dependabot[bot] opened a new pull request, #3393: URL: https://github.com/apache/cxf/pull/3393
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.67. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.67</h2> <h3>Fixed</h3> <ul> <li>make the vector store opt-in so keyless retrieval keeps its provider An empty store becomes the retrieval source and starves the demo path — the rag-chat-commands e2e caught it.</li> <li>scrub SPRING_AI_* and read warnings from binary sample logs Relaxed binding let an ambient SPRING_AI_OPENAI_BASE_URL redirect samples off the keyless-local backend.</li> <li>reject flag-shaped project names and unknown checkpoint options <code>atmosphere new --list-templates</code> scaffolded a directory named after the flag; checkpoint silently ignored --url.</li> <li>build the vector store so retrieval is actually grounded Un-exclude OpenAiEmbeddingAutoConfiguration and gate the bean on a property, not <a href="https://github.com/ConditionalOnBean";><code>@ConditionalOnBean</code></a>.</li> <li>treat unreachable container daemon as engine unavailable</li> </ul> <h3>Changed</h3> <ul> <li>allowlist ConditionalOnBean/ConditionalOnProperty doc symbols Sibling Spring conditions were already listed; these two were missing.</li> <li>document the transport headers replay requires A bare curl returns 200 with an empty body because reattach only runs for WS/SSE/long-polling.</li> <li>unwire mcp-client spec until its build moves out of the hook</li> <li>stop dependabot rewriting the maven wrapper</li> <li>hold the Maven wrapper on 3.x in dependabot</li> <li>bump Embabel to 1.5.0 and MCP Java SDK to 2.0.0</li> <li>bump Spring Boot 4.0.7 to 4.1.0</li> <li>bump org.jetbrains.kotlinx:kotlinx-serialization-core-jvm (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2748";>#2748</a>)</li> <li>bump every version-bearing file in one commit</li> <li>prepare next development version 5.0.42</li> <li>bump version to 4.0.66</li> <li>prepare for next development iteration 4.0.67-SNAPSHOT</li> </ul> <h2>Atmosphere 4.0.66</h2> <h3>Added</h3> <ul> <li>add opt-in durable batch job API at /atmosphere/v1/batches riding AiPipeline SQLite-backed submit/poll/results/cancel, default off; eval dataset runner is the first consumer</li> <li>opt-in Ed25519 state sealing wires AgentStateIntegrity into FileSystemAgentState</li> <li>give the classroom a <a href="https://github.com/RoomService";><code>@RoomService</code></a> chat channel with history A templated <a href="https://github.com/RoomService";><code>@RoomService</code></a> path created one shared room for every path value, so two classrooms saw each other's members and history</li> </ul> <h3>Fixed</h3> <ul> <li>report a non-runnable sample before checking the JDK</li> <li>scaffold from the ref that matches the pinned version, and make compose work anywhere</li> <li>stop provider defaults from shadowing a local backend</li> <li>boot the reactor version, never the newest jar lying in target/</li> <li>never drop a React Native send, and ship the types we advertise</li> <li>send tool-call arguments as a JSON object on the OpenAI wire</li> <li>screen tool-call arguments in deny lists and reach local Koog backends</li> <li>treat a local backend as reachable without a credential</li> <li>report the ms-governance rule count from the loaded policies</li> <li>render every streamed chunk and scope tool cards to their turn</li> <li>build a default model for keyless local backends</li> <li>boot exec-type samples through the helper instead of by hand grpc-chat is the matrix's only exec sample and the helper died on it, so it had to be started manually with the LLM env scrubbed by hand</li> <li>use the Session-bearing SendResult constructors WebSocket 2.2 deprecates the no-Session forms and the build is -Werror.</li> <li>register <a href="https://github.com/Message";><code>@Message</code></a> payload types in the Quarkus deployment processor The Spring AOT half landed separately on main; this is the Jandex-side equivalent, so the Quarkus native lane stops dying on the payload</li> <li>stop the demo runtime shadowing a locally served model A local backend needs no key, so a blank key was the wrong test for "no backend" — LLM_MODE=local reached Ollama and still answered from the canned script</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.67] - 2026-08-17</h2> <h3>Fixed</h3> <ul> <li>make the vector store opt-in so keyless retrieval keeps its provider An empty store becomes the retrieval source and starves the demo path — the rag-chat-commands e2e caught it.</li> <li>scrub SPRING_AI_* and read warnings from binary sample logs Relaxed binding let an ambient SPRING_AI_OPENAI_BASE_URL redirect samples off the keyless-local backend.</li> <li>reject flag-shaped project names and unknown checkpoint options <code>atmosphere new --list-templates</code> scaffolded a directory named after the flag; checkpoint silently ignored --url.</li> <li>build the vector store so retrieval is actually grounded Un-exclude OpenAiEmbeddingAutoConfiguration and gate the bean on a property, not <a href="https://github.com/ConditionalOnBean";><code>@ConditionalOnBean</code></a>.</li> <li>treat unreachable container daemon as engine unavailable</li> </ul> <h3>Changed</h3> <ul> <li>allowlist ConditionalOnBean/ConditionalOnProperty doc symbols Sibling Spring conditions were already listed; these two were missing.</li> <li>document the transport headers replay requires A bare curl returns 200 with an empty body because reattach only runs for WS/SSE/long-polling.</li> <li>unwire mcp-client spec until its build moves out of the hook</li> <li>stop dependabot rewriting the maven wrapper</li> <li>hold the Maven wrapper on 3.x in dependabot</li> <li>bump Embabel to 1.5.0 and MCP Java SDK to 2.0.0</li> <li>bump Spring Boot 4.0.7 to 4.1.0</li> <li>bump org.jetbrains.kotlinx:kotlinx-serialization-core-jvm (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2748";>#2748</a>)</li> <li>bump every version-bearing file in one commit</li> <li>prepare next development version 5.0.42</li> <li>bump version to 4.0.66</li> <li>prepare for next development iteration 4.0.67-SNAPSHOT</li> </ul> <h2>[4.0.66] - 2026-08-09</h2> <h3>Added</h3> <ul> <li>add opt-in durable batch job API at /atmosphere/v1/batches riding AiPipeline SQLite-backed submit/poll/results/cancel, default off; eval dataset runner is the first consumer</li> <li>opt-in Ed25519 state sealing wires AgentStateIntegrity into FileSystemAgentState</li> <li>give the classroom a <a href="https://github.com/RoomService";><code>@RoomService</code></a> chat channel with history A templated <a href="https://github.com/RoomService";><code>@RoomService</code></a> path created one shared room for every path value, so two classrooms saw each other's members and history</li> </ul> <h3>Fixed</h3> <ul> <li>report a non-runnable sample before checking the JDK</li> <li>scaffold from the ref that matches the pinned version, and make compose work anywhere</li> <li>stop provider defaults from shadowing a local backend</li> <li>boot the reactor version, never the newest jar lying in target/</li> <li>never drop a React Native send, and ship the types we advertise</li> <li>send tool-call arguments as a JSON object on the OpenAI wire</li> <li>screen tool-call arguments in deny lists and reach local Koog backends</li> <li>treat a local backend as reachable without a credential</li> <li>report the ms-governance rule count from the loaded policies</li> <li>render every streamed chunk and scope tool cards to their turn</li> <li>build a default model for keyless local backends</li> <li>boot exec-type samples through the helper instead of by hand grpc-chat is the matrix's only exec sample and the helper died on it, so it had to be started manually with the LLM env scrubbed by hand</li> <li>use the Session-bearing SendResult constructors WebSocket 2.2 deprecates the no-Session forms and the build is -Werror.</li> <li>register <a href="https://github.com/Message";><code>@Message</code></a> payload types in the Quarkus deployment processor The Spring AOT half landed separately on main; this is the Jandex-side equivalent, so the Quarkus native lane stops dying on the payload</li> <li>stop the demo runtime shadowing a locally served model A local backend needs no key, so a blank key was the wrong test for "no backend" — LLM_MODE=local reached Ollama and still answered from the canned script</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/bc47390c8422badb3c4b9090d0ed7a8c45529773";><code>bc47390</code></a> release: Atmosphere 4.0.67</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f7c57687c257aad90a2783ca31402209b42a01cc";><code>f7c5768</code></a> fix(rag-chat): make the vector store opt-in so keyless retrieval keeps its pr...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/8ecd9f8e8c2b9f92f715c90fed0587bf732d1b9b";><code>8ecd9f8</code></a> chore(harness): allowlist ConditionalOnBean/ConditionalOnProperty doc symbols</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a6eb4b632cb636f80287b7288892759cafaab2e2";><code>a6eb4b6</code></a> docs(reattach-harness): document the transport headers replay requires</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/bbad7b948c1cf6657eca02b1fb4386172bfe3eb3";><code>bbad7b9</code></a> fix(sweep): scrub SPRING_AI_* and read warnings from binary sample logs</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/0a4df376905960eaab5339513f33731ab6417902";><code>0a4df37</code></a> fix(cli): reject flag-shaped project names and unknown checkpoint options</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/5841b50fb7ffd3774e8c4742b08919e4e8769c18";><code>5841b50</code></a> fix(rag-chat): build the vector store so retrieval is actually grounded</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/b600b8a9496c812c31ebae566002d873d2cbe999";><code>b600b8a</code></a> ci(e2e): unwire mcp-client spec until its build moves out of the hook</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c06204a6c3ddf711a73f4f45d488781a9272aad8";><code>c06204a</code></a> ci(deps): stop dependabot rewriting the maven wrapper</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/80a4a2d52886daa5009e5a190031bde15d2cf96d";><code>80a4a2d</code></a> ci(deps): hold the Maven wrapper on 3.x in dependabot</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.67";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
