Apache Wicket

Apache Wicket 8.0.0-M4 released

2017-02-07T00:00:00+01:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.0.0-M4!

Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org

This release marks the first milestone of the major release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present breaks are present in this release compared to 8.0.0.

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.0.0-M4</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 8.0.0-M4 source download
Binary: 8.0.0-M4 binary download

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 7 migration guide found at

http://s.apache.org/wicket8migration

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.0.0-M4.zip:

Signature for apache-wicket-8.0.0-M4.tar.gz:

================================

This Release

CHANGELOG for 8.0.0-M4:

Bug

[WICKET-6165] - Inconsistent behavior of Markupstream.hasMore vs. MarkupStream.next.
[WICKET-6288] - StatelessLink not working
[WICKET-6303] - renderHead method of a Behavior added to a Border body is not called
[WICKET-6306] - Changing model object of Panel added to a Border not allowed
[WICKET-6310] - Once invalidated the Session will be invalidated on every detach
[WICKET-6311] - SignOutPage_ru.html is missing
[WICKET-6314] - 7.6 release references 7.5-SNAPSHOT poms
[WICKET-6316] - Wicket tester encodes page id for stateless links in stateless pages

Improvement

[WICKET-6307] - SubmitLink does not work in Chrome “ff.onsubmit is not a function”
[WICKET-6308] - Add an extra constructor to EmailTextField with a custom validator but without model
[WICKET-6315] - Optimize LinkParser by caching the compiled regex Pattern

Tasks

[WICKET-6287] - Switch from json.org to open-json
[WICKET-6304] - Remove Tomcat7 support in Native WebSockets
[WICKET-6305] - Remove Atmosphere module
[WICKET-6309] - Move the Native WebSocket demo to wicket-examples module

CVE-2016-6793 Apache Wicket deserialization vulnerability

2016-12-31T00:00:00+01:00

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected: Apache Wicket 6.x and 1.5.x

Description: Depending on the ISerializer set in the Wicket application, it’s possible that a Wicket’s object deserialized from an untrusted source and utilized by the application to causes the code to enter in an infinite loop. Specifically, Wicket’s DiskFileItem class, serialized by Kryo, allows an attacker to hack its serialized form to put a client on an infinite loop if the client attempts to write on the DeferredFileOutputStream attribute.

Mitigation: Upgrade to Apache Wicket 6.25.0 or 1.5.17

Credit: This issue was discovered by Jacob Baines, Tenable Network Security and Pedro Santos

References: https://wicket.apache.org/news

Apache Wicket 8.0.0-M3 released

2016-12-29T00:00:00+01:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.0.0-M3!

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.0.0-M3</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 8.0.0-M3 source download
Binary: 8.0.0-M3 binary download

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 7 migration guide found at

http://s.apache.org/wicket8migration

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.0.0-M3.zip:

Signature for apache-wicket-8.0.0-M3.tar.gz:

================================

This Release

CHANGELOG for 8.0.0-M3:

Bug

[WICKET-6041] - Nested forms / parent FormComponents do not reflect updated model when nested form submitted
[WICKET-6256] - 8.0.0-M1 MarkupNotFoundException
[WICKET-6257] - Page instance isn’t mapped to an URL just after the ‘cid’ parameter is add
[WICKET-6262] - IllegalArgumentException: Argument ‘filterPrefix’ may not be null or empty with WebSocketBehavior
[WICKET-6267] - Native Websocket exception when the page is expired
[WICKET-6270] - No upload is seen as empty upload after WICKET-6210
[WICKET-6277] - Broadcasting ClosedMessage about the JSR 356 WebSocket connection after the container was turned off
[WICKET-6279] - AttributeModifier.VALUELESS_ATTRIBUTE_REMOVE does not work after deserialisation
[WICKET-6283] - Page parameter equality should not depend on named parameters order
[WICKET-6285] - NoRecordsToolbar should override onConfigure rather than isVisible
[WICKET-6289] - Autolinking adds onclick attribute to tags
[WICKET-6290] - CssUrlReplacer doesn’t understand data: urls and breaks them
[WICKET-6292] - Button.onSubmit not called for multipart requests
[WICKET-6296] - Not possible to add WebSocketBehavior in ajax request
[WICKET-6298] - Markup not found for Component id =header and WICKET-6231, regression ?

Improvement

[WICKET-5920] - roll a version of ListDataProvider implementing ISortableDetachable model
[WICKET-6056] - Improvements to browser info gathering implementation
[WICKET-6258] - Repeater example page show the back button with the enable link style when disabled
[WICKET-6260] - Revert Ajax detection needed for character encoding to WebRequest.isAjax()
[WICKET-6261] - CheckGroupSelector default selection state incorrect when the list of Checks is empty
[WICKET-6263] - Fix JavaScript tests to pass with jQuery 2.x. and 3.x
[WICKET-6264] - Form: improve error message for disabled/invisible IFormSubmittingComponent
[WICKET-6269] - Use jdk-serializable-functional voor Serializable functional interfaces
[WICKET-6271] - IRequestableComponent getPage() javaDoc and Component implementation mismatch
[WICKET-6274] - Add origin header to ajax requests in BaseWicketTester
[WICKET-6276] - Reduce memory footprint for LambdaModel
[WICKET-6281] - Listener interfaces’ methods should use empty default methods for friendlier extension
[WICKET-6282] - Make native web socket message classes serializable
[WICKET-6284] - Introduce lambda-enhanced factory method in ResourceReference
[WICKET-6293] - Behavior#onTag() should pass the Component as well
[WICKET-6297] - Add wicket:label tag in wicket.xsd

New Feature

[WICKET-6275] - Stream support for MarkupContainer

Apache Wicket 7.6.0 released

2016-12-29T00:00:00+01:00

The Apache Wicket PMC is proud to announce Apache Wicket 7.6.0!

This release marks another minor release of Wicket 7. We use semantic versioning for the development of Wicket, and as such no API breaks are present breaks are present in this release compared to 7.0.0.

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>7.6.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 7.6.0 source download
Binary: 7.6.0 binary download

Upgrading from earlier versions

If you upgrade from 7.y.z this release is a drop in replacement. If you come from a version prior to 7.0.0, please read our Wicket 7 migration guide found at

http://s.apache.org/wicket7migrate

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-7.6.0.zip:

Signature for apache-wicket-7.6.0.tar.gz:

================================

This Release

CHANGELOG for 7.6.0:

Sub-task

[WICKET-6278] - Backport TagTester fix to 6.x and 7.x

Bug

[WICKET-6256] - 8.0.0-M1 MarkupNotFoundException
[WICKET-6257] - Page instance isn’t mapped to an URL just after the ‘cid’ parameter is add
[WICKET-6262] - IllegalArgumentException: Argument ‘filterPrefix’ may not be null or empty with WebSocketBehavior
[WICKET-6267] - Native Websocket exception when the page is expired
[WICKET-6270] - No upload is seen as empty upload after WICKET-6210
[WICKET-6277] - Broadcasting ClosedMessage about the JSR 356 WebSocket connection after the container was turned off
[WICKET-6279] - AttributeModifier.VALUELESS_ATTRIBUTE_REMOVE does not work after deserialisation
[WICKET-6283] - Page parameter equality should not depend on named parameters order
[WICKET-6285] - NoRecordsToolbar should override onConfigure rather than isVisible
[WICKET-6289] - Autolinking adds onclick attribute to tags
[WICKET-6290] - CssUrlReplacer doesn’t understand data: urls and breaks them
[WICKET-6296] - Not possible to add WebSocketBehavior in ajax request
[WICKET-6298] - Markup not found for Component id =header and WICKET-6231, regression ?

Improvement

[WICKET-6056] - Improvements to browser info gathering implementation
[WICKET-6258] - Repeater example page show the back button with the enable link style when disabled
[WICKET-6260] - Revert Ajax detection needed for character encoding to WebRequest.isAjax()
[WICKET-6261] - CheckGroupSelector default selection state incorrect when the list of Checks is empty
[WICKET-6263] - Fix JavaScript tests to pass with jQuery 2.x. and 3.x
[WICKET-6264] - Form: improve error message for disabled/invisible IFormSubmittingComponent
[WICKET-6271] - IRequestableComponent getPage() javaDoc and Component implementation mismatch
[WICKET-6274] - Add origin header to ajax requests in BaseWicketTester
[WICKET-6282] - Make native web socket message classes serializable
[WICKET-6297] - Add wicket:label tag in wicket.xsd

Apache Wicket 6.26.0 released

2016-12-29T00:00:00+01:00

The Apache Wicket PMC is proud to announce Apache Wicket 6.26.0!

This release marks another minor release of Wicket 6. We use semantic versioning for the development of Wicket, and as such no API breaks are present breaks are present in this release compared to 6.0.0.

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
 <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>6.26.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 6.26.0 source download Binary: 6.26.0 binary download

Upgrading from earlier versions

If you upgrade from 6.y.z this release is a drop in replacement. If you come from a version prior to 6.0.0, please read our Wicket 6 migration guide found at

http://s.apache.org/wicket6migration

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-6.26.0.zip:

Signature for apache-wicket-6.26.0.tar.gz:

================================

This Release

CHANGELOG for 6.26.0:

Sub-task

[WICKET-6278] - Backport TagTester fix to 6.x and 7.x

Bug

[WICKET-6250] - FileUploadField does not deteach models and fails to null the reference to the transient fileUploads field if forceCloseStreamsOnDetach is false
[WICKET-6267] - Native Websocket exception when the page is expired
[WICKET-6270] - No upload is seen as empty upload after WICKET-6210
[WICKET-6279] - AttributeModifier.VALUELESS_ATTRIBUTE_REMOVE does not work after deserialisation
[WICKET-6289] - Autolinking adds onclick attribute to tags
[WICKET-6290] - CssUrlReplacer doesn’t understand data: urls and breaks them
[WICKET-6295] - Clicking Link in BrowserInfoPage results in infinite request loop
[WICKET-6296] - Not possible to add WebSocketBehavior in ajax request

Improvement

[WICKET-6260] - Revert Ajax detection needed for character encoding to WebRequest.isAjax()
[WICKET-6261] - CheckGroupSelector default selection state incorrect when the list of Checks is empty
[WICKET-6271] - IRequestableComponent getPage() javaDoc and Component implementation mismatch
[WICKET-6274] - Add origin header to ajax requests in BaseWicketTester
[WICKET-6282] - Make native web socket message classes serializable

CVE-2016-6806 Apache Wicket CSRF detection vulnerability

2016-11-08T00:00:00+01:00

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Wicket 6.20.0, 6.21.0, 6.22.0, 6.23.0, 6.24.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 and 8.0.0-M1

Description: Affected versions of Apache Wicket provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

Mitigation: 6.x users should upgrade to 6.25.0, 7.x users should upgrade to 7.5.0 and 8.0.0-M1 users should upgrade to 8.0.0-M2.

Credit: This issue was discovered by Gerben Janssen van Doorn

References: https://wicket.apache.org/news

The application developers are recommended to upgrade to:

Users of Wicket verions prior to 6.20 are not affected because the particular component was introduced in 6.20.0.

Apache Wicket 8.0.0-M2 released

2016-10-26T00:00:00+02:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.0.0-M2!

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.0.0-M2</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 8.0.0-M2 source download
Binary: 8.0.0-M2 binary download

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 7 migration guide found at

http://s.apache.org/wicket8migration

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.0.0-M2.zip:

Signature for apache-wicket-8.0.0-M2.tar.gz:

================================

This Release

CHANGELOG for 8.0.0-M2:

Sub-task

[WICKET-6243] - ResourceReferenceAutolink component resolved by AutoLinkResolver ignores session locale changes

Bug

[WICKET-5836] - Update the version of clirr-maven-plugin (current 2.6.1)
[WICKET-5972] - Datepicker “Close” text overlays ‘x’ icon.
[WICKET-6041] - Nested forms / parent FormComponents do not reflect updated model when nested form submitted
[WICKET-6136] - AutoCompleteTextField issue in Android 5.1.1
[WICKET-6161] - SecuritySettings.setEnforceMounts() should be applicable for all kind of pages
[WICKET-6192] - Remove recreateBookmarkablePagesAfterExpiry check in AbstractBookmarkableMapper#mapHandler
[WICKET-6196] - CheckingObjectOutputStream broken in Wicket 7
[WICKET-6198] - Unable to disable a MultiFileUploadField
[WICKET-6202] - Guide: 26.1 Page storing, section HttpSessionDataStore - example code is not correct
[WICKET-6204] - Copy only the provided attributes for Ajax link inclusion
[WICKET-6209] - requesting focus on disabled field fails with error in IE8
[WICKET-6214] - ModalWindow broken on IE
[WICKET-6215] - Test fail when non empty model is set to PasswordTextField
[WICKET-6216] - Problem with queued components and border
[WICKET-6217] - Enclosure broken within Border/Panel
[WICKET-6219] - Fragment fails to report an error in development mode
[WICKET-6220] - TagTester incomplete support for void elements
[WICKET-6221] - WicketTester - missing border path
[WICKET-6222] - renderHead not called with anonymous inner Border class
[WICKET-6225] - Button wrongly sets its model object as ‘value’ attribute
[WICKET-6227] - CharSequenceResource calculates wrong length when there are unicode symbols
[WICKET-6230] - Infinite redirection when using UrlPathPageParametersEncoder
[WICKET-6231] - wicket:enclosure and getVariation().
[WICKET-6232] - When sending binary data from server to client, wicket-websocket-jquery.js throws error “message.indexOf is not a function”
[WICKET-6235] - TableTree#updateNode() fails if no corresponding node is visible
[WICKET-6236] - Files.remove() causes a 5 seconds delay instead of 500ms as was intended
[WICKET-6237] - PageRequestHandlerTracker doesn’t work with IRequestHandlerDelegate
[WICKET-6238] - pub2 Wicket example isn’t switching the beer images
[WICKET-6241] - CheckingObjectOutputStream should track the original instance, before writeReplace()
[WICKET-6242] - Weak concurrency management in AuthenticatedWebSession#signedIn
[WICKET-6244] - Palette does not list unselected options
[WICKET-6245] - Open up CsrfPreventionRequestCycleListener for extension
[WICKET-6249] - Invalid state of LoadableDetachableModel with exception during load()
[WICKET-6250] - FileUploadField does not deteach models and fails to null the reference to the transient fileUploads field if forceCloseStreamsOnDetach is false
[WICKET-6254] - Wicket WebSockets problem behind HTTP proxy without servlet context

Improvement

[WICKET-5866] - Reconsider generics of IConverterLocator#getConverter()
[WICKET-5920] - roll a version of ListDataProvider implementing ISortableDetachable model
[WICKET-6200] - Add default converters for Java 8 classes
[WICKET-6203] - Rename IModel#mapWith() to IModel#combineWith() and reorder the parameters
[WICKET-6206] - Allow to use custom anticache parameter value for Image component
[WICKET-6210] - FileUpload does not support files of zero size
[WICKET-6211] - PasswordTextField should clear password by default
[WICKET-6226] - DOCTYPE URL in properties.xml example in wicket documentation won’t work.
[WICKET-6228] - Hide AuthenticatedWebSession#signOut() from the public API
[WICKET-6229] - Introduce a new setting in ExceptionSettings to control whether to throw exception or log a WARN when requesting for markup id on non-renderable component
[WICKET-6233] - Add component info in the error messages related to WicketTester #assertComponentOnAjaxResponse()
[WICKET-6234] - Log the decrypted url in CryptoMapper for debugging purposes
[WICKET-6239] - Use Response#addHeader() instead of #setContentLength()
[WICKET-6240] - Hook method to display more information on ExceptionErrorPage

New Feature

[WICKET-5623] - Custom Getters and Setters for PropertyResolver
[WICKET-6194] - PushBuilder API integration

Apache Wicket 7.5.0 released

2016-10-26T00:00:00+02:00

The Apache Wicket PMC is proud to announce Apache Wicket 7.5.0!

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>7.5.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 7.5.0 source download
Binary: 7.5.0 binary download

Upgrading from earlier versions

If you upgrade from 7.y.z this release is a drop in replacement. If you come from a version prior to 7.0.0, please read our Wicket 7 migration guide found at

http://s.apache.org/wicket7migrate

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-7.5.0.zip:

Signature for apache-wicket-7.5.0.tar.gz:

================================

This Release

CHANGELOG for 7.5.0:

Sub-task

* [WICKET-6243] - ResourceReferenceAutolink component resolved by AutoLinkResolver ignores session locale changes

Bug

[WICKET-5972] - Datepicker “Close” text overlays ‘x’ icon.
[WICKET-6136] - AutoCompleteTextField issue in Android 5.1.1
[WICKET-6192] - Remove recreateBookmarkablePagesAfterExpiry check in AbstractBookmarkableMapper#mapHandler
[WICKET-6209] - requesting focus on disabled field fails with error in IE8
[WICKET-6214] - ModalWindow broken on IE
[WICKET-6215] - Test fail when non empty model is set to PasswordTextField
[WICKET-6216] - Problem with queued components and border
[WICKET-6217] - Enclosure broken within Border/Panel
[WICKET-6219] - Fragment fails to report an error in development mode
[WICKET-6221] - WicketTester - missing border path
[WICKET-6222] - renderHead not called with anonymous inner Border class
[WICKET-6225] - Button wrongly sets its model object as ‘value’ attribute
[WICKET-6227] - CharSequenceResource calculates wrong length when there are unicode symbols
[WICKET-6230] - Infinite redirection when using UrlPathPageParametersEncoder
[WICKET-6231] - wicket:enclosure and getVariation().
[WICKET-6232] - When sending binary data from server to client, wicket-websocket-jquery.js throws error “message.indexOf is not a function”
[WICKET-6235] - TableTree#updateNode() fails if no corresponding node is visible
[WICKET-6236] - Files.remove() causes a 5 seconds delay instead of 500ms as was intended
[WICKET-6237] - PageRequestHandlerTracker doesn’t work with IRequestHandlerDelegate
[WICKET-6238] - pub2 Wicket example isn’t switching the beer images
[WICKET-6241] - CheckingObjectOutputStream should track the original instance, before writeReplace()
[WICKET-6242] - Weak concurrency management in AuthenticatedWebSession#signedIn
[WICKET-6244] - Palette does not list unselected options
[WICKET-6245] - Open up CsrfPreventionRequestCycleListener for extension
[WICKET-6249] - Invalid state of LoadableDetachableModel with exception during load()
[WICKET-6250] - FileUploadField does not deteach models and fails to null the reference to the transient fileUploads field if forceCloseStreamsOnDetach is false
[WICKET-6254] - Wicket WebSockets problem behind HTTP proxy without servlet context

Improvement

[WICKET-5866] - Reconsider generics of IConverterLocator#getConverter()
[WICKET-6206] - Allow to use custom anticache parameter value for Image component
[WICKET-6210] - FileUpload does not support files of zero size
[WICKET-6211] - PasswordTextField should clear password by default
[WICKET-6226] - DOCTYPE URL in properties.xml example in wicket documentation won’t work.
[WICKET-6229] - Introduce a new setting in ExceptionSettings to control whether to throw exception or log a WARN when requesting for markup id on non-renderable component
[WICKET-6233] - Add component info in the error messages related to WicketTester #assertComponentOnAjaxResponse()
[WICKET-6234] - Log the decrypted url in CryptoMapper for debugging purposes
[WICKET-6239] - Use Response#addHeader() instead of #setContentLength()
[WICKET-6240] - Hook method to display more information on ExceptionErrorPage

New Feature

[WICKET-5623] - Custom Getters and Setters for PropertyResolver

Apache Wicket 6.25.0 released

2016-10-26T00:00:00+02:00

The Apache Wicket PMC is proud to announce Apache Wicket 6.25.0!

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
 <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>6.25.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package

Source: 6.25.0 source download Binary: 6.25.0 binary download

Upgrading from earlier versions

If you upgrade from 6.y.z this release is a drop in replacement. If you come from a version prior to 6.0.0, please read our Wicket 6 migration guide found at

http://s.apache.org/wicket6migration

Have fun!

— The Wicket team

================================

The signatures for the source release artefacts:

Signature for apache-wicket-6.25.0.zip:

Signature for apache-wicket-6.25.0.tar.gz:

================================

This Release

CHANGELOG for 6.25.0:

Sub-task

[WICKET-6218] - backport fix for WICKET-6172 to Wicket 6.x

Bug

[WICKET-5972] - Datepicker “Close” text overlays ‘x’ icon.
[WICKET-6136] - AutoCompleteTextField issue in Android 5.1.1
[WICKET-6209] - requesting focus on disabled field fails with error in IE8
[WICKET-6214] - ModalWindow broken on IE
[WICKET-6219] - Fragment fails to report an error in development mode
[WICKET-6225] - Button wrongly sets its model object as ‘value’ attribute
[WICKET-6227] - CharSequenceResource calculates wrong length when there are unicode symbols
[WICKET-6230] - Infinite redirection when using UrlPathPageParametersEncoder
[WICKET-6232] - When sending binary data from server to client, wicket-websocket-jquery.js throws error “message.indexOf is not a function”
[WICKET-6235] - TableTree#updateNode() fails if no corresponding node is visible
[WICKET-6236] - Files.remove() causes a 5 seconds delay instead of 500ms as was intended
[WICKET-6237] - PageRequestHandlerTracker doesn’t work with IRequestHandlerDelegate
[WICKET-6245] - Open up CsrfPreventionRequestCycleListener for extension
[WICKET-6246] - WebSocket request while Ajax request leads to error regarding HtmlHeaderCotnainer

Improvement

[WICKET-6206] - Allow to use custom anticache parameter value for Image component
[WICKET-6210] - FileUpload does not support files of zero size
[WICKET-6226] - DOCTYPE URL in properties.xml example in wicket documentation won’t work.
[WICKET-6233] - Add component info in the error messages related to WicketTester #assertComponentOnAjaxResponse()
[WICKET-6234] - Log the decrypted url in CryptoMapper for debugging purposes
[WICKET-6239] - Use Response#addHeader() instead of #setContentLength()

Wicket 1.5.16 released

2016-08-05T00:00:00+02:00

This is the sixteenth maintenance release of the Wicket 1.5.x series. This release brings over 2 bug fixes.

CHANGELOG for 1.5.16:

Bug

CVE-2013-2186: Disable (de)serialization of Commons FileUpload items.
CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability

To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>1.5.16</version>
</dependency>

Apache Wicket

Apache Wicket 8.0.0-M4 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 8.0.0-M4:

Bug

Improvement

Tasks

CVE-2016-6793 Apache Wicket deserialization vulnerability

Apache Wicket 8.0.0-M3 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 8.0.0-M3:

Bug

Improvement

New Feature

Apache Wicket 7.6.0 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 7.6.0:

Sub-task

Bug

Improvement

Apache Wicket 6.26.0 released

Upgrading from earlier versions

This Release

CHANGELOG for 6.26.0:

Sub-task

Bug

Improvement

CVE-2016-6806 Apache Wicket CSRF detection vulnerability

The application developers are recommended to upgrade to:

Apache Wicket 8.0.0-M2 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 8.0.0-M2:

Sub-task

Bug

Improvement

New Feature

Apache Wicket 7.5.0 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 7.5.0:

Sub-task

Bug

Improvement

New Feature

Apache Wicket 6.25.0 released

Upgrading from earlier versions

This Release

CHANGELOG for 6.25.0:

Sub-task

Bug

Improvement

Wicket 1.5.16 released

Bug

To use in Maven:

Download the full distribution (including sources)