The Apache Wicket PMC is proud to announce Apache Wicket 11.0.0, the first release of a new major version of Wicket.

Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org

Wicket 11 lets an application drop jQuery entirely, uses less memory and time per component, moves to Java 21 and Jakarta EE 11, and rebuilds Wicket’s encryption on a single, authenticated API. It is the first major release on our new cadence: a new major release every three months, with a long-term support release every July. Wicket 12 follows in January 2027.

Release cadence and support

Wicket 11 is the first release on the schedule we announced in September: a new major release every three months, and a long-term support (LTS) release every July.

  • Wicket 12.0.0: January 2027
  • Wicket 13.0.0: April 2027
  • Wicket 14.0.0: July 2027, the next LTS release

Only the latest quarterly release receives bug fixes and security fixes, so Wicket 11 receives them until Wicket 12 is out. Wicket 10 is the current LTS release and receives security fixes and applicable bug fixes until Wicket 14 is released. That gives you two ways to stay on a supported version:

  • follow the quarterly releases: Wicket 11 now, Wicket 12 in January, and so on;
  • stay on Wicket 10, and move to Wicket 14 when it comes out.

Wicket 9.25.0 and 8.20.0, released on 29 October 2026, were the final releases of the 9.x and 8.x lines; both have reached end of life.

New and noteworthy

Ajax without jQuery

Wicket’s client-side Ajax engine has always been built on jQuery. Wicket 11 adds a second implementation in plain JavaScript with the same public API: Wicket.Ajax, Wicket.Event, Wicket.DOM and the rest. The other framework JavaScript (autocomplete, palette, upload progress, trap focus, the debug bar, native WebSockets) no longer uses jQuery at all, so one line removes jQuery from your application:

@Override
protected void init() {
    super.init();
    getJavaScriptLibrarySettings().setWicketAjaxReference(
        WicketAjaxResourceReference.get());
}

jQuery remains the default in Wicket 11. A future major release is likely to make the plain JavaScript engine the default, so this is a good moment to try it.

Faster and leaner

Wicket 11 keeps a component’s model, behaviors and meta data in a single, simpler structure, and a link or Ajax component no longer carries extra bookkeeping for its behavior ids. Measured against Wicket 10 with the JMH benchmarks in the new wicket-benchmarks module:

  Compared with Wicket 10
Heap per component with an Ajax behavior 72 bytes less
A page of such components, serialized About 40% smaller
Reading a component’s model Half the time
Reading the behaviors of an Ajax component 82% less time
Creating and detaching an Ajax component 43% faster, half the allocation
Looking up a property, string resource or markup file Up to 6.6 times faster, 40–45% less allocation
Writing a 500-component page to the page store 16% less allocation

These are microbenchmarks; what an application gains depends on its pages.

Java 21 and Jakarta EE 11

Wicket 11 moves to the current Java platform: Java 21 and Jakarta EE 11, with Jakarta Servlet 6.1. It is built and tested with Jetty 12.1, Spring 7, CDI 5 with Weld 7, and JUnit 6. Wicket 10 required Java 17, and Wicket 8 ran on Java 8. If your application is still on Java 8, the road runs through Wicket 10 for the move from javax to jakarta, and from there to Wicket 11.

Ajax veils

PageVeilBehavior and LocalVeilBehavior in wicket-extensions block the whole page, or a single component, while an Ajax request runs. A second click on a slow button no longer sends the request twice, and a click elsewhere no longer acts on markup the response is about to replace. A spinner appears only when the request takes longer than 300 ms, and local veils nest, each with its own timings.

Uploads to a resource

FileUploadToResourceField can now take files dropped on any component (FileDropZoneBehavior) and list the chosen files with a remove button (FileListBehavior). Two files of the same name no longer overwrite each other, and a failed upload ends in onUploadFailure() instead of on the error page.

One cryptography API

Wicket 11 replaces its two encryption APIs, one for URLs and one for the page store, with a single ICrypt that always uses authenticated encryption. Choose the scheme with SecuritySettings#setCryptScheme: AES-256-GCM by default, or AES-256-GCM-SIV with Bouncy Castle.

And more

  • LoadableDetachableModel has new detach hooks: onDetach(T) receives the object that is being detached, and onDetachAlways() runs on every detach
  • AjaxFormComponentUpdatingBehavior also processes the components inside a FormComponentPanel, so the panel’s model is up to date in onUpdate()

Using this release

With Apache Maven, update your dependency, and every other Wicket module you use, to the same version:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>11.0.0</version>
</dependency>

Or download the source and the binaries from the Wicket 11 page.

Upgrading from Wicket 10

Wicket 11 is not a drop-in replacement for Wicket 10. Move to Java 21 and a container with Jakarta Servlet 6.1 first. The OpenRewrite recipe org.apache.wicket.MigrateToWicket11 in wicket-migration then handles the mechanical changes, including the Wicket version and the new groupId org.apache.wicket.experimental.wicket11 of the experimental modules:

mvn -U org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.recipeArtifactCoordinates=org.apache.wicket:wicket-migration:11.0.0 \
  -Drewrite.activeRecipes=org.apache.wicket.MigrateToWicket11

Check these by hand; the migration guide has the details and the rest of the changes:

  • Wicket 11 can’t decrypt anything Wicket 10 encrypted. Encrypted URLs bookmarked under Wicket 10 no longer resolve, and pages in an encrypted page store can’t be read back after the upgrade.
  • Text fields now render required, placeholder and pattern. In a form submitted without Ajax, the browser checks them before Wicket sees the request; put novalidate on the form to keep Wicket’s validation messages.
  • The Include component and IAuthenticationStrategy, with the “remember me” support of wicket-auth-roles, are removed; both were deprecated in 10.11.0. SignInPanel and SignInPage are now UsernamePasswordPanel and UsernamePasswordPage, and the recipe renames them.
  • LoadableDetachableModel#detach() is final. Move an override to onDetachAlways(), or to onDetach() if it only applies to an attached model.

Wicket’s modules describes wicket-migration, and the documentation marks every page that needs Wicket 11 with “Wicket 11+”.

Applications on Wicket 8 or 9 move to Wicket 10 first.

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 11.0.0:

Bug
  • [WICKET-7107] - CSP Header not rendered when using RedirectPolicy.AUTO_REDIRECT
  • [WICKET-7182] - Wicket Autocomplete calls event on a non jquery object
  • [WICKET-7186] - wicket 10.9.0 / 10.9.1 leaks File Reaper threads
  • [WICKET-7189] - make partial page update creation pluggable.
  • [WICKET-7199] - Vulnerable dependencies need to be updated
  • [WICKET-7203] - wicket-extensions: Dependency on jackson-databind should be optional in module-info.java
  • [WICKET-7205] - CSP-Headers not set if RenderPageRequestHandler wrapped in more than one IRequestHandlerDelegates
  • [GH-1576] - BUG since 10.11.0: Wrong escaping in Button label,while getEscapeModelStrings=false
  • [GH-1582] - build fails on SignOut
  • [GH-1593] - Typo in WARN message
  • [GH-1616] - AsynchronousPageStoreTest.storeAsynchronousContextClosed never observes its own assertions
  • [GH-1620] - TrapFocusBehavior: Tab/Shift+Tab at trap boundary throws TypeError on wicket-10.x
  • [GH-1646] - Wicket.Event.remove does not remove a listener added for several event types
  • [GH-1647] - The WebSocket charts example calls jQuery.parseJSON, which jQuery 4 removed
  • [GH-1650] - AjaxButton triggering the submit event also submits the form in Firefox
  • [GH-1658] - The quickstart archetype’s Start.java does not compile against Jetty 12
  • [GH-1659] - CrossOrigin.USE_CREDENTIALS renders user-credentials instead of use-credentials
  • [GH-1670] - problems with upload to resource
  • [GH-1678] - Quickstart archetype: give slf4j-simple test scope
  • [GH-1688] - WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations)
  • [GH-1721] - Fix the failures in release.sh found while releasing 9.25.0
  • [GH-1739] - MigrateToWicket11 leaves the org.apache.wicket dependencies at their Wicket 10 version
  • [GH-1749] - release.sh generates a wrong staging repository ID and a duplicated changelog
New Feature
  • [WICKET-7169] - Make partHeaderSizeMax in AbstractFileUpload configurable
  • [WICKET-7190] - Unified cryptography API
  • [WICKET-7196] - Allow unescaped wicket:label tags
  • [GH-1492] - AjaxRequestHandler generation of PartialPageUpdate is not extensible
  • [GH-1583] - create a version of wicket ajax and all the other standard components that is jQuery independent.
  • [GH-1614] - Make LoadableDetachableModel#detach() final and add detach hooks that receive the attached object
  • [GH-1631] - Add Ajax veil behaviors that block the page, or a component, while a request runs
  • [GH-1669] - multiple file upload to resource + drag and drop files and upload to resource.
Improvement
  • [WICKET-7135] - Work on deprecation warnings
  • [WICKET-7144] - Improve Ajax updates of form component panels
  • [WICKET-7172] - Support new CSP style, script directives
  • [WICKET-7176] - Bump up CDI API and Weld versions
  • [WICKET-7179] - add support for jQuery 4.0.0
  • [WICKET-7184] - Make HTML spec compliant
  • [WICKET-7187] - JavaScript header items: module for content, and import maps
  • [WICKET-7188] - Sign file upload resource constraints
  • [WICKET-7191] - Deprecate HTML5Attributes and move its logic to FormComponet hierarchy
  • [WICKET-7192] - restrict SourcesPage to resources of the page’s own package
  • [WICKET-7195] - Add tag type=”search” to those supported by TextField
  • [WICKET-7200] - Align class-vs-package resolution across the wicket-auth-roles annotations
  • [WICKET-7204] - Don’t use INJECTION for ByteBuddy proxy creation
Task
  • [WICKET-7193] - Deprecate and remove IAuthenticationStrategy
  • [WICKET-7194] - Deprecate and remove Include
  • [GH-1584] - Redundant japicmp exclusions need to removed
  • [GH-1699] - Include GitHub issues in the release notes built by build-changelog.sh
  • [GH-1708] - build-versions.py fails on Python 3 and misses the experimental modules