Apache Wicket

Apache Wicket 11.0.0 released

2026-10-26T11:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 11.0.0!

Wicket 11 opens the quarterly release schedule. It moves to a current Java and Jakarta baseline, tightens security, makes every component leaner and lets Ajax run without jQuery. Wicket 11 receives fixes until Wicket 12.0.0, due in January 2027. Wicket 10 remains the long-term support release for production, supported until Wicket 14 in July 2027.

Released with it today: Wicket 10.12.0, an update of the LTS, and 9.25.0 and 8.20.0, the final releases of Wicket 9 and 8. With them, Wicket 9 and 8 have reached end of life.

New and noteworthy

A new baseline. Wicket 11 requires Java 21 and runs on Jakarta Servlet 6.1, and its Spring integration moves to Spring 7. Applications on Wicket 10 already use jakarta.servlet, so the step up is your JDK and your container.

More secure by default. Encryption is rebuilt on one authenticated scheme: encrypted URLs and stored pages cannot be altered unnoticed, the scheme generates its own key, and encrypted URLs stay cacheable. Components that write model values into markup escape them consistently, and the content security policy now covers script-src-attr and style-src-attr.

Leaner components. A component keeps its model, behaviors and metadata in one compact state object instead of a packed array. In the benchmarks, reading that state is 30 to 45% faster, and a component tree with Ajax behaviors serializes about 40% smaller, so sessions and the page store carry less.

Ajax without jQuery. A second, plain JavaScript implementation of the Ajax engine with the same client-side API. Opt in, and your pages, including autocomplete, palette and the upload progress bar, no longer download jQuery. jQuery remains the default and now supports jQuery 4.

@Override
protected void init() {
    super.init();
    getJavaScriptLibrarySettings().setWicketAjaxReference(
        WicketAjaxResourceReference.get());
}

Ajax veils. PageVeilBehavior and LocalVeilBehavior in wicket-extensions cover a page or a single component while an Ajax request runs, so a second click on a slow button does not send the request twice. A spinner appears only when the request takes longer than 300 ms.

Using this release

With Apache Maven, update your dependency, and every other Wicket module you use, to the same version:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>11.0.0</version>
</dependency>

Or download the source and the binaries from the Wicket 11 page.

Upgrading from Wicket 10

Move to Java 21 and a container with Jakarta Servlet 6.1 first. The wicket-migration module has an OpenRewrite recipe for the step, org.apache.wicket.MigrateToWicket11; Wicket’s modules describes it. The documentation marks every page that needs Wicket 11 with “Wicket 11+”.

Applications on Wicket 8 or 9 move to Wicket 10 first; both lines have reached end of life with today’s final releases.

Wicket 8 and 9 have reached end of life

2026-10-26T10:00:00+00:00

Today, together with Wicket 11.0.0, we released Apache Wicket 9.25.0 and 8.20.0: the final releases of both lines. Wicket 9 and 8 have now reached end of life. They get no more releases, not even security fixes, and Wicket’s support for the javax.servlet API ends with them. If your application runs on Wicket 8 or 9, move to Wicket 10, our long-term support release, supported until July 2027, or on to Wicket 11 for new features every quarter.

What end of life means

From today:

no new 8.x or 9.x release ships, for bugs or for vulnerabilities;
every release stays available: on Maven Central, and in the Apache archives;
the users list still helps with questions, but a fix for a problem in 8 or 9 only ships in the lines we still support.

Why we stop

We announced this with the new release cadence. Every security report has to be assessed, fixed, backported and released for each line we support. With four lines that work is done four times, and that is time not spent on improving Wicket itself. Retiring 8 and 9 brings it back to two lines: the LTS and the current quarterly release.

Wicket 8 and 9 are also the last lines on javax.servlet. The Java world moved to the jakarta namespace, and Wicket 10 moved with it.

How to move to Wicket 10

Wicket 10 requires Java 17 and Jakarta Servlet 5.0 or newer, and its integrations move along: Spring 6, Guice 7 and Commons FileUpload 2.

From Wicket 9, move to 10 directly with the migration guide to Wicket 10. The OpenRewrite recipes of wicket-migration do the repetitive part: the jakarta imports, the Java 17 baseline and the moved Wicket classes.
From Wicket 8, take the Wicket 9 step first, with the migration guide to Wicket 9 and Java 11. Each migration guide covers one major version, so the step to 10 follows from there.

The upgrade paths on the releases page show each step, and the pages of Wicket 9 and Wicket 8 list them as well.

Once on Wicket 10, the step to Wicket 11 is your JDK and your container: it needs Java 21 and Jakarta Servlet 6.1.

Need help?

Ask on the users list when the migration raises questions; include your Wicket and Java versions. If you need more hands or more time, several companies offer training, consulting and development for Wicket applications. The Wicket project does not endorse or rank them.

A new release cadence for Apache Wicket

2026-09-11T00:00:00+00:00

Starting with Apache Wicket 11.0, due in the first week of October 2026, Wicket moves to time-based releases: a new major release every three months, and an LTS release once a year. We will do one more release of the 8.x and 9.x branches and then stop supporting those versions entirely, and with them the javax.servlet API. Wicket 10 is our current LTS and remains supported until the release of Wicket 14, expected in the first week of July 2027.

Nothing changes before 11.0 is out. Until then, 10.x, 9.x and 8.x are supported as they are today.

Why we are changing this

Wicket has been around for over twenty years. Where it used to have a very vibrant and active community, development and contributions have slowed down over the past ten years. Partly this is because Wicket has a stable and solid core that simply doesn’t need that much maintenance, but it is also caused by the world moving more to JavaScript-heavy, client-side frameworks. That slowdown also slowed the release cadence, which in turn made it less attractive to contribute, causing even more slowdown.

Over the past six months we have seen a sharp rise in LLM-generated security reports. This helps improve security, but dealing with CVEs takes a lot of time, and that time is currently multiplied by four because of the old versions we support. Time spent on backporting, releasing and documenting those old versions is time not spent on improving Wicket itself.

At the same time, LLMs allow us to perform cleanups and improvements at a larger scale. With major versions years apart, our promise of semantic versioning makes it impossible to deliver those changes to our community in a timely manner.

The new cadence

One major release every three months, each bringing new features. Every fourth major release — once a year — is an LTS release with bugfix and security support until the next LTS. This means we only need to support two active versions at the same time.

In practice that gives the following schedule:

Wicket 11.0.0 — first week of October 2026
Wicket 12.0.0 — January 2027
Wicket 13.0.0 — April 2027
Wicket 14.0.0 — first week of July 2027, our second LTS release, supported until Wicket 18

Wicket 10 is our first LTS release line and stays supported until Wicket 14 is released. Wicket 8 and Wicket 9 each get one more release, after which both are end of life, and with them our support for the javax.servlet API. Applications on 8.x or 9.x should plan their move to 10.x or 11.x now; the migration guide covers the step to Wicket 10.

What “supported until the next major release” means

A question from the user list, worth answering here as well: if there is a major release every quarter, is a feature introduced in one quarter supported for only three months?

No. The support period applies to the release line, not to individual features. New features are developed on main and will normally remain part of subsequent releases, so a feature introduced in Wicket 11 will also be present in 12, 13 and eventually in the next LTS release, Wicket 14. What changes is which release lines receive fixes.

We will develop on main and on the current LTS branch. The LTS branch receives security fixes and applicable bug fixes until the next LTS release. For the quarterly non-LTS releases, only the latest release receives fixes: when Wicket 12 is released we will no longer release fixes for Wicket 11, and when Wicket 13 is released the same applies to Wicket 12.

Bug fixes and security fixes on main will normally be included in the next quarterly release. If an issue is serious enough that it cannot wait, we may do a patch release for the current non-LTS version, for example 13.0.1.

So at any point we expect to maintain at most two release lines: the current LTS and the current quarterly release.

Stability

A large number of applications build on the stability of the Wicket API. This is no different for our community than it is for the team of core developers. That stability is important to the entire Wicket ecosystem and something we do not take lightly. For some changes we do need to break the API, but it is something we will only do if it is really needed. Where possible we will keep the old API as a deprecated alternative for some time to ease migration. API changes are documented in our migration guide.

— The Apache Wicket PMC

A security policy for Apache Wicket

2026-09-08T00:00:00+00:00

Apache Wicket now has a security policy. The SECURITY.md in the Wicket repository describes how to report a vulnerability, what we do and do not assess, and the security model the framework works from: which inputs Wicket treats as trusted, and which boundaries it promises to enforce. It is on master and on the wicket-10.x, wicket-9.x and wicket-8.x branches, so it applies to every line we support.

Why now

Over the past months the number of security reports has grown sharply, many of them produced with tooling or language models. Some point at real problems. Others point at code that does not exist, at versions we no longer support, or at behaviour that depends on a deployment trusting something it should not. Each one costs the same to triage. Writing down what the framework claims, and what it leaves to the application and the operator, lets reporters check their finding before they send it, and lets us answer consistently.

How to report

Report a suspected vulnerability privately to security@apache.org, the ASF security team, who forward it to the Wicket PMC. Never use GitHub issues, pull requests, discussions or the public mailing lists: they disclose the problem before a fix is available.

A useful report names the affected versions and module, the class and method, how an attacker reaches that code and what the attacker controls, the impact, and ideally a failing test. We assess a report against the current tip of a supported branch, so verify it there first and say which commit you tested. How you found it does not matter to us, by hand, with tooling or with a model; whether the code you describe exists does.

What is out of scope

Three kinds of code inside the supported lines are not handled as vulnerabilities:

Deprecated code that an application has to use deliberately. The remedy is to stop using it, and the javadoc says what to do instead.
OriginResourceIsolationPolicy, the fallback that compares Origin and Referer headers. FetchMetadataResourceIsolationPolicy is the supported cross-origin defence.
wicket-examples, which is teaching material and deliberately not production code. We still want to hear about problems in it, and fix them in the open.

What Wicket trusts, and what that means for your application

The security model is worth reading if you run Wicket in production. A few points in it ask something of the deployment:

The host comes from the container. Wicket builds absolute URLs and redirects from the scheme, host and port the servlet container reports, and does not check the Host header itself. Configure the container or proxy to reject unexpected Host values.
X-Forwarded-* headers are ignored unless you enable XForwardedRequestWrapperFactory, and should only be enabled behind a proxy that sets them.
Run production in DEPLOYMENT mode and do not deploy wicket-devutils.
The page store and the session store are trusted storage. An encrypted page store is tamper-evident; anything else that holds serialized Wicket data must not be writable by untrusted parties.
Model data is escaped by default; markup files and message bundles are trusted. Turning off escapeModelStrings makes the content your responsibility, and so does placing a value in a JavaScript context.
Cross-origin listener calls are only refused when you register ResourceIsolationRequestCycleListener. Wicket does not do this by default.
CryptoMapper is not authorization. Encrypted URLs make URLs harder to forge; who may see a page is decided by your IAuthorizationStrategy.

Tell us when the model is wrong

The security model describes what Wicket intends to enforce. If the code falls short of it, that is a vulnerability and we want to hear about it. If you think the model itself is wrong, that is just as useful to report: say so, and we discuss the model instead of a single code path. Findings that are real but not vulnerabilities, such as hardening suggestions, are welcome as public issues or pull requests.

— The Apache Wicket PMC

Apache Wicket 10.11.0 released

2026-08-30T10:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 10.11.0!

Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org

This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-71378 Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>10.11.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-10.x.html#manually

Upgrading from earlier versions

If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at

http://s.apache.org/wicket10migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 10.11.0:

New Feature

[WICKET-7196] - Allow unescaped wicket:label tags

Improvement

[WICKET-7192] - restrict SourcesPage to resources of the page’s own package
[WICKET-7195] - Add tag type=”search” to those supported by TextField

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy

Apache Wicket 9.24.0 released

2026-08-30T09:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 9.24.0!

This release marks another minor release of Wicket 9. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 9.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-71378 Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>9.24.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-9.x.html#manually

Upgrading from earlier versions

If you upgrade from 9.y.z this release is a drop in replacement. If you come from a version prior to 9.0.0, please read our Wicket 9 migration guide found at

http://s.apache.org/wicket9migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 9.24.0:

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy

Apache Wicket 8.19.0 released

2026-08-30T08:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.19.0!

This release marks another minor release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.19.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-8.x.html#manually

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at

http://s.apache.org/wicket8migrate

Have fun!

— The Wicket team

========================================================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.19.0.zip:

Signature for apache-wicket-8.19.0.tar.gz:

========================================================================

This Release

CHANGELOG for 8.19.0:

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy

Apache Wicket 10.10.0 released

2026-07-26T00:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 10.10.0!

This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0.

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>10.10.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-10.x.html#manually

Upgrading from earlier versions

If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at

http://s.apache.org/wicket10migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 10.10.0:

Bug

[WICKET-7107] - CSP Header not rendered when using RedirectPolicy.AUTO_REDIRECT
[WICKET-7182] - Wicket Autocomplete calls event on a non jquery object
[WICKET-7186] - wicket 10.9.0 / 10.9.1 leaks File Reaper threads
[WICKET-7189] - make partial page update creation pluggable.

Improvement

[WICKET-7184] - Make HTML spec compliant
[WICKET-7187] - JavaScript header items: module for content, and import maps
[WICKET-7188] - Sign file upload resource constraints

Apache Wicket 10.9.1 released

2026-05-20T00:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 10.9.1!

This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0.

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>10.9.1</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-10.x.html#manually

Upgrading from earlier versions

If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at

http://s.apache.org/wicket10migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 10.9.1:

[WICKET-7179] - fix broken focus functionality

Apache Wicket 8.18.0 released

2026-05-15T00:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.18.0!

This release marks another minor release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0.

New and noteworthy

CVE-2026-43646 crafted URLs can bypass PackageResourceGuard
CVE-2026-42509 crafted strings can break out of the JavaScript sequence
CVE-2026-40010 possible session fixation using AuthenticatedWebSession

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.18.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-8.x.html#manually

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at

http://s.apache.org/wicket8migrate

Have fun!

— The Wicket team

========================================================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.18.0.zip:

Signature for apache-wicket-8.18.0.tar.gz:

========================================================================

Apache Wicket

Apache Wicket 11.0.0 released

New and noteworthy

Using this release

Upgrading from Wicket 10

Wicket 8 and 9 have reached end of life

What end of life means

Why we stop

How to move to Wicket 10

Need help?

A new release cadence for Apache Wicket

Why we are changing this

The new cadence

What “supported until the next major release” means

Stability

A security policy for Apache Wicket

Why now

How to report

What is out of scope

What Wicket trusts, and what that means for your application

Tell us when the model is wrong

Apache Wicket 10.11.0 released

New and noteworthy

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 10.11.0:

New Feature

Improvement

Task

Apache Wicket 9.24.0 released

New and noteworthy

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 9.24.0:

Task

Apache Wicket 8.19.0 released

New and noteworthy

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 8.19.0:

Task

Apache Wicket 10.10.0 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 10.10.0:

Bug

Improvement

Apache Wicket 10.9.1 released

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 10.9.1:

Apache Wicket 8.18.0 released

New and noteworthy

Using this release

Upgrading from earlier versions

This Release

CHANGELOG for 8.18.0: