chore(deps): update dependency maven-wrapper to v3.3.4 by renovate[bot] · Pull Request #99 · filipowm/spring-api

renovate · 2026-04-10T06:01:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
maven-wrapper (source)	`3.1.0` → `3.3.4`

Release Notes

apache/maven-wrapper (maven-wrapper)

`v3.3.4`: 3.3.4

Compare Source

🐛 Bug Fixes

Revert wrapper version removal (#365) @breun

👻 Maintenance

Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @hazendaz

`v3.3.3`: 3.3.3

Compare Source

💥 Breaking changes

Remove wrapper lifecycle (#357) @slawekjaranowski

🚀 New features and improvements

Fix Maven wrapper support for snapshot distributions (#335) @gnodet

🐛 Bug Fixes

[MWRAPPER-143] - The wrapperVersion property is not used in only-script mode (#145) @bdemers
fix: Maven wrapper relative distributionUrl does not work (fixes #272) (#107) @danishcake
Fix Windows Junction Link support in mvnw.cmd (#143) @fp024
[MWRAPPER-158] - Remove incorrect license header (#166) @lbruun
[MWRAPPER-161] - Improve script directory detection when using sh mvnw (#329) @ppkarwasz
[MWRAPPER-162] - Removed dead link was getting 404 (#167) @montu376
[MWRAPPER-159] - Fix shellcheck in mvnw (#168) @slawekjaranowski
[MWRAPPER-146] - Bad substitution on Windows if MVNW_REPOURL is set on script-only (#151) @jahk04
[MWRAPPER-147] - mvnw.cmd fails to launch maven if username contains space (#152) @sebthom
[MWRAPPER-150] - Fails to validate checksums on MacOS Sequoia (#155) @jon-signal
[MWRAPPER-111] - Trim whitespace when reading from properties file (#158) @mhalbritter
[MWRAPPER-153] - Fixed only-mvnw.cmd fails when FIPS mode is enabled on Windows hosts (#157) @zbalkan

📝 Documentation updates

Clarify usage of MAVEN_USER_HOME (#359) @slawekjaranowski
site is now /tools/wrapper (#336) @hboutemy

👻 Maintenance

Use invoker version from parent (#356) @slawekjaranowski
Refresh download page (#354) @slawekjaranowski
Update site descriptor to 2.0.0 (#351) @slawekjaranowski
Enable prevent branch protection rules (#348) @slawekjaranowski
Copy edit docs (#344) @elharo
Prefer @Inject (#343) @elharo
Bump shellcheck to 0.10.0 (#333) @slachiewicz
Enable GitHub Issues (#169) @slawekjaranowski
[MNGSITE-529] - Rename "Goals" to "Plugin Documentation" (#163) @Bukama

📦 Dependency updates

Bump mavenVersion from 3.9.6 to 3.9.11 (#360) @dependabot[bot]
Bump exec-maven-plugin to 3.5.1 in ITs (#355) @slawekjaranowski
Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0 (#350) @dependabot[bot]
Bump org.codehaus.plexus:plexus-archiver from 4.10.0 to 4.10.1 (#349) @dependabot[bot]
Bump actions/checkout from 4 to 5 (#347) @dependabot[bot]
Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#339) @dependabot[bot]
Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#164) @dependabot[bot]
Bump org.apache.maven.resolver:maven-resolver-api from 1.9.20 to 1.9.24 (#334) @dependabot[bot]
Bump org.codehaus.plexus:plexus-io from 3.4.2 to 3.5.1 (#153) @dependabot[bot]
Bump org.codehaus.plexus:plexus-archiver from 4.9.2 to 4.10.0 (#147) @dependabot[bot]
Upgrade to parent pom 45 (#332) @slachiewicz
[MWRAPPER-154] - Bump commons-io:commons-io from 2.16.1 to 2.18.0 (#161) @dependabot[bot]
Bump org.hamcrest:hamcrest from 2.2 to 3.0 (#149) @dependabot[bot]

`v3.3.2`: 3.3.2

Compare Source

Release Notes - Maven Wrapper - Version 3.3.2

Bug

[MWRAPPER-136] - maven-wrapper.properties created with Windows line breaks which mvnw can't handle
[MWRAPPER-137] - Can't match distributionUrl when using MINGW64
[MWRAPPER-139] - Shell scripts break on LF in config for Windows
[MWRAPPER-140] - only-script Type does not honor MAVEN_USER_HOME

Improvement

[MWRAPPER-141] - Use distribution type of existing Maven Wrapper by default

Task

[MWRAPPER-135] - Provide a reliable way to determine the Maven Wrapper type

What's Changed

Bump org.apache.maven.resolver:maven-resolver-api from 1.9.18 to 1.9.20 by @dependabot in #136
[MWRAPPER-135] Provide a reliable way to determine the Maven Wrapper type by @breun in #140
[MWRAPPER-141] Use distribution type of existing Maven Wrapper by default by @breun in #141
MWRAPPER-139: Remove trailing whitespace from fields in properties by @ascopes in #139
[MWRAPPER-140] only-script type does not honor MAVEN_USER_HOME by @cstamas in #142

New Contributors

@breun made their first contribution in #140

Full Changelog: apache/maven-wrapper@maven-wrapper-3.3.1...maven-wrapper-3.3.2

`v3.3.1`: 3.3.1

Compare Source

Release Notes - Maven Wrapper - Version 3.3.1

Improvement

[MWRAPPER-132] - Inlined mvnw Downloader.java uses `new URL(String)`, which is deprecated in Java 21
[MWRAPPER-134] - Provide a reliable way to determine the Maven Wrapper version

What's Changed

[MWRAPPER-132][MWRAPPER-124] port MWRAPPER-124 fix to only-script by @gzm55 in #133
[MWRAPPER-134] Add wrapperVersion to maven-wrapper.properties by @cstamas in #135

Full Changelog: apache/maven-wrapper@maven-wrapper-3.3.0...maven-wrapper-3.3.1

`v3.3.0`: 3.3.0

Compare Source

Release Notes - Maven Wrapper - Version 3.3.0

Bug

[MWRAPPER-86] - Trim trailing slash in Repo URL
[MWRAPPER-103] - Failed to validate Maven Wrapper SHA-256 on Windows
[MWRAPPER-108] - mvnw script fails silently when download fails
[MWRAPPER-112] - Detection of JAVA_HOME fails due to bad quoting
[MWRAPPER-113] - Error and warning output goes to standard output and intermingles with Maven output
[MWRAPPER-120] - Maven wrapper plugin should not create wrapperUrl property for script-only mode
[MWRAPPER-123] - only-mvnw fails on ksh printf implementations
[MWRAPPER-131] - Downloader downloads directly into target file

Improvement

[MWRAPPER-70] - Don't require a pom.xml
[MWRAPPER-104] - Add prettier config for shell scripts
[MWRAPPER-124] - MavenWrapperDownloader uses new URL(String), which is deprecated in Java 21
[MWRAPPER-125] - Make "only-script" the default wrapper

Task

[MWRAPPER-128] - Remove legacy
[MWRAPPER-129] - Set plugin prerequisite to Maven 3.6.3

Dependency upgrade

[MWRAPPER-100] - Declare needed dependencies
[MWRAPPER-115] - Bump org.codehaus.plexus:plexus-archiver from 4.6.2 to 4.9.1
[MWRAPPER-118] - Bump org.codehaus.mojo:mrm-maven-plugin from 1.5.0 to 1.6.0
[MWRAPPER-119] - Upgrade Parent to 41
[MWRAPPER-126] - Upgrade org.codehaus.plexus:plexus-archiver to 4.9.2
[MWRAPPER-127] - Bump commons-io:commons-io from 2.16.0 to 2.16.1
[MWRAPPER-130] - Use Maven parent 42

What's Changed

[MWRAPPER-100] declare used dependencies by @elharo in #95
cleanup a couple more dependency glitches by @elharo in #96
Bump org.junit:junit-bom from 5.9.2 to 5.10.0 by @dependabot in #103
[MWRAPPER-115] Bump org.codehaus.plexus:plexus-archiver from 4.6.2 to 4.8.0 by @dependabot in #105
Bump actions/checkout from 3 to 4 by @dependabot in #108
[MWRAPPER-118] Bump org.codehaus.mojo:mrm-maven-plugin from 1.5.0 to 1.6.0 by @dependabot in #109
Bump org.junit:junit-bom from 5.10.0 to 5.10.1 by @dependabot in #111
[MWRAPPER-119] Upgrade Parent to 41 by @slawekjaranowski in #110
[MWRAPPER-120] - Wrapper Plugin no longer add wrapperUrl property by @bdemers in #114
[MWRAPPER-104] add prettier config for shell by @bmarwell in #84
[MWRAPPER-123] hash string char-by-char for ksh implementations by @bmarwell in #117
[MWRAPPER-115] Bump org.codehaus.plexus:plexus-archiver from 4.8.0 to 4.9.1 by @dependabot in #115
[MWRAPPER-112] Detection of JAVA_HOME fails due to bad quoting by @inkarkat in #102
[MWRAPPER-113] Some mvnw error and warning output goes to standard output by @inkarkat in #106
Bump org.junit:junit-bom from 5.10.1 to 5.10.2 by @dependabot in #118
[MWRAPPER-86] Trim repourl and other checks; tests by @bmarwell in #119
Bump apache/maven-gh-actions-shared from 3 to 4 by @dependabot in #121
Bump org.junit.jupiter:junit-jupiter-api from 5.10.1 to 5.10.2 by @dependabot in #122
[MWRAPPER-124] Avoid Java 21's deprecation of the URL constructors by @rhowe in #120
Bump org.codehaus.plexus:plexus-io from 3.4.1 to 3.4.2 by @dependabot in #116
Bump org.apache.maven.shared:maven-shared-utils from 3.3.4 to 3.4.2 by @dependabot in #113
[MWRAPPER-126] Bump org.codehaus.plexus:plexus-archiver from 4.9.1 to 4.9.2 by @dependabot in #123
Bump commons-io:commons-io from 2.16.0 to 2.16.1 by @dependabot in #124
[MWRAPPER-70] Do not require project by @cstamas in #125
[MWRAPPER-129][MWRAPPER-128] Drop legacy stuff, require Maven 3.6.3+ by @cstamas in #126
[MWRAPPER-125] Make only-script the default by @cstamas in #127
[MWRAPPER-130] Update parent POM to 42 by @cstamas in #129
[MWRAPPER-103] Apply recommended workaround by @cstamas in #132
[MWRAPPER-108] Emit clear error message when download fails on U*IX by @cstamas in #130
[MWRAPPER-131] Make downloader not stream into final target file by @cstamas in #128

New Contributors

@elharo made their first contribution in #95
@inkarkat made their first contribution in #102
@rhowe made their first contribution in #120
@cstamas made their first contribution in #125

Full Changelog: apache/maven-wrapper@maven-wrapper-3.2.0...maven-wrapper-3.3.0

`v3.2.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

augmentcode · 2026-04-10T06:06:46Z

🤖 Augment PR Summary

Summary: Updates the Apache Maven Wrapper configuration and bootstrap scripts so the build uses a newer wrapper JAR and refreshed launcher logic.

Changes:

Bumps wrapperUrl in .mvn/wrapper/maven-wrapper.properties from 3.1.0 to 3.2.0
Regenerates mvnw and mvnw.cmd to the corresponding upstream wrapper scripts (labeled v3.2.0)
Adds a small verbose logging helper and improves wrapper URL parsing (including CRLF handling for wrapperUrl)
Adds optional SHA-256 validation controlled by wrapperSha256Sum in maven-wrapper.properties
Adjusts base-directory detection / path normalization and removes legacy M2_HOME-based logic

Technical Notes: The Maven distribution (distributionUrl) remains pinned to 3.6.1; the main change is the wrapper launcher JAR and its download/validation behavior.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 4 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-04-10T06:06:47Z

 # under the License.
 distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.1/apache-maven-3.6.1-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar


.mvn/wrapper/maven-wrapper.properties:18 pins wrapperUrl to maven-wrapper-3.2.0.jar, but this PR’s title/description indicate an upgrade to 3.3.4. This mismatch can be confusing and may miss fixes expected from the described version bump.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-04-10T06:06:47Z

-  [ -n "$JAVA_HOME" ] &&
-    JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`"
+  [ -n "$JAVA_HOME" ] && [ -d "$JAVA_HOME" ] &&
+    JAVA_HOME="$(cd "$JAVA_HOME" || (echo "cannot cd into $JAVA_HOME."; exit 1); pwd)"


mvnw:89 uses cd "$JAVA_HOME" || (echo ...; exit 1); pwd, but the exit runs in a subshell so pwd will still execute on failure, potentially setting JAVA_HOME to the current directory. That could lead to running with an incorrect JAVA_HOME rather than failing fast.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-04-10T06:06:47Z

    # end of workaround
  done
-  echo "${basedir}"
+  printf '%s' "$(cd "$basedir" || exit 1; pwd)"


mvnw:157 does printf '%s' "$(cd "$basedir" ...; pwd)"; if .mvn isn’t found and basedir stays empty, cd "" resolves to $HOME and returns a non-empty path. That would bypass the later -z "$BASE_DIR" guard and make failures harder to diagnose.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-04-10T06:06:47Z

+# If specified, validate the SHA-256 sum of the Maven wrapper jar file
+wrapperSha256Sum=""
+while IFS="=" read -r key value; do
+  case "$key" in (wrapperSha256Sum) wrapperSha256Sum=$value; break ;;


mvnw:257 reads wrapperSha256Sum without stripping a trailing \r, while the earlier wrapperUrl parsing explicitly removes \r. On Windows/CRLF checkouts this can cause checksum validation to fail even with a correct hash.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

renovate · 2026-05-18T18:02:25Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: .mvn/wrapper/maven-wrapper.properties

Command failed: ./mvnw wrapper:wrapper -Dtype=script
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0    96    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (22) The requested URL returned error: 429
Error: Could not find or load main class org.apache.maven.wrapper.MavenWrapperMain
Caused by: java.lang.ClassNotFoundException: org.apache.maven.wrapper.MavenWrapperMain

renovate Bot requested a review from filipowm April 10, 2026 06:01

augmentcode Bot reviewed Apr 10, 2026

View reviewed changes

chore(deps): update dependency maven-wrapper to v3.3.4

ebb2fcb

renovate Bot force-pushed the renovate/maven-wrapper-3.x branch from 31c0b1c to ebb2fcb Compare May 18, 2026 18:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency maven-wrapper to v3.3.4#99

chore(deps): update dependency maven-wrapper to v3.3.4#99
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-wrapper-3.x

renovate Bot commented Apr 10, 2026

Uh oh!

augmentcode Bot commented Apr 10, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Apr 10, 2026

Uh oh!

augmentcode Bot Apr 10, 2026

Uh oh!

augmentcode Bot Apr 10, 2026

Uh oh!

augmentcode Bot Apr 10, 2026

Uh oh!

renovate Bot commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 10, 2026

Release Notes

v3.3.4: 3.3.4

🐛 Bug Fixes

👻 Maintenance

v3.3.3: 3.3.3

💥 Breaking changes

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

v3.3.2: 3.3.2

Release Notes - Maven Wrapper - Version 3.3.2

Bug

Improvement

Task

What's Changed

New Contributors

v3.3.1: 3.3.1

Release Notes - Maven Wrapper - Version 3.3.1

Improvement

What's Changed

v3.3.0: 3.3.0

Release Notes - Maven Wrapper - Version 3.3.0

Bug

Improvement

Task

Dependency upgrade

What's Changed

New Contributors

v3.2.0

Configuration

Uh oh!

augmentcode Bot commented Apr 10, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

renovate Bot commented May 18, 2026

⚠️ Artifact update problem

File name: .mvn/wrapper/maven-wrapper.properties

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v3.3.4`: 3.3.4

`v3.3.3`: 3.3.3

`v3.3.2`: 3.3.2

`v3.3.1`: 3.3.1

`v3.3.0`: 3.3.0

`v3.2.0`