From bc9b589501ec4bb1a03f963b2bdd4b8c09766396 Mon Sep 17 00:00:00 2001
From: Martijn Visser <2989614+MartijnVisser@users.noreply.github.com>
Date: Mon, 24 Aug 2026 11:43:26 +0200
Subject: [PATCH 1/2] [FLINK-40459][build] Bump Maven from 3.8.6 to 3.9.16

Updates the enforcer requireMavenVersion pin, the Maven wrapper
distributionUrl/checksum, and the documented Maven version (README,
AGENTS.md, docs) in lock-step.

Also switches .github/workflows/docs.sh from the CI image's system
Maven to the Maven wrapper: all other CI paths already build through
./mvnw (tools/ci/maven-utils.sh), so this lets the enforcer bump land
without requiring a new flink-ci-docker image.

Maven 3.9 logs plugin executions by goal prefix (dependency:3.2.0:tree)
instead of by artifactId (maven-dependency-plugin:3.2.0:tree). The CI
output parsers in flink-ci-tools now accept both spellings; without that
the bundled-optional, scala-suffix and license checks no longer
recognize any module.

Generated-by: Claude Code (Claude Opus 5)
---
 .github/workflows/docs.sh                          |  6 +++---
 .mvn/wrapper/maven-wrapper.properties              |  4 ++--
 AGENTS.md                                          |  2 +-
 README.md                                          |  2 +-
 docs/content.zh/docs/dev/configuration/maven.md    |  2 +-
 docs/content/docs/dev/configuration/maven.md       |  2 +-
 pom.xml                                            |  2 +-
 .../tools/ci/suffixcheck/ScalaSuffixChecker.java   |  5 ++++-
 .../ci/utils/dependency/DependencyParser.java      | 12 ++++++++++--
 .../flink/tools/ci/utils/deploy/DeployParser.java  |  4 +++-
 .../utils/dependency/DependencyParserCopyTest.java | 14 +++++++++++++-
 .../utils/dependency/DependencyParserTreeTest.java | 14 +++++++++++++-
 .../tools/ci/utils/deploy/DeployParserTest.java    | 11 +++++++++++
 .../tools/ci/utils/shade/ShadeParserTest.java      | 13 ++++++++++++-
 14 files changed, 76 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/docs.sh b/.github/workflows/docs.sh
index 7b37dcdf97366d..185dbfbb287c48 100755
--- a/.github/workflows/docs.sh
+++ b/.github/workflows/docs.sh
@@ -23,7 +23,7 @@ set -e
 export JAVA_HOME=$JAVA_HOME_17_X64
 export PATH=$JAVA_HOME_17_X64/bin:$PATH
 
-mvn --version
+./mvnw --version
 java -version
 javadoc -J-version
 
@@ -62,11 +62,11 @@ ErrorDocument 404 /flink/flink-docs-${BRANCH}/404.html
 EOF
 
 # build Flink; required for Javadoc step
-mvn clean install -B -DskipTests -Dfast -Dskip.npm -Pskip-webui-build
+./mvnw clean install -B -DskipTests -Dfast -Dskip.npm -Pskip-webui-build
 
 # build java/scala docs
 mkdir -p docs/target/api
-mvn javadoc:aggregate -B \
+./mvnw javadoc:aggregate -B \
     -Pskip-webui-build \
     -Dmaven.javadoc.failOnError=true \
     -Dcheckstyle.skip=true \
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
index 0fe40ae8c5c2bf..ccae42cca9e3d0 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -16,7 +16,7 @@
 # under the License.
 
 # updating the Maven version requires updates to certain documentation and verification logic
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.6/apache-maven-3.8.6-bin.zip
-distributionSha256Sum=ccf20a80e75a17ffc34d47c5c95c98c39d426ca17d670f09cd91e877072a9309
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce
 wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
 wrapperSha256Sum=3d8f20ce6103913be8b52aef6d994e0c54705fb527324ceb9b835b338739c7a8
diff --git a/AGENTS.md b/AGENTS.md
index b21b1b52ea0f01..a03fda28842bcf 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -24,7 +24,7 @@ This file provides guidance for AI coding agents working with the Apache Flink c
 ## Prerequisites
 
 - Java 11, 17 (default), or 21. Java 11 syntax must be used in all modules. Java 17 syntax (records, sealed classes, pattern matching) is only permitted in the `flink-tests-java17` module.
-- Maven 3.8.6 (Maven wrapper `./mvnw` included; prefer it)
+- Maven 3.9.16 (Maven wrapper `./mvnw` included; prefer it)
 - Git
 - Unix-like environment (Linux, macOS, WSL, Cygwin)
 
diff --git a/README.md b/README.md
index 1c74da64e88d1f..12befe0fa57f63 100644
--- a/README.md
+++ b/README.md
@@ -103,7 +103,7 @@ Prerequisites for building Flink:
 
 * Unix-like environment (we use Linux, Mac OS X, Cygwin, WSL)
 * Git
-* Maven (we require version 3.8.6)
+* Maven (we require version 3.9.16)
 * Java (version 11, 17, or 21)
 
 ### Basic Build Instructions
diff --git a/docs/content.zh/docs/dev/configuration/maven.md b/docs/content.zh/docs/dev/configuration/maven.md
index dd1bd066979f13..583010384b3543 100644
--- a/docs/content.zh/docs/dev/configuration/maven.md
+++ b/docs/content.zh/docs/dev/configuration/maven.md
@@ -28,7 +28,7 @@ under the License.
 
 ## 要求
 
-- Maven 3.8.6
+- Maven 3.9.16
 - Java 11
 
 ## 将项目导入 IDE
diff --git a/docs/content/docs/dev/configuration/maven.md b/docs/content/docs/dev/configuration/maven.md
index 7c93aef90b23e5..47508d92aa19ab 100644
--- a/docs/content/docs/dev/configuration/maven.md
+++ b/docs/content/docs/dev/configuration/maven.md
@@ -30,7 +30,7 @@ publish, and deploy projects. You can use it to manage the entire lifecycle of y
 
 ## Requirements
 
-- Maven 3.8.6
+- Maven 3.9.16
 - Java 11
 
 ## Importing the project into your IDE
diff --git a/pom.xml b/pom.xml
index 883febb9b8210e..8a88789883ed64 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1879,7 +1879,7 @@ under the License.
 						<configuration>
 							<rules>
 								<requireMavenVersion>
-									<version>[3.8.6]</version>
+									<version>[3.9.16]</version>
 								</requireMavenVersion>
 								<requireJavaVersion>
 									<version>${target.java.version}</version>
diff --git a/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/suffixcheck/ScalaSuffixChecker.java b/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/suffixcheck/ScalaSuffixChecker.java
index b40f7b7ee6d03b..5318085c8f55b4 100644
--- a/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/suffixcheck/ScalaSuffixChecker.java
+++ b/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/suffixcheck/ScalaSuffixChecker.java
@@ -45,8 +45,11 @@ public class ScalaSuffixChecker {
     private static final Logger LOG = LoggerFactory.getLogger(ScalaSuffixChecker.class);
 
     // [INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @ flink-annotations ---
+    // [INFO] --- dependency:3.1.1:tree (default-cli) @ flink-annotations ---
+    // Maven logs the plugin as "maven-dependency-plugin" up to 3.8 and as "dependency" (the goal
+    // prefix) from 3.9 on; both spellings are accepted so the parser works on either Maven version.
     private static final Pattern moduleNamePattern =
-            Pattern.compile(".* --- maven-dependency-plugin.* @ (.*) ---.*");
+            Pattern.compile(".* --- (?:maven-)?dependency(?:-plugin)?:.* @ (.*) ---.*");
 
     // [INFO] +- junit:junit:jar:4.13.2:test
     // [INFO] |  \- org.hamcrest:hamcrest-core:jar:1.3:test
diff --git a/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/dependency/DependencyParser.java b/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/dependency/DependencyParser.java
index 6c164c6f6d666e..61b940c1930005 100644
--- a/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/dependency/DependencyParser.java
+++ b/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/dependency/DependencyParser.java
@@ -39,13 +39,21 @@
 /** Parsing utils for the Maven dependency plugin. */
 public class DependencyParser {
 
+    // Maven logs the plugin as "maven-dependency-plugin" up to 3.8 and as "dependency" (the goal
+    // prefix) from 3.9 on; both spellings are accepted so the parsers work on either Maven version.
+    private static final String DEPENDENCY_PLUGIN = "(?:maven-)?dependency(?:-plugin)?";
+
     private static final Pattern DEPENDENCY_COPY_NEXT_MODULE_PATTERN =
             Pattern.compile(
-                    ".*maven-dependency-plugin:[^:]+:copy .* @ (?<module>[^ _]+)(?:_[0-9.]+)? --.*");
+                    ".*"
+                            + DEPENDENCY_PLUGIN
+                            + ":[^:]+:copy .* @ (?<module>[^ _]+)(?:_[0-9.]+)? --.*");
 
     private static final Pattern DEPENDENCY_TREE_NEXT_MODULE_PATTERN =
             Pattern.compile(
-                    ".*maven-dependency-plugin:[^:]+:tree .* @ (?<module>[^ _]+)(?:_[0-9.]+)? --.*");
+                    ".*"
+                            + DEPENDENCY_PLUGIN
+                            + ":[^:]+:tree .* @ (?<module>[^ _]+)(?:_[0-9.]+)? --.*");
 
     /** See {@link DependencyParserTreeTest} for examples. */
     private static final Pattern DEPENDENCY_TREE_ITEM_PATTERN =
diff --git a/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/deploy/DeployParser.java b/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/deploy/DeployParser.java
index 22fd4893c429bf..977905b99ac82d 100644
--- a/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/deploy/DeployParser.java
+++ b/tools/ci/flink-ci-tools/src/main/java/org/apache/flink/tools/ci/utils/deploy/DeployParser.java
@@ -43,9 +43,11 @@ public class DeployParser {
     // Skipped deployment:
     // [INFO] --- maven-deploy-plugin:2.8.2:deploy (default-deploy) @ flink-parent ---
     // [INFO] Skipping artifact deployment
+    // Maven logs the plugin as "maven-deploy-plugin" up to 3.8 and as "deploy" (the goal prefix)
+    // from 3.9 on; both spellings are accepted so the parser works on either Maven version.
     private static final Pattern DEPLOY_MODULE_PATTERN =
             Pattern.compile(
-                    ".maven-deploy-plugin:.*:deploy .* @ (?<module>[^ _]+)(?:_[0-9.]+)? --.*");
+                    ".*(?:maven-)?deploy(?:-plugin)?:.*:deploy .* @ (?<module>[^ _]+)(?:_[0-9.]+)? --.*");
 
     /**
      * Parses the output of a Maven build where {@code deploy:deploy} was used, and returns a set of
diff --git a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserCopyTest.java b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserCopyTest.java
index 1281c623344e95..824350213bb303 100644
--- a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserCopyTest.java
+++ b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserCopyTest.java
@@ -45,8 +45,20 @@ private static Stream<String> getTestDependencyCopy() {
 
     @Test
     void testCopyParsing() {
+        assertCopyParsing(getTestDependencyCopy());
+    }
+
+    /** Maven 3.9+ logs plugins by their goal prefix instead of their artifactId. */
+    @Test
+    void testCopyParsingWithGoalPrefixedPluginName() {
+        assertCopyParsing(
+                getTestDependencyCopy()
+                        .map(line -> line.replace("maven-dependency-plugin:", "dependency:")));
+    }
+
+    private static void assertCopyParsing(Stream<String> lines) {
         final Map<String, Set<Dependency>> dependenciesByModule =
-                DependencyParser.parseDependencyCopyOutput(getTestDependencyCopy());
+                DependencyParser.parseDependencyCopyOutput(lines);
 
         assertThat(dependenciesByModule).containsOnlyKeys("m1", "m2");
         assertThat(dependenciesByModule.get("m1"))
diff --git a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserTreeTest.java b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserTreeTest.java
index 78eb12f6f430cb..a6cd9786173f67 100644
--- a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserTreeTest.java
+++ b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/dependency/DependencyParserTreeTest.java
@@ -47,8 +47,20 @@ private static Stream<String> getTestDependencyTree() {
 
     @Test
     void testTreeParsing() {
+        assertTreeParsing(getTestDependencyTree());
+    }
+
+    /** Maven 3.9+ logs plugins by their goal prefix instead of their artifactId. */
+    @Test
+    void testTreeParsingWithGoalPrefixedPluginName() {
+        assertTreeParsing(
+                getTestDependencyTree()
+                        .map(line -> line.replace("maven-dependency-plugin:", "dependency:")));
+    }
+
+    private static void assertTreeParsing(Stream<String> lines) {
         final Map<String, DependencyTree> dependenciesByModule =
-                DependencyParser.parseDependencyTreeOutput(getTestDependencyTree());
+                DependencyParser.parseDependencyTreeOutput(lines);
 
         assertThat(dependenciesByModule).containsOnlyKeys("m1", "m2");
         assertThat(dependenciesByModule.get("m1").flatten())
diff --git a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/deploy/DeployParserTest.java b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/deploy/DeployParserTest.java
index a8115d2c50f1f0..bf37632073f678 100644
--- a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/deploy/DeployParserTest.java
+++ b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/deploy/DeployParserTest.java
@@ -35,6 +35,17 @@ void testParseDeployOutputDetectsDeployment() {
                 .containsExactly("flink-parent");
     }
 
+    /** Maven 3.9+ logs plugins by their goal prefix instead of their artifactId. */
+    @Test
+    void testParseDeployOutputDetectsDeploymentWithGoalPrefixedPluginName() {
+        assertThat(
+                        DeployParser.parseDeployOutput(
+                                Stream.of(
+                                        "[INFO] --- deploy:2.8.2:deploy (default-deploy) @ flink-parent ---",
+                                        "[INFO] ")))
+                .containsExactly("flink-parent");
+    }
+
     @Test
     void testParseDeployOutputDetectsDeploymentWithAltRepository() {
         assertThat(
diff --git a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/shade/ShadeParserTest.java b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/shade/ShadeParserTest.java
index 66845907b1a0c2..9e50902e69df11 100644
--- a/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/shade/ShadeParserTest.java
+++ b/tools/ci/flink-ci-tools/src/test/java/org/apache/flink/tools/ci/utils/shade/ShadeParserTest.java
@@ -45,8 +45,19 @@ private static Stream<String> getTestDependencyCopy() {
 
     @Test
     void testParsing() {
+        assertParsing(getTestDependencyCopy());
+    }
+
+    /** Maven 3.9+ logs plugins by their goal prefix instead of their artifactId. */
+    @Test
+    void testParsingWithGoalPrefixedPluginName() {
+        assertParsing(
+                getTestDependencyCopy().map(line -> line.replace("maven-shade-plugin:", "shade:")));
+    }
+
+    private static void assertParsing(Stream<String> lines) {
         final Map<String, Set<Dependency>> dependenciesByModule =
-                ShadeParser.parseShadeOutput(getTestDependencyCopy());
+                ShadeParser.parseShadeOutput(lines);
 
         assertThat(dependenciesByModule).containsOnlyKeys("m1", "m2");
         assertThat(dependenciesByModule.get("m1"))

From 98cdae48967547a86645986f9c12f4227bc3bdc7 Mon Sep 17 00:00:00 2001
From: Martijn Visser <2989614+MartijnVisser@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:51:25 +0200
Subject: [PATCH 2/2] [FLINK-40459][build] Bump Maven Wrapper from 3.3.2 to
 3.3.4

Regenerated with maven-wrapper-plugin 3.3.4 (type=bin). Picks up the
macOS Sequoia checksum verification fix (MWRAPPER-150), whitespace
trimming when reading maven-wrapper.properties, and the path traversal
hardening in MavenWrapperDownloader.

The ASF header and the pinned distribution/wrapper SHA-256 sums are
kept in maven-wrapper.properties; the plugin does not generate those.

Generated-by: Claude Code (Claude Opus 5)
---
 .mvn/wrapper/maven-wrapper.properties |  4 ++--
 mvnw                                  | 30 ++++++++++++++++-----------
 mvnw.cmd                              |  6 +++---
 3 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
index ccae42cca9e3d0..e24c8b3d92bb9d 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -18,5 +18,5 @@
 # updating the Maven version requires updates to certain documentation and verification logic
 distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
 distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
-wrapperSha256Sum=3d8f20ce6103913be8b52aef6d994e0c54705fb527324ceb9b835b338739c7a8
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
+wrapperSha256Sum=4e2fbf6554bc8a4702cdfdd3bef464f423393d784ddbb037216320ce55d5e4e1
diff --git a/mvnw b/mvnw
index 7a34695b137bba..1ddd97b9ee3cec 100755
--- a/mvnw
+++ b/mvnw
@@ -19,7 +19,7 @@
 # ----------------------------------------------------------------------------
 
 # ----------------------------------------------------------------------------
-# Apache Maven Wrapper startup batch script, version 3.3.2
+# Apache Maven Wrapper startup batch script, version 3.3.4
 #
 # Required ENV vars:
 # ------------------
@@ -201,6 +201,14 @@ MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}
 export MAVEN_PROJECTBASEDIR
 log "$MAVEN_PROJECTBASEDIR"
 
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
 ##########################################################################################
 # Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
 # This allows using the maven wrapper in projects that prohibit checking in binary data.
@@ -212,15 +220,13 @@ else
   log "Couldn't find $wrapperJarPath, downloading it ..."
 
   if [ -n "$MVNW_REPOURL" ]; then
-    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
   else
-    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
   fi
   while IFS="=" read -r key value; do
-    # Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' )
-    safeValue=$(echo "$value" | tr -d '\r')
     case "$key" in wrapperUrl)
-      wrapperUrl="$safeValue"
+      wrapperUrl=$(trim "${value-}")
       break
       ;;
     esac
@@ -235,17 +241,17 @@ else
     log "Found wget ... using wget"
     [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--quiet"
     if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
-      wget $QUIET "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+      wget ${QUIET:+"$QUIET"} "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
     else
-      wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+      wget ${QUIET:+"$QUIET"} --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
     fi
   elif command -v curl >/dev/null; then
     log "Found curl ... using curl"
     [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--silent"
     if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
-      curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+      curl ${QUIET:+"$QUIET"} -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
     else
-      curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+      curl ${QUIET:+"$QUIET"} --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
     fi
   else
     log "Falling back to using Java to download"
@@ -276,7 +282,7 @@ fi
 wrapperSha256Sum=""
 while IFS="=" read -r key value; do
   case "$key" in wrapperSha256Sum)
-    wrapperSha256Sum=$value
+    wrapperSha256Sum=$(trim "${value-}")
     break
     ;;
   esac
@@ -288,7 +294,7 @@ if [ -n "$wrapperSha256Sum" ]; then
       wrapperSha256Result=true
     fi
   elif command -v shasum >/dev/null; then
-    if echo "$wrapperSha256Sum  $wrapperJarPath" | shasum -a 256 -c - >/dev/null 2>&1; then
+    if echo "$wrapperSha256Sum  $wrapperJarPath" | shasum -a 256 -c >/dev/null 2>&1; then
       wrapperSha256Result=true
     fi
   else
diff --git a/mvnw.cmd b/mvnw.cmd
index 1204076a90ab82..c453424c6fcfc5 100644
--- a/mvnw.cmd
+++ b/mvnw.cmd
@@ -18,7 +18,7 @@
 @REM ----------------------------------------------------------------------------
 
 @REM ----------------------------------------------------------------------------
-@REM Apache Maven Wrapper startup batch script, version 3.3.2
+@REM Apache Maven Wrapper startup batch script, version 3.3.4
 @REM
 @REM Required ENV vars:
 @REM JAVA_HOME - location of a JDK home dir
@@ -119,7 +119,7 @@ SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
 set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
 set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
 
-set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
 
 FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
     IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
@@ -133,7 +133,7 @@ if exist %WRAPPER_JAR% (
     )
 ) else (
     if not "%MVNW_REPOURL%" == "" (
-        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
     )
     if "%MVNW_VERBOSE%" == "true" (
         echo Couldn't find %WRAPPER_JAR%, downloading it ...