Bug fixed B65-ZK-1897: Possible Cross-site Scripting Vulnerability 
http://tracker.zkoss.org/browse/ZK-1897
Bug Refixed B65-ZK-1889: zul.lang.wpd is always loaded twice with some
JS package merge configurations

http://tracker.zkoss.org/browse/ZK-1889