The Apache Wicket PMC is proud to announce Apache Wicket 10.12.0! Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org
This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0. New and noteworthy ------------------ Wicket 10 is the long term support (LTS) version of Apache Wicket going forward. As part of our new release cadence we will support Wicket 10 until Wicket 14, the next LTS version, comes out: * https://wicket.apache.org/news/2026/09/11/release-cadence.html Changes in this release: * Vulnerable dependencies have been updated (WICKET-7199) * Fixed a regression in 10.11.0: setEscapeModelStrings(false) on a Button had no effect, so markup in a button label was escaped (GH-1576) * CSP headers are now also set when a RenderPageRequestHandler is wrapped in more than one IRequestHandlerDelegate (WICKET-7205) * CrossOrigin.USE_CREDENTIALS now renders use-credentials instead of user-credentials (GH-1659) * The WebSocket request wrappers follow the Servlet header contract: header names are case-insensitive and the header enumerations can be read more than once (GH-1688) * Palette's "move up" works again, it was broken since 10.9.0 (GH-1618) * TrapFocusBehavior no longer throws a TypeError on Tab or Shift+Tab at the edge of the trap (GH-1620) * Lazy-init proxies, as used by @SpringBean, are no longer created with ByteBuddy's class injection but defined through a private lookup in the class loader of the proxied type (WICKET-7204) * wicket-extensions: the dependency on jackson-databind is optional in module-info.java (WICKET-7203) * The quickstart archetype's Start.java now compiles against Jetty 12 (GH-1658) Using this release ------------------ With Apache Maven update your dependency to (and don't forget to update any other dependencies on Wicket projects to the same version): <dependency> <groupId>org.apache.wicket</groupId> <artifactId>wicket-core</artifactId> <version>10.12.0</version> </dependency> Or download and build the distribution yourself, or use our convenience binary package you can find here: * Download: https://wicket.apache.org/versions/wicket-10.x/#manually Upgrading from earlier versions ------------------------------- If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at * https://s.apache.org/wicket10migrate Have fun! — The Wicket team ======================================================================== CHANGELOG for 10.12.0: ** Bug * [WICKET-7199] - Vulnerable dependencies need to be updated * [WICKET-7203] - wicket-extensions: Dependency on jackson-databind should be optional in module-info.java * [WICKET-7205] - CSP-Headers not set if RenderPageRequestHandler wrapped in more than one IRequestHandlerDelegates * [GH-1576] - BUG since 10.11.0: Wrong escaping in Button label,while getEscapeModelStrings=false * [GH-1618] - Palette "move up" broken since 10.9.0: moveUpHelper calls box.trigger('focus') on a plain DOM element * [GH-1620] - TrapFocusBehavior: Tab/Shift+Tab at trap boundary throws TypeError on wicket-10.x * [GH-1658] - The quickstart archetype's Start.java does not compile against Jetty 12 * [GH-1659] - CrossOrigin.USE_CREDENTIALS renders user-credentials instead of use-credentials * [GH-1688] - WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations) ** Improvement * [WICKET-7204] - Don't use INJECTION for ByteBuddy proxy creation ** Task * [GH-1584] - Redundant japicmp exclusions need to removed * [GH-1699] - Include GitHub issues in the release notes built by build-changelog.sh * [GH-1708] - build-versions.py fails on Python 3 and misses the experimental modules
