Changes
Component placeholders and form hidden fields
Hidden markup generated by Component placeholders and forms is no longer hidden with style="display:none;" but with HTML5 "hidden" attribute instead:
https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/hidden
Applications must ensure that their CSS do not reveal this markup, e.g. by falsely changing the CSS display:
/* applied to *all* divs, including hidden */ div { display: flex; } /* fix */ *[hidden] { display: none; }
IPageStore rework - WICKET-6563Getting issue details... STATUS
Storage of pages was reworked:
- PageStoreManager was broken up into specific managers for storing pages in the request and session and further storage
- IPageStore and IDataStore were unified
Most application code should be uneffected by this change, IPageManager stays the central mediator between the application and page storage(s).
Users might consider utilizing new features as:
- CryptingPageStore for encryption of persisted pages
- FilePageStore with improvements for storing of pages that receive alternating requests
Stores in https://github.com/wicketstuff/core/wiki/DataStores were also updated.
PriorityHeadItems siblings ordering - WICKET-6673Getting issue details... STATUS
The order of siblings' PriorityHeaderItems are now preserved.
Content Security Policy - WICKET-6733Getting issue details... STATUS
A strict content security policy (CSP) is now in effect in Wicket 9. This policy forbids any inline javascript and styling. This includes inline javascript event handlers. This CSP greatly enhances the security of a web application, but it can be difficult to make a large application compliant. See - WICKET-6687Getting issue details... STATUS for the changes that were made in Wicket for this change.
The documentation on the configuration of the CSP and guidelines for fixing violations can be found in the user guide: https://ci.apache.org/projects/wicket/guide/9.x/single.html#_content_security_policy_csp
While we do not recommend disabling the CSP entirely, this can be done with one line of code in your application's init method:
getCsp().blocking().disable();
Disabling the CSP will not make your application less secure than it was with Wicket 8, but you will miss the extra protection against attacks like XSS.
API Changes
Deprecate package org.apache.wicket.util.time from wicket-util - WICKET-6662Getting issue details... STATUS
Wicket used custom classes from package org.apache.wicket.util.time to handle and manipulate time entities such as "duration" or "current instant".
These classes have been replaced with standard Java 8 classes java.time.Duration and java.time.Instant.
Deprecate ModalWindow from wicket-extension - WICKET-6666Getting issue details... STATUS
ModalWindow was deprecated and its usage should be replaced with the new ModalDialog implementation.
Removals
Removed from wicket-core all the deprecated classes - WICKET-6562Getting issue details... STATUS
Several deprecated classes were removed from wicket-core:
org/apache/wicket/RequestListenerInterface.java
org/apache/wicket/markup/IMarkup.java
org/apache/wicket/model/AbstractReadOnlyModel.java
org/apache/wicket/model/IChainingModel.java
org/apache/wicket/protocol/http/documentvalidation/Comment.java
org/apache/wicket/protocol/http/documentvalidation/DocumentElement.java
org/apache/wicket/protocol/http/documentvalidation/HtmlDocumentParser.java
org/apache/wicket/protocol/http/documentvalidation/HtmlDocumentValidator.java
org/apache/wicket/protocol/http/documentvalidation/Tag.java
org/apache/wicket/protocol/http/documentvalidation/TextContent.java
org/apache/wicket/request/cycle/AbstractRequestCycleListener.java
Browser User agent detection - WICKET-6544Getting issue details... STATUS
Wicket's user agent detection was removed (was deprecated in Wicket 8.x), as the API and implementation was not sufficient for modern browsers. Users are encouraged to utilize https://github.com/nielsbasjes/yauaa
IE<11 and other browser workarounds - WICKET-6667Getting issue details... STATUS
Several workarounds for older browsers were removed. The special JavaScript event "inputchange" for IE is no longer supported and should be replaced with the standard "input change" instead.
AjaxFormChoiceComponentUpdatingBehavior and FormComponentUpdatingBehavior "change" event - WICKET-6718Getting issue details... STATUS
Behaviors to update form components always use the "change" JavaScript event now, the previous workaround with "click" for IE<9 was removed.
Dependencies
Wicket 9.0 requires Java 11
Upgrade JUnit to version 5 - WICKET-6595Getting issue details... STATUS
All **Tester classes (e.g. WicketTester, FormTester, TagTester, WebSocketTester) now depend on JUnit 5.x instead of 4.x.
Update CDI integration to CDI 2.0 specification - WICKET-6581Getting issue details... STATUS
The old wicket-cdi module based on CDI 1.0 has been replaced with wicket-cdi-1.1 module (based on CDI 1.1), which has been updated to CDI 2.0. No code change or API break has been required for this update, hence those who were using wicket-cdi-1.1 should have no problem migrating to the new wicket-cdi module.
Use JQuery 3.x by default - WICKET-6596Getting issue details... STATUS
JQuery 2.x is not maintained anymore by jQuery team. Wicket will use by default latest available 3.x version.
Upgrade Apache Velocity to 2.x - WICKET-6653Getting issue details... STATUS
wicket-velocity module now uses org.apache.velocity:velocity-engine-core:2.1 dependency instead of org.apache.velocity:velocity:1.7. Because of this change there are small API changes in the signature of the Wicket Model used for the variables.
Overall updates
All libraries on which Wicket modules depend are updated to their latest stable versions.
The most notable ones are: