Update mvnw, mvn and action versions and enable dependabot for actions

[mbien]

• mvn 3.9.11
• mvnw 3.3.3
• actions v5
• 'github-actions' ecosystem dependabot set to weekly

[neilcsmith-net]

Looks good!

I wish I'd noticed that the wrapper release was coming - just patched a couple elsewhere last week.

I couldn't remember if I'd added the change from apache/maven-wrapper#155 to this already, but evidently not. This might be the time to also bump the runner to macos-15.

[mbien]

wondering what the upgrade process with the checksum is. Because mvn artifacts offer sha512 but no 256, I downloaded the zip manually to produce the sum.

The error msg of the validator should probably mention the sum if it doesn't match the requested sum.

[neilcsmith-net]

Yes, it's a pain! See also apache/maven-wrapper#364 and various other conversations around this and the manual process (eg. apache/maven-wrapper#310).

The error msg of the validator should probably mention the sum if it doesn't match the requested sum.

Not sure what you mean there? But we need to keep SHA in here. CI should fail on wrong hash with a suitable message.

[mbien]

The error msg of the validator should probably mention the sum if it doesn't match the requested sum.

Not sure what you mean there? But we need to keep SHA in here. CI should fail on wrong hash with a suitable message.

I mean that the mvnw launcher could add the two SHA it compared to the error msg instead of simply saying that they don't match. So the dev could paste it into the properties file after upgrade. CI would detect if anything is wrong there anyway.

also: TIL that mvnw supports mvnd already

[mbien]

something like apache/maven-wrapper#366