13 May 2026</small>
+ <p>The Apache Wicket PMC is proud to announce Apache Wicket 9.23.0!
Apache Wicket is an open source Java component oriented web application
framework that powers thousands of web applications and web sites for
governments, stores, universities, cities, banks, email providers, and more.
You can find more about Apache Wicket at...
+ <a href="/news/2026/05/13/wicket-9.23.0-released.html">more</a></p>
+</article>
+
<article>
<h3 id="/news/2026/05/05/wicket-10.9.0-released.html">Apache Wicket
10.9.0 released</h3>
<small>05 May 2026</small>
diff --git a/content/start/download.html b/content/start/download.html
index d8b65208..30c9204b 100644
--- a/content/start/download.html
+++ b/content/start/download.html
@@ -168,7 +168,7 @@
</tr>
<tr>
<td><a href="wicket-9.x.html">Wicket 9.x</a></td>
- <td>9.22.0</td>
+ <td>9.23.0</td>
<td>supported</td>
</tr>
<tr>
diff --git a/content/start/quickstart.html b/content/start/quickstart.html
index 3deeb666..ac03e6b6 100644
--- a/content/start/quickstart.html
+++ b/content/start/quickstart.html
@@ -225,7 +225,7 @@ command line to your clipboard.</p>
- <option value="9.23.0-SNAPSHOT">9.23.0-SNAPSHOT</option>
+ <option value="9.24.0-SNAPSHOT">9.24.0-SNAPSHOT</option>
@@ -249,7 +249,7 @@ command line to your clipboard.</p>
- <option value="9.22.0">9.22.0</option>
+ <option value="9.23.0">9.23.0</option>
diff --git a/content/start/wicket-9.x.html b/content/start/wicket-9.x.html
index 9767271e..bf6db432 100644
--- a/content/start/wicket-9.x.html
+++ b/content/start/wicket-9.x.html
@@ -170,11 +170,11 @@ releases will not break compatibility.</p>
<h3 id="change-log">Change log</h3>
<p>To see what changed in these releases you can read the
-<a href="https://downloads.apache.org/wicket/9.22.0/CHANGELOG-9.x";
target="_blank" rel="noopener noreferrer">change log</a>.</p>
+<a href="https://downloads.apache.org/wicket/9.23.0/CHANGELOG-9.x";
target="_blank" rel="noopener noreferrer">change log</a>.</p>
<h2 id="download">Download</h2>
-<p>The most recent test version in this branch is: <strong>9.22.0</strong>.
+<p>The most recent test version in this branch is: <strong>9.23.0</strong>.
You can test the current state of development using <a href="#maven">Maven</a>
or <a href="#manually">download it manually</a>.</p>
<h3 id="maven">Using Apache Maven</h3>
@@ -184,7 +184,7 @@ You can test the current state of development using <a
href="#maven">Maven</a> o
<figure class="highlight"><pre><code class="language-xml"
data-lang="xml"><span class="nt"><dependency></span>
<span class="nt"><groupId></span>org.apache.wicket<span
class="nt"></groupId></span>
<span class="nt"><artifactId></span>wicket-core<span
class="nt"></artifactId></span>
- <span class="nt"><version></span>9.22.0<span
class="nt"></version></span>
+ <span class="nt"><version></span>9.23.0<span
class="nt"></version></span>
<span class="nt"></dependency></span></code></pre></figure>
<p>Add the snippet above to your project’s POM in the dependency
@@ -202,26 +202,26 @@ accordingly).</p>
from source:</p>
<ul>
- <li>Download source <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.22.0/apache-wicket-9.22.0.tar.gz";
target="_blank" rel="noopener noreferrer">apache-wicket-9.22.0.tar.gz</a>
-(<a
href="https://downloads.apache.org/wicket/9.22.0/apache-wicket-9.22.0.tar.gz.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
-<a
href="https://downloads.apache.org/wicket/9.22.0/apache-wicket-9.22.0.tar.gz.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
+ <li>Download source <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.23.0/apache-wicket-9.23.0.tar.gz";
target="_blank" rel="noopener noreferrer">apache-wicket-9.23.0.tar.gz</a>
+(<a
href="https://downloads.apache.org/wicket/9.23.0/apache-wicket-9.23.0.tar.gz.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
+<a
href="https://downloads.apache.org/wicket/9.23.0/apache-wicket-9.23.0.tar.gz.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
)</li>
- <li>Download source <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.22.0/apache-wicket-9.22.0.zip";
target="_blank" rel="noopener noreferrer">apache-wicket-9.22.0.zip</a>
-(<a
href="https://downloads.apache.org/wicket/9.22.0/apache-wicket-9.22.0.zip.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
-<a
href="https://downloads.apache.org/wicket/9.22.0/apache-wicket-9.22.0.zip.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
+ <li>Download source <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.23.0/apache-wicket-9.23.0.zip";
target="_blank" rel="noopener noreferrer">apache-wicket-9.23.0.zip</a>
+(<a
href="https://downloads.apache.org/wicket/9.23.0/apache-wicket-9.23.0.zip.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
+<a
href="https://downloads.apache.org/wicket/9.23.0/apache-wicket-9.23.0.zip.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
)</li>
</ul>
<p>Or use the following links to get the pre-packaged binaries instead:</p>
<ul>
- <li>Download binaries <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.22.0/binaries/apache-wicket-9.22.0-bin.tar.gz";
target="_blank" rel="noopener noreferrer">apache-wicket-9.22.0-bin.tar.gz</a>
-(<a
href="https://downloads.apache.org/wicket/9.22.0/binaries/apache-wicket-9.22.0-bin.tar.gz.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
-<a
href="https://downloads.apache.org/wicket/9.22.0/binaries/apache-wicket-9.22.0-bin.tar.gz.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
+ <li>Download binaries <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.23.0/binaries/apache-wicket-9.23.0-bin.tar.gz";
target="_blank" rel="noopener noreferrer">apache-wicket-9.23.0-bin.tar.gz</a>
+(<a
href="https://downloads.apache.org/wicket/9.23.0/binaries/apache-wicket-9.23.0-bin.tar.gz.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
+<a
href="https://downloads.apache.org/wicket/9.23.0/binaries/apache-wicket-9.23.0-bin.tar.gz.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
)</li>
- <li>Download binaries <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.22.0/binaries/apache-wicket-9.22.0-bin.zip";
target="_blank" rel="noopener noreferrer">apache-wicket-9.22.0-bin.zip</a>
-(<a
href="https://downloads.apache.org/wicket/9.22.0/binaries/apache-wicket-9.22.0-bin.zip.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
-<a
href="https://downloads.apache.org/wicket/9.22.0/binaries/apache-wicket-9.22.0-bin.zip.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
+ <li>Download binaries <a
href="http://www.apache.org/dyn/closer.cgi/wicket/9.23.0/binaries/apache-wicket-9.23.0-bin.zip";
target="_blank" rel="noopener noreferrer">apache-wicket-9.23.0-bin.zip</a>
+(<a
href="https://downloads.apache.org/wicket/9.23.0/binaries/apache-wicket-9.23.0-bin.zip.asc";
target="_blank" rel="noopener noreferrer">PGP</a>,
+<a
href="https://downloads.apache.org/wicket/9.23.0/binaries/apache-wicket-9.23.0-bin.zip.sha256";
target="_blank" rel="noopener noreferrer">SHA-256</a>
)</li>
</ul>
![https://www.apache.org/img/asf_logo.png"](https://www.apache.org/img/asf_logo.png"){kind=link}