Apache Wicket 11
A component-oriented Java web framework: plain Java, plain HTML, no JavaScript build chain.
A long-term support release every year for production. A major release with new features every quarter.
| When | Release | Service | Supported | Status |
|---|---|---|---|---|
| Since Mar 2024 | 10.11.0 | LTS | Until 14.0.0, Jul 2027 | For production |
| Since Oct 2026 | 11.0.0 | Quarterly | Until 12.0.0, Jan 2027 | For new features |
Next 12.0.0 Jan 2027 10.12.0 LTS Jan 2027 14.0.0 LTS Jul 2027
Out of service 9.24.0 8.19.0 Ended with 11.0.0. How to upgrade
Why Wicket
Wicket is a component-oriented, server-side Java web framework. Open source since 2004 and developed at the Apache Software Foundation, it powers long-lived applications that need complex, dynamic pages without a JavaScript build chain.
-
Plain Java and plain HTML
Markup stays HTML that opens in any editor. Behaviour lives in Java. A
wicket:idattribute binds a tag to a component, and that is the whole contract: no template language, no JavaScript toolchain.HelloWorld.html
<h1 wicket:id="message">Message goes here</h1>HelloWorld.java
public class HelloWorld extends WebPage { public HelloWorld() { add(new Label("message", "Hello World!")); } } -
Components for complex pages
Pages and components are real Java objects with encapsulation, inheritance and events. Build a panel once, with its own markup, styles and scripts, and reuse it on every page, or ship a whole component library as a JAR.
AddressPanel.java
public class AddressPanel extends Panel { public AddressPanel(String id, IModel<Address> address) { super(id, new CompoundPropertyModel<>(address)); add(new TextField<String>("street")); add(new TextField<String>("city")); } } // one component, used twice on the same form form.add(new AddressPanel("billing", billingAddress)); form.add(new AddressPanel("shipping", shippingAddress)); -
Ajax without writing JavaScript
Update parts of a page from Java. Wicket's Ajax components re-render only the components you add to the request, and come with a solid set of building blocks.
CounterPage.java
Label count = new Label("count", () -> clicks); add(count.setOutputMarkupId(true)); add(new AjaxLink<Void>("increment") { @Override public void onClick(AjaxRequestTarget target) { clicks++; target.add(count); } }); -
Secure by default
Component paths are session-relative and URLs do not expose your model. Wicket supports a strict Content Security Policy without
unsafe-inline: every header contribution gets a nonce automatically. You only add what your application needs.MyApplication.java
@Override protected void init() { super.init(); // CSP is on by default; allow one extra image host getCspSettings().blocking() .add(CSPDirective.IMG_SRC, "https://images.example.org"); } -
Tested without a browser
WicketTester renders pages and components in a plain unit test: no browser, no container. Check the rendered markup, click links, submit forms.
HelloWorldTest.java
WicketTester tester = new WicketTester(new MyApplication()); tester.startPage(HelloWorld.class); tester.assertLabel("message", "Hello World!");
Also included
- Internationalized
- Over 25 languages out of the box, with translations per application, page or component.
- Many tabs, one session
- Automatic page state storage lets users open pages in new tabs and windows safely.
- Dependency injection
- Integrations for CDI, Spring and Guice.
- Jakarta EE
- Use JPA, EJB, Bean Validation and CDI through Wicket's integrations.
- Your JavaScript and CSS
- Global libraries mix cleanly with component-local resources.
- Apache License 2.0
- One of the most permissive open source licenses, since day one.
Built with Wicket
Many applications run on Wicket without saying so. These say so, collected through the Built with Wicket feed. Submit your own project.
New in Wicket 11
Everything about Wicket 11Wicket 11 opens the quarterly release schedule. It moves to a current Java and Jakarta baseline, tightens security, makes every component leaner and lets Ajax run without jQuery.
-
A new baseline
Wicket 11 requires Java 21 and runs on Jakarta Servlet 6.1, and its Spring integration moves to Spring 7. Applications on Wicket 10 already use
jakarta.servlet, so the step up is your JDK and your container.- Java
- 21
- Jakarta Servlet
- 6.1
- Spring
- 7
-
More secure by default
Encryption is rebuilt on one authenticated scheme: encrypted URLs and stored pages cannot be altered unnoticed, the scheme generates its own key, and encrypted URLs stay cacheable. Components that write model values into markup escape them consistently, and the content security policy now covers
script-src-attrandstyle-src-attr. -
Leaner components
A component keeps its model, behaviors and metadata in one compact state object instead of a packed array. In the benchmarks, reading that state is 30 to 45% faster, and a component tree with Ajax behaviors serializes about 40% smaller, so sessions and the page store carry less.
-
Ajax without jQuery
A second, plain JavaScript implementation of the Ajax engine with the same client-side API. Opt in, and your pages, including autocomplete, palette and the upload progress bar, no longer download jQuery. jQuery remains the default and now supports jQuery 4.
WicketApplication.java
@Override protected void init() { super.init(); getJavaScriptLibrarySettings().setWicketAjaxReference( WicketAjaxResourceReference.get()); }
Announcements
-
A new release cadence for Apache Wicket
Starting with Apache Wicket 11.0, due in the first week of October 2026, Wicket moves to time-based releases: a new major release every three months, and an LTS release once a year. We will do one more release of the 8.x and 9.x branches and...