dependabot[bot] opened a new pull request, #3131: URL: https://github.com/apache/cxf/pull/3131
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.46. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.46</h2> <h3>Added</h3> <ul> <li>Spring AI Alibaba: unconditional <code>TOOL_CALLING</code> / <code>TOOL_APPROVAL</code> / <code>TOKEN_USAGE</code> (<code>534317f03d</code>) — <code>UsageCapturingChatModel</code> wraps the configured Spring AI <code>ChatModel</code> bean at auto-configuration time; per-thread accumulator captures <code>ChatResponseMetadata.getUsage()</code> across every step of the ReAct graph and emits a single <code>session.usage(TokenUsage)</code> after each dispatch. Tool calling is no longer gated on <code>staticChatModel != null</code> — <code>SpringAiAlibabaToolBridge</code> is wired on every dispatch with tools, and the runtime fails fast with <code>configurationHint()</code> if <code>ChatModel</code> is missing. Closes the last conditional capability gap from the runtime parity push (<code>62a9b7e6af</code>).</li> <li>RAG vector-store matrix expanded with three direct connectors (<code>31d6455a75</code>): <code>PgVectorContextProvider</code> (Postgres + pgvector via JDBC), <code>QdrantContextProvider</code> (Qdrant REST over <code>java.net.http.HttpClient</code>), and <code>PineconeContextProvider</code> (Pinecone REST). Each connector embeds the user query through <code>EmbeddingRuntime</code>, validates caller-controlled identifiers at construction time per Boundary-Safety invariant, and ships with a Mockito-backed unit-test suite. <code>modules/rag/README.md</code> adds a reachability matrix showing the six direct providers plus the Spring AI / LangChain4j bridges covering the long tail (Weaviate, Milvus, Chroma, Elasticsearch, Redis Stack, MongoDB Atlas, OpenSearch, Cassandra).</li> <li>Workflow authoring inside the admin control plane (<code>81ff454177</code>) — <code>WorkflowManifest</code> JSON record, <code>WorkflowStore</code> SPI with <code>InMemoryWorkflowStore</code> default and optimistic-concurrency version conflict detection, <code>WorkflowController</code> with <code>ControlAuthorizer</code> gating plus audit-log entries on every save / delete, Spring Boot endpoint exposes <code>GET/POST/DELETE /api/admin/workflow</code>, and <code>/atmosphere/admin/workflow.html</code> ships a vanilla-JS authoring UI that lists / creates / edits manifests against the REST surface.</li> <li>Eval dashboard inside the admin control plane (<code>38e2a45920</code>) — <code>EvalRun</code> JSON record, <code>EvalRunStore</code> SPI with bounded-ring-buffer <code>InMemoryEvalRunStore</code> default (500 runs per baseline, oldest-evicted), <code>EvalController</code> aggregates pass-rate per baseline, Spring Boot endpoint exposes <code>GET/POST/DELETE /api/admin/evals/{runs,baselines}</code>, and <code>/atmosphere/admin/evals.html</code> surfaces pass-rate meters + recent-run table with auto-refresh. CI submits a JSON body per LLM-as-judge run and the dashboard surfaces the trend without leaving the control plane.</li> <li><code>atmosphere-admin-bundle</code> enterprise console aggregator (<code>eaad0df089</code>) — single Maven <code>pom</code>-packaging artifact that transitively pulls in <code>atmosphere-spring-boot-starter</code>, <code>atmosphere-admin</code>, <code>atmosphere-ai</code>, <code>atmosphere-coordinator</code>, <code>atmosphere-agent</code>, <code>atmosphere-rag</code>, <code>atmosphere-checkpoint</code>, <code>atmosphere-durable-sessions</code>, and</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.46] - 2026-05-16</h2> <h3>Added</h3> <ul> <li>Spring AI Alibaba: unconditional <code>TOOL_CALLING</code> / <code>TOOL_APPROVAL</code> / <code>TOKEN_USAGE</code> (<code>534317f03d</code>) — <code>UsageCapturingChatModel</code> wraps the configured Spring AI <code>ChatModel</code> bean at auto-configuration time; per-thread accumulator captures <code>ChatResponseMetadata.getUsage()</code> across every step of the ReAct graph and emits a single <code>session.usage(TokenUsage)</code> after each dispatch. Tool calling is no longer gated on <code>staticChatModel != null</code> — <code>SpringAiAlibabaToolBridge</code> is wired on every dispatch with tools, and the runtime fails fast with <code>configurationHint()</code> if <code>ChatModel</code> is missing. Closes the last conditional capability gap from the runtime parity push (<code>62a9b7e6af</code>).</li> <li>RAG vector-store matrix expanded with three direct connectors (<code>31d6455a75</code>): <code>PgVectorContextProvider</code> (Postgres + pgvector via JDBC), <code>QdrantContextProvider</code> (Qdrant REST over <code>java.net.http.HttpClient</code>), and <code>PineconeContextProvider</code> (Pinecone REST). Each connector embeds the user query through <code>EmbeddingRuntime</code>, validates caller-controlled identifiers at construction time per Boundary-Safety invariant, and ships with a Mockito-backed unit-test suite. <code>modules/rag/README.md</code> adds a reachability matrix showing the six direct providers plus the Spring AI / LangChain4j bridges covering the long tail (Weaviate, Milvus, Chroma, Elasticsearch, Redis Stack, MongoDB Atlas, OpenSearch, Cassandra).</li> <li>Workflow authoring inside the admin control plane (<code>81ff454177</code>) — <code>WorkflowManifest</code> JSON record, <code>WorkflowStore</code> SPI with <code>InMemoryWorkflowStore</code> default and optimistic-concurrency version conflict detection, <code>WorkflowController</code> with <code>ControlAuthorizer</code> gating plus audit-log entries on every save / delete, Spring Boot endpoint exposes <code>GET/POST/DELETE /api/admin/workflow</code>, and <code>/atmosphere/admin/workflow.html</code> ships a vanilla-JS authoring UI that lists / creates / edits manifests against the REST surface.</li> <li>Eval dashboard inside the admin control plane (<code>38e2a45920</code>) — <code>EvalRun</code> JSON record, <code>EvalRunStore</code> SPI with bounded-ring-buffer <code>InMemoryEvalRunStore</code> default (500 runs per baseline, oldest-evicted), <code>EvalController</code> aggregates pass-rate per baseline, Spring Boot endpoint exposes <code>GET/POST/DELETE /api/admin/evals/{runs,baselines}</code>, and <code>/atmosphere/admin/evals.html</code> surfaces pass-rate meters + recent-run table with auto-refresh. CI submits a JSON body per LLM-as-judge run and the dashboard surfaces the trend without leaving the control plane.</li> <li><code>atmosphere-admin-bundle</code> enterprise console aggregator (<code>eaad0df089</code>) — single Maven <code>pom</code>-packaging artifact that transitively pulls in <code>atmosphere-spring-boot-starter</code>, <code>atmosphere-admin</code>, <code>atmosphere-ai</code>, <code>atmosphere-coordinator</code>, <code>atmosphere-agent</code>, <code>atmosphere-rag</code>, <code>atmosphere-checkpoint</code>, <code>atmosphere-durable-sessions</code>, and</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/ca3de50fbf4a4c3f7d7f964df32ad4312fc70e63";><code>ca3de50</code></a> release: Atmosphere 4.0.46</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/e022c29f163debf308545af07f8e08fac899659d";><code>e022c29</code></a> fix(quarkus-chat): inherit opentelemetry-api version from parent BOM</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f39d99b5aa530e532dc5a1152e2c61aca8a5820d";><code>f39d99b</code></a> revert: move mirroir-pilot sample authoring to mirroir-skills repo</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/d92649e15b1e1a64c75d16fa4d6ad530cbaee1bc";><code>d92649e</code></a> fix(deps): close Dependabot alerts (OTel, spring-ai, spring-fw, reactor-netty...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/b5a9b23b1141ba7d4bb4c23287e832463914a6d0";><code>b5a9b23</code></a> ci(mirroir-pilot): matrix-extend to 4 samples (Phase A + Phase B chat-streaming)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/2bbf2f08772a526a05da50e6c1919d0c11f865a5";><code>2bbf2f0</code></a> feat(samples): Phase B — SAMPLE.md + scenarios for spring-boot-chat, quarkus-...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/58c6599a6903285a91a9278b64ba418d97cf6eb1";><code>58c6599</code></a> fix(mirroir-pilot): widen boot scope + warm plugins + bump timeout to 240s</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/cafaa092c4fa7205cd86f494a6f81fedeca2efb6";><code>cafaa09</code></a> ci(mirroir-pilot): always rebuild runner from pinned branch — cache deps only</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/8391f1925dd679c1af363230744f7bf94642ae4a";><code>8391f19</code></a> ci(mirroir-pilot): pin runner clone to feature/runner-cli-smoke + canonical URL</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c3aad868e6174f8426833212e761588a15ffd689";><code>c3aad86</code></a> docs(harness): drift-log <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/38";>#38</a> — LLM_MODE=demo wasn't real; runtime takes 'fake'</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.46";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
