Apache Wicket 11.0.0 released

The Apache Wicket PMC is proud to announce Apache Wicket 11.0.0!

Wicket 11 opens the quarterly release schedule. It moves to a current Java and Jakarta baseline, tightens security, makes every component leaner and lets Ajax run without jQuery. Wicket 11 receives fixes until Wicket 12.0.0, due in January 2027. Wicket 10 remains the long-term support release for production, supported until Wicket 14 in July 2027.

Released with it today: Wicket 10.12.0, an update of the LTS, and 9.25.0 and 8.20.0, the final releases of Wicket 9 and 8. With them, Wicket 9 and 8 have reached end of life.

New and noteworthy

A new baseline. Wicket 11 requires Java 21 and runs on Jakarta Servlet 6.1, and its Spring integration moves to Spring 7. Applications on Wicket 10 already use jakarta.servlet, so the step up is your JDK and your container.

More secure by default. Encryption is rebuilt on one authenticated scheme: encrypted URLs and stored pages cannot be altered unnoticed, the scheme generates its own key, and encrypted URLs stay cacheable. Components that write model values into markup escape them consistently, and the content security policy now covers script-src-attr and style-src-attr.

Leaner components. A component keeps its model, behaviors and metadata in one compact state object instead of a packed array. In the benchmarks, reading that state is 30 to 45% faster, and a component tree with Ajax behaviors serializes about 40% smaller, so sessions and the page store carry less.

Ajax without jQuery. A second, plain JavaScript implementation of the Ajax engine with the same client-side API. Opt in, and your pages, including autocomplete, palette and the upload progress bar, no longer download jQuery. jQuery remains the default and now supports jQuery 4.

@Override
protected void init() {
    super.init();
    getJavaScriptLibrarySettings().setWicketAjaxReference(
        WicketAjaxResourceReference.get());
}

Ajax veils. PageVeilBehavior and LocalVeilBehavior in wicket-extensions cover a page or a single component while an Ajax request runs, so a second click on a slow button does not send the request twice. A spinner appears only when the request takes longer than 300 ms.

Using this release

With Apache Maven, update your dependency, and every other Wicket module you use, to the same version:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>11.0.0</version>
</dependency>

Or download the source and the binaries from the Wicket 11 page.

Upgrading from Wicket 10

Move to Java 21 and a container with Jakarta Servlet 6.1 first. The wicket-migration module has an OpenRewrite recipe for the step, org.apache.wicket.MigrateToWicket11; Wicket’s modules describes it. The documentation marks every page that needs Wicket 11 with “Wicket 11+”.

Applications on Wicket 8 or 9 move to Wicket 10 first; both lines have reached end of life with today’s final releases.