Apache Wicket

Apache Wicket 11.0.0 released

2026-11-01T11:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 11.0.0, the first release of a new major version of Wicket.

Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org

Wicket 11 lets an application drop jQuery entirely, uses less memory and time per component, moves to Java 21 and Jakarta EE 11, and rebuilds Wicket’s encryption on a single, authenticated API. It is the first major release on our new cadence: a new major release every three months, with a long-term support release every July. Wicket 12 follows in January 2027.

Release cadence and support

Wicket 11 is the first release on the schedule we announced in September: a new major release every three months, and a long-term support (LTS) release every July.

Wicket 12.0.0: January 2027
Wicket 13.0.0: April 2027
Wicket 14.0.0: July 2027, the next LTS release

Only the latest quarterly release receives bug fixes and security fixes, so Wicket 11 receives them until Wicket 12 is out. Wicket 10 is the current LTS release and receives security fixes and applicable bug fixes until Wicket 14 is released. That gives you two ways to stay on a supported version:

follow the quarterly releases: Wicket 11 now, Wicket 12 in January, and so on;
stay on Wicket 10, and move to Wicket 14 when it comes out.

Wicket 9.25.0 and 8.20.0, released on 29 October 2026, were the final releases of the 9.x and 8.x lines; both have reached end of life.

New and noteworthy

Ajax without jQuery

Wicket’s client-side Ajax engine has always been built on jQuery. Wicket 11 adds a second implementation in plain JavaScript with the same public API: Wicket.Ajax, Wicket.Event, Wicket.DOM and the rest. The other framework JavaScript (autocomplete, palette, upload progress, trap focus, the debug bar, native WebSockets) no longer uses jQuery at all, so one line removes jQuery from your application:

@Override
protected void init() {
    super.init();
    getJavaScriptLibrarySettings().setWicketAjaxReference(
        WicketAjaxResourceReference.get());
}

jQuery remains the default in Wicket 11. A future major release is likely to make the plain JavaScript engine the default, so this is a good moment to try it.

Faster and leaner

Wicket 11 keeps a component’s model, behaviors and meta data in a single, simpler structure, and a link or Ajax component no longer carries extra bookkeeping for its behavior ids. Measured against Wicket 10 with the JMH benchmarks in the new wicket-benchmarks module:

	Compared with Wicket 10
Heap per component with an Ajax behavior	72 bytes less
A page of such components, serialized	About 40% smaller
Reading a component’s model	Half the time
Reading the behaviors of an Ajax component	82% less time
Creating and detaching an Ajax component	43% faster, half the allocation
Looking up a property, string resource or markup file	Up to 6.6 times faster, 40–45% less allocation
Writing a 500-component page to the page store	16% less allocation

These are microbenchmarks; what an application gains depends on its pages.

Java 21 and Jakarta EE 11

Wicket 11 moves to the current Java platform: Java 21 and Jakarta EE 11, with Jakarta Servlet 6.1. It is built and tested with Jetty 12.1, Spring 7, CDI 5 with Weld 7, and JUnit 6. Wicket 10 required Java 17, and Wicket 8 ran on Java 8. If your application is still on Java 8, the road runs through Wicket 10 for the move from javax to jakarta, and from there to Wicket 11.

Ajax veils

PageVeilBehavior and LocalVeilBehavior in wicket-extensions block the whole page, or a single component, while an Ajax request runs. A second click on a slow button no longer sends the request twice, and a click elsewhere no longer acts on markup the response is about to replace. A spinner appears only when the request takes longer than 300 ms, and local veils nest, each with its own timings.

Uploads to a resource

FileUploadToResourceField can now take files dropped on any component (FileDropZoneBehavior) and list the chosen files with a remove button (FileListBehavior). Two files of the same name no longer overwrite each other, and a failed upload ends in onUploadFailure() instead of on the error page.

One cryptography API

Wicket 11 replaces its two encryption APIs, one for URLs and one for the page store, with a single ICrypt that always uses authenticated encryption. Choose the scheme with SecuritySettings#setCryptScheme: AES-256-GCM by default, or AES-256-GCM-SIV with Bouncy Castle.

And more

LoadableDetachableModel has new detach hooks: onDetach(T) receives the object that is being detached, and onDetachAlways() runs on every detach
AjaxFormComponentUpdatingBehavior also processes the components inside a FormComponentPanel, so the panel’s model is up to date in onUpdate()

Using this release

With Apache Maven, update your dependency, and every other Wicket module you use, to the same version:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>11.0.0</version>
</dependency>

Or download the source and the binaries from the Wicket 11 page.

Upgrading from Wicket 10

Wicket 11 is not a drop-in replacement for Wicket 10. Move to Java 21 and a container with Jakarta Servlet 6.1 first. The OpenRewrite recipe org.apache.wicket.MigrateToWicket11 in wicket-migration then handles the mechanical changes, including the Wicket version and the new groupId org.apache.wicket.experimental.wicket11 of the experimental modules:

mvn -U org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.recipeArtifactCoordinates=org.apache.wicket:wicket-migration:11.0.0 \
  -Drewrite.activeRecipes=org.apache.wicket.MigrateToWicket11

Check these by hand; the migration guide has the details and the rest of the changes:

Wicket 11 can’t decrypt anything Wicket 10 encrypted. Encrypted URLs bookmarked under Wicket 10 no longer resolve, and pages in an encrypted page store can’t be read back after the upgrade.
Text fields now render required, placeholder and pattern. In a form submitted without Ajax, the browser checks them before Wicket sees the request; put novalidate on the form to keep Wicket’s validation messages.
The Include component and IAuthenticationStrategy, with the “remember me” support of wicket-auth-roles, are removed; both were deprecated in 10.11.0. SignInPanel and SignInPage are now UsernamePasswordPanel and UsernamePasswordPage, and the recipe renames them.
LoadableDetachableModel#detach() is final. Move an override to onDetachAlways(), or to onDetach() if it only applies to an attached model.

Wicket’s modules describes wicket-migration, and the documentation marks every page that needs Wicket 11 with “Wicket 11+”.

Applications on Wicket 8 or 9 move to Wicket 10 first.

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 11.0.0:

Bug

[WICKET-7107] - CSP Header not rendered when using RedirectPolicy.AUTO_REDIRECT
[WICKET-7182] - Wicket Autocomplete calls event on a non jquery object
[WICKET-7186] - wicket 10.9.0 / 10.9.1 leaks File Reaper threads
[WICKET-7189] - make partial page update creation pluggable.
[WICKET-7199] - Vulnerable dependencies need to be updated
[WICKET-7203] - wicket-extensions: Dependency on jackson-databind should be optional in module-info.java
[WICKET-7205] - CSP-Headers not set if RenderPageRequestHandler wrapped in more than one IRequestHandlerDelegates
[GH-1576] - BUG since 10.11.0: Wrong escaping in Button label,while getEscapeModelStrings=false
[GH-1582] - build fails on SignOut
[GH-1593] - Typo in WARN message
[GH-1616] - AsynchronousPageStoreTest.storeAsynchronousContextClosed never observes its own assertions
[GH-1620] - TrapFocusBehavior: Tab/Shift+Tab at trap boundary throws TypeError on wicket-10.x
[GH-1646] - Wicket.Event.remove does not remove a listener added for several event types
[GH-1647] - The WebSocket charts example calls jQuery.parseJSON, which jQuery 4 removed
[GH-1650] - AjaxButton triggering the submit event also submits the form in Firefox
[GH-1658] - The quickstart archetype’s Start.java does not compile against Jetty 12
[GH-1659] - CrossOrigin.USE_CREDENTIALS renders user-credentials instead of use-credentials
[GH-1670] - problems with upload to resource
[GH-1678] - Quickstart archetype: give slf4j-simple test scope
[GH-1688] - WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations)
[GH-1721] - Fix the failures in release.sh found while releasing 9.25.0
[GH-1739] - MigrateToWicket11 leaves the org.apache.wicket dependencies at their Wicket 10 version
[GH-1749] - release.sh generates a wrong staging repository ID and a duplicated changelog

New Feature

[WICKET-7169] - Make partHeaderSizeMax in AbstractFileUpload configurable
[WICKET-7190] - Unified cryptography API
[WICKET-7196] - Allow unescaped wicket:label tags
[GH-1492] - AjaxRequestHandler generation of PartialPageUpdate is not extensible
[GH-1583] - create a version of wicket ajax and all the other standard components that is jQuery independent.
[GH-1614] - Make LoadableDetachableModel#detach() final and add detach hooks that receive the attached object
[GH-1631] - Add Ajax veil behaviors that block the page, or a component, while a request runs
[GH-1669] - multiple file upload to resource + drag and drop files and upload to resource.

Improvement

[WICKET-7135] - Work on deprecation warnings
[WICKET-7144] - Improve Ajax updates of form component panels
[WICKET-7172] - Support new CSP style, script directives
[WICKET-7176] - Bump up CDI API and Weld versions
[WICKET-7179] - add support for jQuery 4.0.0
[WICKET-7184] - Make HTML spec compliant
[WICKET-7187] - JavaScript header items: module for content, and import maps
[WICKET-7188] - Sign file upload resource constraints
[WICKET-7191] - Deprecate HTML5Attributes and move its logic to FormComponet hierarchy
[WICKET-7192] - restrict SourcesPage to resources of the page’s own package
[WICKET-7195] - Add tag type=”search” to those supported by TextField
[WICKET-7200] - Align class-vs-package resolution across the wicket-auth-roles annotations
[WICKET-7204] - Don’t use INJECTION for ByteBuddy proxy creation

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy
[WICKET-7194] - Deprecate and remove Include
[GH-1584] - Redundant japicmp exclusions need to removed
[GH-1699] - Include GitHub issues in the release notes built by build-changelog.sh
[GH-1708] - build-versions.py fails on Python 3 and misses the experimental modules

Apache Wicket 10.12.0 (LTS) is released

2026-10-31T15:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 10.12.0!

This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0.

New and noteworthy

Wicket 10 is the long term support (LTS) version of Apache Wicket going forward. As part of our new release cadence we will support Wicket 10 until Wicket 14, the next LTS version, comes out.

Vulnerable dependencies have been updated (WICKET-7199)
Fixed a regression in 10.11.0: setEscapeModelStrings(false) on a Button had no effect, so markup in a button label was escaped (GH-1576)
CSP headers are now also set when a RenderPageRequestHandler is wrapped in more than one IRequestHandlerDelegate (WICKET-7205)
CrossOrigin.USE_CREDENTIALS now renders use-credentials instead of user-credentials (GH-1659)
The WebSocket request wrappers follow the Servlet header contract: header names are case-insensitive and the header enumerations can be read more than once (GH-1688)
Palette’s “move up” works again, it was broken since 10.9.0 (GH-1618)
TrapFocusBehavior no longer throws a TypeError on Tab or Shift+Tab at the edge of the trap (GH-1620)
Lazy-init proxies, as used by @SpringBean, are no longer created with ByteBuddy’s class injection but defined through a private lookup in the class loader of the proxied type (WICKET-7204)
wicket-extensions: the dependency on jackson-databind is optional in module-info.java (WICKET-7203)
The quickstart archetype’s Start.java now compiles against Jetty 12 (GH-1658)

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>10.12.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: https://wicket.apache.org/versions/wicket-10.x/#manually

Upgrading from earlier versions

If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at

http://s.apache.org/wicket10migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 10.12.0:

Bug

[WICKET-7199] - Vulnerable dependencies need to be updated
[WICKET-7203] - wicket-extensions: Dependency on jackson-databind should be optional in module-info.java
[WICKET-7205] - CSP-Headers not set if RenderPageRequestHandler wrapped in more than one IRequestHandlerDelegates
[GH-1576] - BUG since 10.11.0: Wrong escaping in Button label,while getEscapeModelStrings=false
[GH-1618] - Palette “move up” broken since 10.9.0: moveUpHelper calls box.trigger(‘focus’) on a plain DOM element
[GH-1620] - TrapFocusBehavior: Tab/Shift+Tab at trap boundary throws TypeError on wicket-10.x
[GH-1658] - The quickstart archetype’s Start.java does not compile against Jetty 12
[GH-1659] - CrossOrigin.USE_CREDENTIALS renders user-credentials instead of use-credentials
[GH-1688] - WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations)

Improvement

[WICKET-7204] - Don’t use INJECTION for ByteBuddy proxy creation

Task

[GH-1584] - Redundant japicmp exclusions need to removed
[GH-1699] - Include GitHub issues in the release notes built by build-changelog.sh
[GH-1708] - build-versions.py fails on Python 3 and misses the experimental modules

Apache Wicket 9.25.0 marks the end of Wicket 9

2026-10-29T10:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 9.25.0!

Final release of Wicket 9

This is the final release of Wicket 9. With this release the 9.x branch has reached end of life: there will be no further 9.x releases, not even for security fixes. Wicket now releases a new major version every three months, with a long-term support release once a year. Read about our new release cadence and support policy and see the upgrade options.

We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 9.0.0.

New and noteworthy

Vulnerable dependencies have been updated (WICKET-7199)
Fixed a regression from the Button XSS fix in 9.24.0 (and 10.11.0): setEscapeModelStrings(false) on a Button had no effect, so markup in a button label was escaped (GH-1576)
CSP headers are now also set when a RenderPageRequestHandler is wrapped in more than one IRequestHandlerDelegate (WICKET-7205)

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>9.25.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: https://wicket.apache.org/versions/wicket-9.x/#manually

Upgrading from earlier versions

If you upgrade from 9.y.z this release is a drop in replacement. If you come from a version prior to 9.0.0, please read our Wicket 9 migration guide found at

http://s.apache.org/wicket9migrate

Now that Wicket 9 has reached end of life, plan your move to Wicket 10, our long-term support release, supported until July 2027. For upgrade options see:

https://wicket.apache.org/versions/wicket-9.x/#upgrade

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 9.25.0:

Bug

[WICKET-7199] - Vulnerable dependencies need to be updated
[WICKET-7205] - CSP-Headers not set if RenderPageRequestHandler wrapped in more than one IRequestHandlerDelegates
[GH-1576] - BUG since 10.11.0: Wrong escaping in Button label,while getEscapeModelStrings=false

Task

[GH-1699] - Include GitHub issues in the release notes built by build-changelog.sh
[GH-1708] - build-versions.py fails on Python 3 and misses the experimental modules

Apache Wicket 8.20.0 marks the end of Wicket 8

2026-10-29T09:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.20.0!

Final release of Wicket 8

This is the final release of Wicket 8. With this release the 8.x branch has reached end of life: there will be no further 8.x releases, not even for security fixes. Wicket now releases a new major version every three months, with a long-term support release once a year. Read about our new release cadence and support policy and see the upgrade options.

We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0.

New and noteworthy

Vulnerable dependencies have been updated (WICKET-7199)

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.20.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: https://wicket.apache.org/versions/wicket-8.x/#manually

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at

http://s.apache.org/wicket8migrate

Now that Wicket 8 has reached end of life, plan your move to Wicket 10, our long-term support release, supported until July 2027. For upgrade options see:

https://wicket.apache.org/versions/wicket-8.x/#upgrade

Have fun!

— The Wicket team

========================================================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.20.0.zip:

Signature for apache-wicket-8.20.0.tar.gz:

========================================================================

This Release

CHANGELOG for 8.20.0:

Bug

[WICKET-7199] - Vulnerable dependencies need to be updated

Task

[GH-1699] - Include GitHub issues in the release notes built by build-changelog.sh
[GH-1708] - build-versions.py fails on Python 3 and misses the experimental modules

Wicket 8 and 9 reach end of life soon

2026-10-21T00:00:00+00:00

Apache Wicket 8.x and 9.x each get one final release, and then reach end of life. After that they get no more releases, not even security fixes, and Wicket’s support for the javax.servlet API ends with them. We announce the final releases on the announce list and here on the blog. If your application runs on Wicket 8 or 9, plan the move to Wicket 10 now: it is our long-term support release, supported until July 2027.

What end of life means

After their final release:

no new 8.x or 9.x release ships, for bugs or for vulnerabilities;
every release stays available: on Maven Central, and in the Apache archives;
the users list still helps with questions, but a fix for a problem in 8 or 9 only ships in the lines we still support.

Why we stop

We announced this with the new release cadence. Every security report has to be assessed, fixed, backported and released for each line we support. With four lines that work is done four times, and that is time not spent on improving Wicket itself. Retiring 8 and 9 ends that.

Wicket 8 and 9 are also the last lines on javax.servlet. Jakarta EE 9 moved the Java enterprise APIs to the jakarta namespace in December 2020, almost six years ago, and Wicket 10 moved with it.

How to move to Wicket 10

Wicket 10 requires Java 17 and Jakarta Servlet 5.0 or newer, and its integrations move along: Spring 6, Guice 7 and Commons FileUpload 2.

From Wicket 9, move to 10 directly with the migration guide to Wicket 10. The OpenRewrite recipes of wicket-migration do the repetitive part: the jakarta imports, the Java 17 baseline and the moved Wicket classes.
From Wicket 8, take the Wicket 9 step first, with the migration guide to Wicket 9 and Java 11. Each migration guide covers one major version, so the step to 10 follows from there.

The upgrade paths on the releases page show the route, and the pages of Wicket 9 and Wicket 8 carry it as well.

Need help?

Ask on the users list when the migration raises questions; include your Wicket and Java versions. If you need more hands or more time, several companies offer training, consulting and development for Wicket applications. The Wicket project does not endorse or rank them.

A new release cadence for Apache Wicket

2026-09-11T00:00:00+00:00

Starting with Apache Wicket 11.0, due in the first week of October 2026, Wicket moves to time-based releases: a new major release every three months, and an LTS release once a year. We will do one more release of the 8.x and 9.x branches and then stop supporting those versions entirely, and with them the javax.servlet API. Wicket 10 is our current LTS and remains supported until the release of Wicket 14, expected in the first week of July 2027.

Nothing changes before 11.0 is out. Until then, 10.x, 9.x and 8.x are supported as they are today.

Why we are changing this

Wicket has been around for over twenty years. Where it used to have a very vibrant and active community, development and contributions have slowed down over the past ten years. Partly this is because Wicket has a stable and solid core that simply doesn’t need that much maintenance, but it is also caused by the world moving more to JavaScript-heavy, client-side frameworks. That slowdown also slowed the release cadence, which in turn made it less attractive to contribute, causing even more slowdown.

Over the past six months we have seen a sharp rise in LLM-generated security reports. This helps improve security, but dealing with CVEs takes a lot of time, and that time is currently multiplied by four because of the old versions we support. Time spent on backporting, releasing and documenting those old versions is time not spent on improving Wicket itself.

At the same time, LLMs allow us to perform cleanups and improvements at a larger scale. With major versions years apart, our promise of semantic versioning makes it impossible to deliver those changes to our community in a timely manner.

The new cadence

One major release every three months, each bringing new features. Every fourth major release — once a year — is an LTS release with bugfix and security support until the next LTS. This means we only need to support two active versions at the same time.

In practice that gives the following schedule:

Wicket 11.0.0 — first week of October 2026
Wicket 12.0.0 — January 2027
Wicket 13.0.0 — April 2027
Wicket 14.0.0 — first week of July 2027, our second LTS release, supported until Wicket 18

Wicket 10 is our first LTS release line and stays supported until Wicket 14 is released. Wicket 8 and Wicket 9 each get one more release, after which both are end of life, and with them our support for the javax.servlet API. Applications on 8.x or 9.x should plan their move to 10.x or 11.x now; the migration guide covers the step to Wicket 10.

What “supported until the next major release” means

A question from the user list, worth answering here as well: if there is a major release every quarter, is a feature introduced in one quarter supported for only three months?

No. The support period applies to the release line, not to individual features. New features are developed on main and will normally remain part of subsequent releases, so a feature introduced in Wicket 11 will also be present in 12, 13 and eventually in the next LTS release, Wicket 14. What changes is which release lines receive fixes.

We will develop on main and on the current LTS branch. The LTS branch receives security fixes and applicable bug fixes until the next LTS release. For the quarterly non-LTS releases, only the latest release receives fixes: when Wicket 12 is released we will no longer release fixes for Wicket 11, and when Wicket 13 is released the same applies to Wicket 12.

Bug fixes and security fixes on main will normally be included in the next quarterly release. If an issue is serious enough that it cannot wait, we may do a patch release for the current non-LTS version, for example 13.0.1.

So at any point we expect to maintain at most two release lines: the current LTS and the current quarterly release.

Stability

A large number of applications build on the stability of the Wicket API. This is no different for our community than it is for the team of core developers. That stability is important to the entire Wicket ecosystem and something we do not take lightly. For some changes we do need to break the API, but it is something we will only do if it is really needed. Where possible we will keep the old API as a deprecated alternative for some time to ease migration. API changes are documented in our migration guide.

— The Apache Wicket PMC

A security policy for Apache Wicket

2026-09-08T00:00:00+00:00

Apache Wicket now has a security policy. The SECURITY.md in the Wicket repository describes how to report a vulnerability, what we do and do not assess, and the security model the framework works from: which inputs Wicket treats as trusted, and which boundaries it promises to enforce. It is on master and on the wicket-10.x, wicket-9.x and wicket-8.x branches, so it applies to every line we support.

Why now

Over the past months the number of security reports has grown sharply, many of them produced with tooling or language models. Some point at real problems. Others point at code that does not exist, at versions we no longer support, or at behaviour that depends on a deployment trusting something it should not. Each one costs the same to triage. Writing down what the framework claims, and what it leaves to the application and the operator, lets reporters check their finding before they send it, and lets us answer consistently.

How to report

Report a suspected vulnerability privately to security@apache.org, the ASF security team, who forward it to the Wicket PMC. Never use GitHub issues, pull requests, discussions or the public mailing lists: they disclose the problem before a fix is available.

A useful report names the affected versions and module, the class and method, how an attacker reaches that code and what the attacker controls, the impact, and ideally a failing test. We assess a report against the current tip of a supported branch, so verify it there first and say which commit you tested. How you found it does not matter to us, by hand, with tooling or with a model; whether the code you describe exists does.

What is out of scope

Three kinds of code inside the supported lines are not handled as vulnerabilities:

Deprecated code that an application has to use deliberately. The remedy is to stop using it, and the javadoc says what to do instead.
OriginResourceIsolationPolicy, the fallback that compares Origin and Referer headers. FetchMetadataResourceIsolationPolicy is the supported cross-origin defence.
wicket-examples, which is teaching material and deliberately not production code. We still want to hear about problems in it, and fix them in the open.

What Wicket trusts, and what that means for your application

The security model is worth reading if you run Wicket in production. A few points in it ask something of the deployment:

The host comes from the container. Wicket builds absolute URLs and redirects from the scheme, host and port the servlet container reports, and does not check the Host header itself. Configure the container or proxy to reject unexpected Host values.
X-Forwarded-* headers are ignored unless you enable XForwardedRequestWrapperFactory, and should only be enabled behind a proxy that sets them.
Run production in DEPLOYMENT mode and do not deploy wicket-devutils.
The page store and the session store are trusted storage. An encrypted page store is tamper-evident; anything else that holds serialized Wicket data must not be writable by untrusted parties.
Model data is escaped by default; markup files and message bundles are trusted. Turning off escapeModelStrings makes the content your responsibility, and so does placing a value in a JavaScript context.
Cross-origin listener calls are only refused when you register ResourceIsolationRequestCycleListener. Wicket does not do this by default.
CryptoMapper is not authorization. Encrypted URLs make URLs harder to forge; who may see a page is decided by your IAuthorizationStrategy.

Tell us when the model is wrong

The security model describes what Wicket intends to enforce. If the code falls short of it, that is a vulnerability and we want to hear about it. If you think the model itself is wrong, that is just as useful to report: say so, and we discuss the model instead of a single code path. Findings that are real but not vulnerabilities, such as hardening suggestions, are welcome as public issues or pull requests.

— The Apache Wicket PMC

Apache Wicket 10.11.0 released

2026-08-30T10:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 10.11.0!

This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-71378 Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>10.11.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-10.x.html#manually

Upgrading from earlier versions

If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at

http://s.apache.org/wicket10migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 10.11.0:

New Feature

[WICKET-7196] - Allow unescaped wicket:label tags

Improvement

[WICKET-7192] - restrict SourcesPage to resources of the page’s own package
[WICKET-7195] - Add tag type=”search” to those supported by TextField

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy

Apache Wicket 9.24.0 released

2026-08-30T09:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 9.24.0!

This release marks another minor release of Wicket 9. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 9.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-71378 Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>9.24.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-9.x.html#manually

Upgrading from earlier versions

If you upgrade from 9.y.z this release is a drop in replacement. If you come from a version prior to 9.0.0, please read our Wicket 9 migration guide found at

http://s.apache.org/wicket9migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 9.24.0:

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy

Apache Wicket 8.19.0 released

2026-08-30T08:00:00+00:00

The Apache Wicket PMC is proud to announce Apache Wicket 8.19.0!

This release marks another minor release of Wicket 8. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 8.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>8.19.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-8.x.html#manually

Upgrading from earlier versions

If you upgrade from 8.y.z this release is a drop in replacement. If you come from a version prior to 8.0.0, please read our Wicket 8 migration guide found at

http://s.apache.org/wicket8migrate

Have fun!

— The Wicket team

========================================================================

The signatures for the source release artefacts:

Signature for apache-wicket-8.19.0.zip:

Signature for apache-wicket-8.19.0.tar.gz: