Apache Wicket
A component-oriented Java web framework: plain Java, plain HTML, no JavaScript build chain.
Open source since 2004 and developed at the Apache Software Foundation.
Release lines
| In service | |
|---|---|
| 10.11.0LTS | For productionSince Mar 2024Until 14.0.0, Jul 2027 |
| 11.0.0 | For new featuresSince Oct 2026Until 12.0.0, Jan 2027 |
| Next | |
| 12.0.0 | Jan 2027 |
| 10.12.0 LTS | Jan 2027 |
| 13.0.0 | Apr 2027 |
| 14.0.0 LTS | Jul 2027 |
| Out of service | |
| 9.24.0 | Ended with 11.0.0 |
| 8.19.0 | Ended with 11.0.0 |
Maven dependency
10.11.0 LTS, for production
<dependency>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-core</artifactId>
<version>10.11.0</version>
</dependency>For new features, use version 11.0.0. It needs Java 21.
Why Wicket
Wicket is a component-oriented, server-side Java web framework. Open source since 2004 and developed at the Apache Software Foundation, it powers long-lived applications that need complex, dynamic pages without a JavaScript build chain.
Every tag with a wicket:id has a component with the same id in Java. Point at a component, or tab to it, and its binding lights up in the markup.
Plain Java and plain HTML
Markup stays HTML that opens in any editor. Behaviour lives in Java. A wicket:id attribute binds a tag to a component, and that is the whole contract: no template language, no JavaScript toolchain.
<h1 wicket:id="message">Message goes here</h1>public class HelloWorld extends WebPage {
public HelloWorld() {
add(new Label("message", "Hello World!"));
}
}Point at a component in the Java code.
Components for complex pages
Pages and components are real Java objects with encapsulation, inheritance and events. Build a panel once, with its own markup, styles and scripts, and reuse it on every page, or ship a whole component library as a JAR.
<wicket:panel>
<label>Street <input wicket:id="street"></label>
<label>City <input wicket:id="city"></label>
</wicket:panel><form wicket:id="form">
<div wicket:id="billing"></div>
<div wicket:id="shipping"></div>
</form>public class AddressPanel extends Panel {
public AddressPanel(String id, IModel<Address> address) {
super(id, new CompoundPropertyModel<>(address));
add(new TextField<String>("street"));
add(new TextField<String>("city"));
}
}
// one component, used twice on the same form
form.add(new AddressPanel("billing", billingAddress));
form.add(new AddressPanel("shipping", shippingAddress));Point at a component in the Java code.
Ajax without writing JavaScript
Update parts of a page from Java. Wicket's Ajax components re-render only the components you add to the request, and come with a solid set of building blocks.
<span wicket:id="count">0</span>
<a wicket:id="increment">Add one</a>Label count = new Label("count", () -> clicks);
add(count.setOutputMarkupId(true));
add(new AjaxLink<Void>("increment") {
@Override
public void onClick(AjaxRequestTarget target) {
clicks++;
target.add(count);
}
});Point at a component in the Java code.
Secure by default
Component paths are session-relative and URLs do not expose your model. You only add what your application needs.
@Override
protected void init() {
super.init();
// CSP is on by default; allow one extra image host
getCspSettings().blocking()
.add(CSPDirective.IMG_SRC, "https://images.example.org");
}Wicket supports a strict Content Security Policy without unsafe-inline: every header contribution gets a nonce automatically.
Tested without a browser
WicketTester renders pages and components in a plain unit test: no browser, no container. Check the rendered markup, click links, submit forms.
WicketTester tester = new WicketTester(new MyApplication());
tester.startPage(HelloWorld.class);
tester.assertLabel("message", "Hello World!");The same id as wicket:id="message" in HelloWorld.html: the test reaches the label through it.
Also included
- Internationalized
- Over 25 languages out of the box, with translations per application, page or component.
- Many tabs, one session
- Automatic page state storage lets users open pages in new tabs and windows safely.
- Dependency injection
- Integrations for CDI, Spring and Guice.
- Jakarta EE
- Use JPA, EJB, Bean Validation and CDI through Wicket's integrations.
- Your JavaScript and CSS
- Global libraries mix cleanly with component-local resources.
- Apache License 2.0
- One of the most permissive open source licenses, since day one.
New in Wicket 11
Wicket 11 opens the quarterly release schedule. It moves to a current Java and Jakarta baseline, tightens security, makes every component leaner and lets Ajax run without jQuery.
A new baseline
Wicket 11 requires Java 21 and runs on Jakarta Servlet 6.1, and its Spring integration moves to Spring 7. Applications on Wicket 10 already use jakarta.servlet, so the step up is your JDK and your container.
- Java
- 21
- Jakarta Servlet
- 6.1
- Spring
- 7
More secure by default
Encryption is rebuilt on one authenticated scheme: encrypted URLs and stored pages cannot be altered unnoticed, the scheme generates its own key, and encrypted URLs stay cacheable. Components that write model values into markup escape them consistently, and the content security policy now covers script-src-attr and style-src-attr.
Leaner components
A component keeps its model, behaviors and metadata in one compact state object instead of a packed array. In the benchmarks, reading that state is 30 to 45% faster, and a component tree with Ajax behaviors serializes about 40% smaller, so sessions and the page store carry less.
- 30–45%
- faster to read component state, in the benchmarks
- 40%
- about that much smaller when a tree with Ajax behaviors is serialized
Ajax without jQuery
A second, plain JavaScript implementation of the Ajax engine with the same client-side API. Opt in, and your pages, including autocomplete, palette and the upload progress bar, no longer download jQuery. jQuery remains the default and now supports jQuery 4.
@Override
protected void init() {
super.init();
getJavaScriptLibrarySettings().setWicketAjaxReference(
WicketAjaxVanillaResourceReference.get());
}Upgrade paths
Two lines run at any time. The LTS is the line for production: it receives security and bug fixes until the next LTS, a year later. The quarterly release brings new features and receives fixes until the next one replaces it. Features are developed on main and carry forward into every release that follows.
| You are on | Your route | Guide |
|---|---|---|
| Wicket 8.x or 9.x |
8.x 9 Java 11 10 LTS Java 17 14 LTS July 2027 End of life since Wicket 11.0.0: no more releases, not even security fixes. For production, move to 10 LTS: it brings |
Migration to Wicket 9 Migration to Wicket 10 |
| Wicket 10.x | Stay on the LTS until Wicket 14, the next LTS, ships in July 2027. Moving to 11 for its new features means Java 21 and Jakarta Servlet 6.1. |
New in Wicket 11 |
| Starting out | Start on the LTS when the application should change slowly, or on 11 to get new features every quarter. |
Quick start |
Announcements
-
A new release cadence for Apache Wicket
Starting with Apache Wicket 11.0, due in the first week of October 2026, Wicket moves to time-based releases: a new major release every three months, and an LTS release once a year.
Built with Wicket
Many applications run on Wicket without saying so. The ones that do are collected in the Built with Wicket feed, with a screenshot and a line about each project.