Skip to content

build(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.1.1 to 3.3.4 - #923

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/org.apache.maven.wrapper-maven-wrapper-3.3.4
Open

build(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.1.1 to 3.3.4#923
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/org.apache.maven.wrapper-maven-wrapper-3.3.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor

Bumps org.apache.maven.wrapper:maven-wrapper from 3.1.1 to 3.3.4.

Release notes

Sourced from org.apache.maven.wrapper:maven-wrapper's releases.

3.3.4

🐛 Bug Fixes

👻 Maintenance

  • Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @​hazendaz

3.3.3

💥 Breaking changes

🚀 New features and improvements

  • Fix Maven wrapper support for snapshot distributions (#335) @​gnodet

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 524486a [maven-release-plugin] prepare release maven-wrapper-3.3.4
  • 17c1ec9 Revert wrapper version removal (#365)
  • 366207f Ensure Path Traversal is fully addressed in MavenWrapperDownloader
  • 086b1c9 [maven-release-plugin] prepare for next development iteration
  • e2a0c81 [maven-release-plugin] prepare release maven-wrapper-3.3.3
  • 80952cd Clarify usage of MAVEN_USER_HOME
  • 08e7200 Remove wrapper lifecycle
  • 36886fa Support for snapshot distributions - fix (#352)
  • d02d845 Use invoker version from parent
  • af7671b Bump mavenVersion from 3.9.6 to 3.9.11 (#360)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Bumps org.apache.maven.wrapper:maven-wrapper from 3.1.1 to 3.3.4 to adopt the script-only wrapper and include recent fixes. Previously the wrapper bootstrapped via maven-wrapper.jar and wrapperUrl; now the scripts download Maven directly with distributionType=only-script. The configured Maven distribution remains 3.8.5.

Review and rollout notes

  • Updates mvnw and mvnw.cmd to 3.3.4; Windows launcher is now a Batch + PowerShell script.
  • .mvn/wrapper/maven-wrapper.properties: adds wrapperVersion=3.3.4 and distributionType=only-script; removes wrapperUrl.
  • Scripts use wget/curl (or Java as fallback) and unzip/tar; ensure these are available in CI. Windows requires PowerShell with Expand-Archive.
  • Optional checksum via distributionSha256Sum is supported; path traversal issues in the downloader are addressed upstream.
  • First run will cache Maven under ~/.m2/wrapper/dists; no build behavior changes expected.

Written for commit 106e315. Summary will update on new commits.

Review in cubic

Bumps [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper) from 3.1.1 to 3.3.4.
- [Release notes](https://github.com/apache/maven-wrapper/releases)
- [Commits](apache/maven-wrapper@maven-wrapper-3.1.1...maven-wrapper-3.3.4)

---
updated-dependencies:
- dependency-name: org.apache.maven.wrapper:maven-wrapper
  dependency-version: 3.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants