dependabot[bot] opened a new pull request, #3207: URL: https://github.com/apache/cxf/pull/3207
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.50. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.50</h2> <h3>Removed</h3> <ul> <li>Pruned dead/unwired internal classes found during a release-readiness audit — none was documented, advertised, or reachable from a user code path: <code>McpWebSocketHandler</code> (superseded by <code>McpHandler</code>'s direct WebSocket-frame handling), <code>AgUiSession</code> (superseded by <code>ResourceAgUiStreamingSession</code>), <code>AiCoalescingBroadcasterCache</code> (a delegate-only <code>BroadcasterCache</code> that the no-arg reflective cache-wiring path cannot instantiate), <code>AdkArtifactBridge</code>, <code>AdkCompactionBridge</code>, <code>AtmosphereRequestBridge</code>, <code>AtmosphereResponseBridge</code>, the channels <code>AuditLoggingFilter</code> (never registered as a bean, so it never reached the filter chain), the unwired <code>GrpcProtocolBridge</code>, and the A2A <code>ListTaskPushNotificationConfigsResponse</code> DTO (the <code>ListTaskPushNotificationConfigs</code> method returns <code>ERROR_PUSH_NOT_SUPPORTED</code>, so the response type was never constructed).</li> </ul> <h3>Fixed</h3> <ul> <li><code>ToolBridgeUtils.findUnescapedQuote</code> no longer advances the scan index past the end of the string when malformed tool-call JSON ends in a lone backslash — the escaped-character skip is now bounds-checked (boundary safety, Correctness Invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/4";>#4</a>). Regression test added.</li> </ul> <h3>Added</h3> <ul> <li><strong>Interactions API</strong> (<code>org.atmosphere.interactions</code>, artifact <code>atmosphere-interactions</code>) — a stateful agent-turn resource layered above the <code>AgentRuntime</code> SPI, so it works for every adapter with no per-runtime code. An <code>Interaction</code> carries a stable id, a durable <code>steps[]</code> event log, and chains turns via <code>previousInteractionId</code> (the server holds history; the client does not resend it). Turns run <strong>synchronously</strong> or in the <strong>background</strong> (<code>background=true</code> returns a <code>RUNNING</code> record immediately and is retrievable after a disconnect), and <code>store=false</code> streams without persisting. The starter exposes the resource over <code>POST /api/interactions</code>, <code>POST /api/interactions/{id}/continue</code>, <code>GET /api/interactions/{id}</code>, <code>GET /api/interactions</code>, <code>POST /api/interactions/{id}/cancel</code>, and <code>DELETE /api/interactions/{id}</code> — every mutating route is default-deny behind <code>atmosphere.interactions.http-write-enabled</code> plus an authenticated principal (Correctness Invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/6";>#6</a>). Two <code>InteractionStore</code> backends ship: <code>InMemoryInteractionStore</code> (default) and <code>SqliteInteractionStore</code>; the SPI is pluggable for others. <code>atmosphere.js</code> gains a typed <code>InteractionsClient</code> (<code>atmosphere.js/interactions</code>) covering the REST surface plus <code>pollUntilTerminal</code> / <code>watch</code> helpers.</li> <li><strong>Interactions live streaming</strong> — a background interaction now streams its durable <code>steps[]</code> to a subscribed browser as they are produced, over the Atmosphere transport (<code>/atmosphere/interactions-stream?id=<id></code>, WebSocket/SSE). On connect the handler replays the steps captured so far (late-joiner catch-up, deduped client-side by sequence), then pushes each new step live and a terminal frame on completion; ownership is enforced per-interaction, same scope as the REST read. <code>InteractionsClient.subscribe(id, handlers)</code> bridges it on the client</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.50] - 2026-06-05</h2> <h3>Removed</h3> <ul> <li>Pruned dead/unwired internal classes found during a release-readiness audit — none was documented, advertised, or reachable from a user code path: <code>McpWebSocketHandler</code> (superseded by <code>McpHandler</code>'s direct WebSocket-frame handling), <code>AgUiSession</code> (superseded by <code>ResourceAgUiStreamingSession</code>), <code>AiCoalescingBroadcasterCache</code> (a delegate-only <code>BroadcasterCache</code> that the no-arg reflective cache-wiring path cannot instantiate), <code>AdkArtifactBridge</code>, <code>AdkCompactionBridge</code>, <code>AtmosphereRequestBridge</code>, <code>AtmosphereResponseBridge</code>, the channels <code>AuditLoggingFilter</code> (never registered as a bean, so it never reached the filter chain), the unwired <code>GrpcProtocolBridge</code>, and the A2A <code>ListTaskPushNotificationConfigsResponse</code> DTO (the <code>ListTaskPushNotificationConfigs</code> method returns <code>ERROR_PUSH_NOT_SUPPORTED</code>, so the response type was never constructed).</li> </ul> <h3>Fixed</h3> <ul> <li><code>ToolBridgeUtils.findUnescapedQuote</code> no longer advances the scan index past the end of the string when malformed tool-call JSON ends in a lone backslash — the escaped-character skip is now bounds-checked (boundary safety, Correctness Invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/4";>#4</a>). Regression test added.</li> </ul> <h3>Added</h3> <ul> <li><strong>Interactions API</strong> (<code>org.atmosphere.interactions</code>, artifact <code>atmosphere-interactions</code>) — a stateful agent-turn resource layered above the <code>AgentRuntime</code> SPI, so it works for every adapter with no per-runtime code. An <code>Interaction</code> carries a stable id, a durable <code>steps[]</code> event log, and chains turns via <code>previousInteractionId</code> (the server holds history; the client does not resend it). Turns run <strong>synchronously</strong> or in the <strong>background</strong> (<code>background=true</code> returns a <code>RUNNING</code> record immediately and is retrievable after a disconnect), and <code>store=false</code> streams without persisting. The starter exposes the resource over <code>POST /api/interactions</code>, <code>POST /api/interactions/{id}/continue</code>, <code>GET /api/interactions/{id}</code>, <code>GET /api/interactions</code>, <code>POST /api/interactions/{id}/cancel</code>, and <code>DELETE /api/interactions/{id}</code> — every mutating route is default-deny behind <code>atmosphere.interactions.http-write-enabled</code> plus an authenticated principal (Correctness Invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/6";>#6</a>). Two <code>InteractionStore</code> backends ship: <code>InMemoryInteractionStore</code> (default) and <code>SqliteInteractionStore</code>; the SPI is pluggable for others. <code>atmosphere.js</code> gains a typed <code>InteractionsClient</code> (<code>atmosphere.js/interactions</code>) covering the REST surface plus <code>pollUntilTerminal</code> / <code>watch</code> helpers.</li> <li><strong>Interactions live streaming</strong> — a background interaction now streams its durable <code>steps[]</code> to a subscribed browser as they are produced, over the Atmosphere transport (<code>/atmosphere/interactions-stream?id=<id></code>, WebSocket/SSE). On connect the handler replays the steps captured so far (late-joiner catch-up, deduped client-side by sequence), then pushes each new step live and a terminal frame on completion; ownership is enforced per-interaction, same scope as the REST read. <code>InteractionsClient.subscribe(id, handlers)</code> bridges it on the client</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/5bb693a1f3184f61ea20bfa9ac2a4913d5c6bf9e";><code>5bb693a</code></a> release: Atmosphere 4.0.50</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/03d45aa66b268098c4da89fade57200889021129";><code>03d45aa</code></a> fix(spring-boot): isolate protocol-tracing refs to nested configs so OTel-onl...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/11ee392b799c95f4c3130e34c227bb37fabc28d1";><code>11ee392</code></a> feat: auto-attach protocol tracing, add Postgres + SMT verifier backends, ali...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/126be1a614eb6b03ad358575e6fc669fffbd394f";><code>126be1a</code></a> build(quarkus): bump Quarkus 3.35.2 to 3.36.0</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/54cbc446a4a7abb3d17588e0115ddde6c3be3872";><code>54cbc44</code></a> docs(atmosphere.js): drop dead Maven/WebJar publish section (npm-only)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/49a347b16508df78bc2465f8545d987bbfb99604";><code>49a347b</code></a> docs(atmosphere.js): fix broken subscribe example + stale publish-doc commands</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c5aa063f82363ca4773b3380727f0f86834e02a6";><code>c5aa063</code></a> ci(harness): add diff-aware orphan-class gate (new class must have a consumer)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a74f1a9795af0713ecbd5fecc642e151a1648d6f";><code>a74f1a9</code></a> docs: complete README runtime-adapter list (add Anthropic, Cohere, CrewAI)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/fa1326c20af989cf7cab2b1ec66eddb9a25aa412";><code>fa1326c</code></a> refactor(ai-test): extract shared HttpRuntimeTestSupport for HTTP-runtime con...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/e9160eac16c2a7517cc3be29cf9554c4952337d8";><code>e9160ea</code></a> refactor(ai): hoist shared HTTP-runtime streaming dispatch into AbstractAgent...</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.50";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
