dependabot[bot] opened a new pull request, #3330: URL: https://github.com/apache/cxf/pull/3330
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.63. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.63</h2> <h3>Added</h3> <ul> <li>offline-queue badge with queued suffixes and WT-to-WS fallback resubscribe</li> <li>Rooms + Observability tabs; spring-boot-chat converted Framework-owned /api/admin/rooms over RoomManager + hasRooms/hasActuator gates; room dialect fixes (join latched until subscribe resolves, protocol/tracking framing off, RoomMember-shaped join_ack); presence, cross-member delivery, both tabs browser-proven over WebTransport</li> <li>room picker, presence, Room Protocol; classroom converted console-endpoints renders a pre-connect picker, presence frames drive the online chip, console-room joins RoomProtocolInterceptor endpoints with sinceId cursors; collaborative streaming browser-proven across two pages</li> <li>multi-agent fleet roster + activity strip; startup-team on the Console CoordinatorProcessor publishes live fleets into the framework property bag and CoordinatorController reads them via supplier (the /api/admin/coordinators wiring was a dead empty map); the console renders the runtime-truth roster on the welcome screen and per-agent steps during coordinations</li> <li>ai-chat and ai-tools on the Console with WebTransport-first connect /api/console/info gains a runtime-truth webTransport block, the console CSP allows the live HTTP/3 sidecar origin (it silently blocked WT before), routing cost/latency chips render from metadata events; bespoke React frontends deleted</li> <li>chat (WAR) and embedded-jetty-websocket-chat demo through the Atmosphere Console Both bare-Jetty samples ship gate-synced console bundle copies + static /api/console/info servlets; bespoke React bundles and stale committed asset hashes deleted, / redirects</li> <li>quarkus-chat, mcp-server and rag-chat demo through the Atmosphere Console Bespoke React frontends deleted, / redirects to /atmosphere/console/ with per-sample subtitle+endpoint config; rag-chat's root UI had referenced a nonexistent asset bundle</li> <li>grpc-chat demos through the Atmosphere Console over Connect-JSON Bare-Jetty sample ships a third gate-synced console bundle copy + a static /api/console/info servlet selecting the grpc adapter; bespoke Connect-web React frontend deleted, / redirects</li> <li>spring-boot-agui-chat demos through the Atmosphere Console Console drives the real AG-UI named-SSE wire via console-transport=ag-ui (bespoke React UI deleted, / redirects); adapter probes the origin root so connect never red-logs a 405; Playwright UI lane repointed at the Console</li> <li>spring-boot-a2a-agent demos through the Atmosphere Console Console drives the real A2A wire via console-transport=a2a (bespoke frontend deleted, / redirects); a2a/agui handlers now classify as ai mode; adapter tolerates the SSE layer's data: re-framing and surfaces failed-Task text</li> <li>gRPC chat transport adapter over Connect-JSON Speaks ConnectProtocolServlet's JSON mode (enveloped connect+json Subscribe, unary json Send) with ACK-gated open, capped resubscribe and broadcast rendering - no protobuf/codegen dependency</li> <li>A2A and AG-UI chat transport adapters as lazy chunks Built against the server wire shapes (result.artifactUpdate parts / named-SSE AgUiEventMapper inverse) with unary fallback + terminal-path completion; widens ConnectionStatusOptions.initialTransport to ConnectionTransportName</li> <li>console-transport parity on /api/console/info quarkus.atmosphere.console-transport + atmosphere.console-transport (boot3) validated to atmosphere|grpc|a2a|ag-ui, unknown falls back to atmosphere, mirroring the Spring Boot 4 starter</li> <li>pluggable ChatTransport seam behind the chat renderer Extracts the Atmosphere WS wire (framing, auth, send dialect) from useAtmosphereChat into a ChatTransport selected via /api/console/info transport; foreign adapters (grpc/a2a/ag-ui) fail loud until shipped</li> <li>console-transport property + /api/console/info transport field</li> <li>atmosphere-checkpoint-temporal — run Workflow<!-- raw HTML omitted --> on a Temporal service DurableExecutionProvider adapter: steps as Temporal activities in the calling JVM, CheckpointStore snapshot parity, e2e on the Temporal test service; pins grpc-api alongside the other grpc artifacts</li> <li>port the session-tape admin surface + content-read-auth gate to SB3 Tape runs/steps/replay endpoints + TapeAdminSupport + hasTape probe, gated by a ported AdminApiAuthFilter (content-read default-deny, Inv#6); ai-chat TapeLifecycleE2ETest now runs on both SB4 and SB3</li> <li>visualize the tape coordination tree as a Vue Flow node-graph Replay tab renders the coordinator + fan-out agents (edges by parentRunId) via a pure, unit-tested BFS layout; e2e-verified in the console under the strict nonce CSP with zero violations</li> </ul> <h3>Fixed</h3> <ul> <li>clear during a streaming reply no longer lets late deltas resurrect a bubble Discard flag drops stream events until the cleared stream terminates; clear also resets the agent strip and stats; bundles resynced</li> <li>agent-step handler reads the agent name from the nested AgentStep payload The wire shape is {stepName, data:{agent}} so the fleet activity strip never rendered; bundles resynced</li> <li>classroom spec lands on the Console; samples no longer claim hasFrontend</li> <li>heal WebTransport reconnect chain and drain offline queue on first open</li> <li>deterministic conversational default for no-skillId requests Free-text chat routed to whatever skill registered first (getDeclaredMethods order is JVM-arbitrary), nondeterministically hitting parameter-shaped skills and returning empty streams; prefer the single String-message skill on both stream and unary paths</li> <li>route Workflow.run() through DurableExecutionProvider.resolve() A ServiceLoader-registered engine adapter (Temporal/DBOS/Restate) now takes over without caller changes; contract test pins takeover + fallback</li> <li>enforce skill-file guardrails as admission scope on <a href="https://github.com/Coordinator";><code>@Coordinator</code></a> <a href="https://github.com/Coordinator";><code>@Coordinator</code></a> advertised ## Guardrails on the A2A card but enforced only <a href="https://github.com/AgentScope";><code>@AgentScope</code></a>; shared ScopePolicyResolver gives it <a href="https://github.com/Agent";><code>@Agent</code></a>'s skill-beats-annotation precedence</li> <li>make annotation checks portable across ripgrep versions rg 14.1.0 (ubuntu-latest apt) matches nothing for an optional group containing a dot, so the qualified-<a href="https://github.com/Disabled";><code>@Disabled</code></a> fix passed locally and no-op-ed in CI; also stop the harness reverting its own subject</li> <li>stop three validation checks from passing on empty input Refuse to run without rg, assert allowlists parse non-empty, move the wiring-site filter out of a stdin-stealing heredoc, and count with grep -c so a clean tree is not 1 finding</li> <li>fail architectural validation on every finding instead of warning Deletes the advisory tier, adds comment-aware scanning so Javadoc examples and enum constants stop being false positives, authorises CrewAI tool callbacks with a per-run token, and revives an offer() check dead since 68fdaf598d</li> <li>scope the tape lifecycle E2E to Spring Boot 4 (SB3 starter lacks tape admin routes) spring-boot3-starter's AtmosphereAdminEndpoint has no /api/admin/tape/* routes, so exclude TapeLifecycleE2ETest under -Pspring-boot3 until that parity gap is closed</li> <li>protect WEB-INF/META-INF on grpc-chat's Jetty static handler + CI lint grpc-chat served its frontend via DefaultServlet without setProtectedTargets; add it (matching embedded-jetty) plus an architectural-validation check failing any samples/ Jetty static-server that omits the guard</li> <li>remove unnessary docs</li> </ul> <h3>Changed</h3> <ul> <li>stage sweep pathspecs one-by-one so an unmatched glob cannot strand the release commit docs/ lost its last subdirectory .md and 'docs/**/*.md' fataled the whole git add after Central had already published 4.0.63</li> <li>resync committed bundles after the atmosphere.js 5.0.39 dev-version bump</li> <li>repoint agent-scope-on-coordinator claim evidence at ScopePolicyResolver The shared-resolver refactor (092f1460f9) replaced the direct ScopePolicyBuilder.build call the gate greps for</li> <li>prepare next development version 5.0.39</li> <li>drop the per-sample frontend build job</li> <li>retarget sample specs to the Console UI they now serve</li> <li>probe Temporal readiness with curl GET + CLI health, not wait-on HEAD The UI server ignores HEAD so wait-on timed out against a healthy server; also gates on the gRPC frontend so the adapter's 30s failed-probe backoff cannot race startup</li> <li>resync committed bundles after rebase onto main</li> <li>fingerprint-gated bundle sync for the committed sb3/quarkus consoles sync-console-bundle.sh + architectural-validation gate close silent drift; refresh brings the Tape tab, MCP sandbox.html and the ChatTransport seam to both runtimes</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.63] - 2026-07-17</h2> <h3>Added</h3> <ul> <li>offline-queue badge with queued suffixes and WT-to-WS fallback resubscribe</li> <li>Rooms + Observability tabs; spring-boot-chat converted Framework-owned /api/admin/rooms over RoomManager + hasRooms/hasActuator gates; room dialect fixes (join latched until subscribe resolves, protocol/tracking framing off, RoomMember-shaped join_ack); presence, cross-member delivery, both tabs browser-proven over WebTransport</li> <li>room picker, presence, Room Protocol; classroom converted console-endpoints renders a pre-connect picker, presence frames drive the online chip, console-room joins RoomProtocolInterceptor endpoints with sinceId cursors; collaborative streaming browser-proven across two pages</li> <li>multi-agent fleet roster + activity strip; startup-team on the Console CoordinatorProcessor publishes live fleets into the framework property bag and CoordinatorController reads them via supplier (the /api/admin/coordinators wiring was a dead empty map); the console renders the runtime-truth roster on the welcome screen and per-agent steps during coordinations</li> <li>ai-chat and ai-tools on the Console with WebTransport-first connect /api/console/info gains a runtime-truth webTransport block, the console CSP allows the live HTTP/3 sidecar origin (it silently blocked WT before), routing cost/latency chips render from metadata events; bespoke React frontends deleted</li> <li>chat (WAR) and embedded-jetty-websocket-chat demo through the Atmosphere Console Both bare-Jetty samples ship gate-synced console bundle copies + static /api/console/info servlets; bespoke React bundles and stale committed asset hashes deleted, / redirects</li> <li>quarkus-chat, mcp-server and rag-chat demo through the Atmosphere Console Bespoke React frontends deleted, / redirects to /atmosphere/console/ with per-sample subtitle+endpoint config; rag-chat's root UI had referenced a nonexistent asset bundle</li> <li>grpc-chat demos through the Atmosphere Console over Connect-JSON Bare-Jetty sample ships a third gate-synced console bundle copy + a static /api/console/info servlet selecting the grpc adapter; bespoke Connect-web React frontend deleted, / redirects</li> <li>spring-boot-agui-chat demos through the Atmosphere Console Console drives the real AG-UI named-SSE wire via console-transport=ag-ui (bespoke React UI deleted, / redirects); adapter probes the origin root so connect never red-logs a 405; Playwright UI lane repointed at the Console</li> <li>spring-boot-a2a-agent demos through the Atmosphere Console Console drives the real A2A wire via console-transport=a2a (bespoke frontend deleted, / redirects); a2a/agui handlers now classify as ai mode; adapter tolerates the SSE layer's data: re-framing and surfaces failed-Task text</li> <li>gRPC chat transport adapter over Connect-JSON Speaks ConnectProtocolServlet's JSON mode (enveloped connect+json Subscribe, unary json Send) with ACK-gated open, capped resubscribe and broadcast rendering - no protobuf/codegen dependency</li> <li>A2A and AG-UI chat transport adapters as lazy chunks Built against the server wire shapes (result.artifactUpdate parts / named-SSE AgUiEventMapper inverse) with unary fallback + terminal-path completion; widens ConnectionStatusOptions.initialTransport to ConnectionTransportName</li> <li>console-transport parity on /api/console/info quarkus.atmosphere.console-transport + atmosphere.console-transport (boot3) validated to atmosphere|grpc|a2a|ag-ui, unknown falls back to atmosphere, mirroring the Spring Boot 4 starter</li> <li>pluggable ChatTransport seam behind the chat renderer Extracts the Atmosphere WS wire (framing, auth, send dialect) from useAtmosphereChat into a ChatTransport selected via /api/console/info transport; foreign adapters (grpc/a2a/ag-ui) fail loud until shipped</li> <li>console-transport property + /api/console/info transport field</li> <li>atmosphere-checkpoint-temporal — run Workflow<!-- raw HTML omitted --> on a Temporal service DurableExecutionProvider adapter: steps as Temporal activities in the calling JVM, CheckpointStore snapshot parity, e2e on the Temporal test service; pins grpc-api alongside the other grpc artifacts</li> <li>port the session-tape admin surface + content-read-auth gate to SB3 Tape runs/steps/replay endpoints + TapeAdminSupport + hasTape probe, gated by a ported AdminApiAuthFilter (content-read default-deny, Inv#6); ai-chat TapeLifecycleE2ETest now runs on both SB4 and SB3</li> <li>visualize the tape coordination tree as a Vue Flow node-graph Replay tab renders the coordinator + fan-out agents (edges by parentRunId) via a pure, unit-tested BFS layout; e2e-verified in the console under the strict nonce CSP with zero violations</li> </ul> <h3>Fixed</h3> <ul> <li>clear during a streaming reply no longer lets late deltas resurrect a bubble Discard flag drops stream events until the cleared stream terminates; clear also resets the agent strip and stats; bundles resynced</li> <li>agent-step handler reads the agent name from the nested AgentStep payload The wire shape is {stepName, data:{agent}} so the fleet activity strip never rendered; bundles resynced</li> <li>classroom spec lands on the Console; samples no longer claim hasFrontend</li> <li>heal WebTransport reconnect chain and drain offline queue on first open</li> <li>deterministic conversational default for no-skillId requests Free-text chat routed to whatever skill registered first (getDeclaredMethods order is JVM-arbitrary), nondeterministically hitting parameter-shaped skills and returning empty streams; prefer the single String-message skill on both stream and unary paths</li> <li>route Workflow.run() through DurableExecutionProvider.resolve() A ServiceLoader-registered engine adapter (Temporal/DBOS/Restate) now takes over without caller changes; contract test pins takeover + fallback</li> <li>enforce skill-file guardrails as admission scope on <a href="https://github.com/Coordinator";><code>@Coordinator</code></a> <a href="https://github.com/Coordinator";><code>@Coordinator</code></a> advertised ## Guardrails on the A2A card but enforced only <a href="https://github.com/AgentScope";><code>@AgentScope</code></a>; shared ScopePolicyResolver gives it <a href="https://github.com/Agent";><code>@Agent</code></a>'s skill-beats-annotation precedence</li> <li>make annotation checks portable across ripgrep versions rg 14.1.0 (ubuntu-latest apt) matches nothing for an optional group containing a dot, so the qualified-<a href="https://github.com/Disabled";><code>@Disabled</code></a> fix passed locally and no-op-ed in CI; also stop the harness reverting its own subject</li> <li>stop three validation checks from passing on empty input Refuse to run without rg, assert allowlists parse non-empty, move the wiring-site filter out of a stdin-stealing heredoc, and count with grep -c so a clean tree is not 1 finding</li> <li>fail architectural validation on every finding instead of warning Deletes the advisory tier, adds comment-aware scanning so Javadoc examples and enum constants stop being false positives, authorises CrewAI tool callbacks with a per-run token, and revives an offer() check dead since 68fdaf598d</li> <li>scope the tape lifecycle E2E to Spring Boot 4 (SB3 starter lacks tape admin routes) spring-boot3-starter's AtmosphereAdminEndpoint has no /api/admin/tape/* routes, so exclude TapeLifecycleE2ETest under -Pspring-boot3 until that parity gap is closed</li> <li>protect WEB-INF/META-INF on grpc-chat's Jetty static handler + CI lint grpc-chat served its frontend via DefaultServlet without setProtectedTargets; add it (matching embedded-jetty) plus an architectural-validation check failing any samples/ Jetty static-server that omits the guard</li> <li>remove unnessary docs</li> </ul> <h3>Changed</h3> <ul> <li>stage sweep pathspecs one-by-one so an unmatched glob cannot strand the release commit docs/ lost its last subdirectory .md and 'docs/**/*.md' fataled the whole git add after Central had already published 4.0.63</li> <li>resync committed bundles after the atmosphere.js 5.0.39 dev-version bump</li> <li>repoint agent-scope-on-coordinator claim evidence at ScopePolicyResolver The shared-resolver refactor (092f1460f9) replaced the direct ScopePolicyBuilder.build call the gate greps for</li> <li>prepare next development version 5.0.39</li> <li>drop the per-sample frontend build job</li> <li>retarget sample specs to the Console UI they now serve</li> <li>probe Temporal readiness with curl GET + CLI health, not wait-on HEAD The UI server ignores HEAD so wait-on timed out against a healthy server; also gates on the gRPC frontend so the adapter's 30s failed-probe backoff cannot race startup</li> <li>resync committed bundles after rebase onto main</li> <li>fingerprint-gated bundle sync for the committed sb3/quarkus consoles sync-console-bundle.sh + architectural-validation gate close silent drift; refresh brings the Tape tab, MCP sandbox.html and the ChatTransport seam to both runtimes</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/8d93a4ad026f91150771ee541de8334660e34d75";><code>8d93a4a</code></a> release: Atmosphere 4.0.63</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/021d0228d0a6b2928c2b9b299942a48a7ae106ed";><code>021d022</code></a> ci(release): stage sweep pathspecs one-by-one so an unmatched glob cannot str...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f37232fa7e9584d117e366d2317fbba0e1372c3e";><code>f37232f</code></a> build(console): resync committed bundles after the atmosphere.js 5.0.39 dev-v...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/419ece7802681c36333503b208eb7041bb5d4431";><code>419ece7</code></a> chore(harness): repoint agent-scope-on-coordinator claim evidence at ScopePol...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/5c2dd00b8f5f66bf8b39e703255e411f6b76a2bc";><code>5c2dd00</code></a> chore(js): prepare next development version 5.0.39</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/e0b15f541c6b3095f2d5256ef6085f60edc40e3a";><code>e0b15f5</code></a> fix(console): clear during a streaming reply no longer lets late deltas resur...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/674d47e3b8f9f9b7c58869b6e549504d82a4c613";><code>674d47e</code></a> fix(console): agent-step handler reads the agent name from the nested AgentSt...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/9c0b87ec7bb67622937db6ab5a94aeadfe4632f8";><code>9c0b87e</code></a> ci(samples): drop the per-sample frontend build job</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/cc0202a91865a55cd4c506f6d1abb87c8817efc0";><code>cc0202a</code></a> test(e2e): retarget sample specs to the Console UI they now serve</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/cd32bdd9dfc667782f0dcb6f51019bb5b9d8dbd8";><code>cd32bdd</code></a> ci(e2e): probe Temporal readiness with curl GET + CLI health, not wait-on HEAD</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.63";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
