dependabot[bot] opened a new pull request, #3441: URL: https://github.com/apache/cxf/pull/3441
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.69. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.69</h2> <h3>Added</h3> <ul> <li>add the classic-rooms template and gate the two template maps in lockstep</li> <li>add spring-boot-low-level-handlers, the layer under <a href="https://github.com/ManagedService";><code>@ManagedService</code></a></li> <li>add spring-boot-team-rooms, a classic-annotation multi-room chat</li> </ul> <h3>Fixed</h3> <ul> <li>stop the personal assistant overwriting an upstream-resolved ai.userId</li> <li>skip cross-session recall when the resolved runtime is the demo fallback</li> <li>reattach two Javadoc comments orphaned by the owner-reclaim insert</li> <li>stop the CHANGELOG generator crediting reverted commits</li> <li>keep the run owner across a recycled request so fact extraction still runs</li> <li>make the classic-annotation samples work at runtime, not just in tests</li> <li>resolve templated endpoint paths on WebTransport, not just requestURI</li> <li>fail a fixture boot as soon as the process dies, not after the timeout</li> <li>fail the coverage map on entries for samples that no longer exist</li> <li>resolve e2e coverage entries to real specs, projects and CI legs</li> <li>resolve <a href="https://github.com/PathParam";><code>@PathParam</code></a> on <a href="https://github.com/RoomService";><code>@RoomService</code></a> and add it to the servlet scan</li> </ul> <h3>Changed</h3> <ul> <li>require evidence in the four matrix rows that certified without it</li> <li>log the offline-maven CI regression and the CDI annotation false positive</li> <li>register the two classic-annotation samples across every gate and doc</li> <li>log the fabricated container-ledger blog claim and the relayed RAG negative grep</li> <li>forbid host-network toggles, record the NetInfo assertion as PARTIAL</li> </ul> <h2>Atmosphere 4.0.68</h2> <h3>Added</h3> <ul> <li>scope workspace RUNTIME.md settings to their agent via AiConfig.configureForAgent First workspace seeds the process default, later ones stay agent-scoped; the built-in runtime serves scoped agents from their own client (registre#39)</li> <li>ship the voice-mode endpoint driving the speech-to-speech loop VoiceEndpointHandler resolves RealtimeVoiceProvider per connect; mounted behind atmosphere.ai.voice.enabled on Spring and Quarkus (registre#25)</li> <li>per-user MCP credentials via McpTrustProvider, facade on the selection path connectForUser sends the resolved Bearer credential and fails closed unauthorized; ToolSelection composes ToolExtensibilityPoint per request (registre#24)</li> <li>arm durable approval-expiry timers for journaled approvals DurableApprovalExpiry is DurableTimerService's production consumer, wired by both durable-run installers; markFailed never demotes COMMITTED (registre#26)</li> <li>implement expose, snapshot and hibernate on both shipped backends Docker uses pause/commit/port-publishing recreation, in-process copies its workdir (registre#5); README stops naming non-existent backend modules</li> <li>execute saved workflow manifests through AgentFleet with run/approval endpoints WorkflowRunner dispatches agent/condition/fan-out/join/approval/output nodes (registre#1); Quarkus gains the workflow surface and live coordinator wiring</li> <li>read WEBTRANSPORT_PROTOCOL knob to install custom WebTransport protocols Custom protocol owns message/lifecycle callbacks (registre#28); tool/voice SPI docs made truthful (registre#24, registre#25); exec-maven-plugin version pinned</li> <li>expose fleet health, make VerifyCli launchable, honest fan-out contract GET /coordinators/{name}/health reads AgentFleet.health(); exec mainClass pinned for the verifier CLI; FanOutStreamingSession documented app-constructed (registre#43)</li> <li>surface priced call cost as business.session.cost response metadata CostAccountant gains priceUsd; the accounting session emits the real figure and BusinessMetadata docs now state who writes what (registre#42)</li> <li>emit MESSAGES_SNAPSHOT at run start and document the produced event set 23 of 27 AG-UI types now have producers; the chunked/raw alternates are documented parse-only by design (registre#29)</li> <li>stream reasoning and citations as first-class AiEvents Anthropic thinking blocks and Cohere citations now produce ReasoningDelta/ReasoningComplete/Citation, mapped to AG-UI's REASONING_* and CUSTOM (registre#16)</li> <li>wire the agent-state control plane to both admin transports StateController serves the live per-agent AgentState registry with guarded mutations; the vacuous [200,404] e2e now discriminates (registre#21)</li> <li>register live protocol bridges and list them on the admin plane Processors install Mcp/A2a/AgUi/InMemory bridges via ProtocolBridgeRegistry.install; GET /api/admin/protocols reports runtime truth and the false SPI comments are corrected (registre#22)</li> <li>render the coordination causal tree from the journaled lineage GET /journal/{id}/tree reads CoordinationProjection on both admin transports, giving the envelope lineage its production consumer (registre#23)</li> <li>route shared-channel free text by address, default agent, or sole binding <code>@name/name</code>: addressing beats registration order; atmosphere.channels.default-agent catches the rest; ambiguity now warns (registre#34)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.69] - 2026-08-30</h2> <h3>Added</h3> <ul> <li>add the classic-rooms template and gate the two template maps in lockstep</li> <li>add spring-boot-low-level-handlers, the layer under <a href="https://github.com/ManagedService";><code>@ManagedService</code></a></li> <li>add spring-boot-team-rooms, a classic-annotation multi-room chat</li> </ul> <h3>Fixed</h3> <ul> <li>stop the personal assistant overwriting an upstream-resolved ai.userId</li> <li>skip cross-session recall when the resolved runtime is the demo fallback</li> <li>reattach two Javadoc comments orphaned by the owner-reclaim insert</li> <li>stop the CHANGELOG generator crediting reverted commits</li> <li>keep the run owner across a recycled request so fact extraction still runs</li> <li>make the classic-annotation samples work at runtime, not just in tests</li> <li>resolve templated endpoint paths on WebTransport, not just requestURI</li> <li>fail a fixture boot as soon as the process dies, not after the timeout</li> <li>fail the coverage map on entries for samples that no longer exist</li> <li>resolve e2e coverage entries to real specs, projects and CI legs</li> <li>resolve <a href="https://github.com/PathParam";><code>@PathParam</code></a> on <a href="https://github.com/RoomService";><code>@RoomService</code></a> and add it to the servlet scan</li> </ul> <h3>Changed</h3> <ul> <li>require evidence in the four matrix rows that certified without it</li> <li>log the offline-maven CI regression and the CDI annotation false positive</li> <li>register the two classic-annotation samples across every gate and doc</li> <li>log the fabricated container-ledger blog claim and the relayed RAG negative grep</li> <li>forbid host-network toggles, record the NetInfo assertion as PARTIAL</li> </ul> <h2>[4.0.68] - 2026-08-23</h2> <h3>Added</h3> <ul> <li>scope workspace RUNTIME.md settings to their agent via AiConfig.configureForAgent First workspace seeds the process default, later ones stay agent-scoped; the built-in runtime serves scoped agents from their own client (registre#39)</li> <li>ship the voice-mode endpoint driving the speech-to-speech loop VoiceEndpointHandler resolves RealtimeVoiceProvider per connect; mounted behind atmosphere.ai.voice.enabled on Spring and Quarkus (registre#25)</li> <li>per-user MCP credentials via McpTrustProvider, facade on the selection path connectForUser sends the resolved Bearer credential and fails closed unauthorized; ToolSelection composes ToolExtensibilityPoint per request (registre#24)</li> <li>arm durable approval-expiry timers for journaled approvals DurableApprovalExpiry is DurableTimerService's production consumer, wired by both durable-run installers; markFailed never demotes COMMITTED (registre#26)</li> <li>implement expose, snapshot and hibernate on both shipped backends Docker uses pause/commit/port-publishing recreation, in-process copies its workdir (registre#5); README stops naming non-existent backend modules</li> <li>execute saved workflow manifests through AgentFleet with run/approval endpoints WorkflowRunner dispatches agent/condition/fan-out/join/approval/output nodes (registre#1); Quarkus gains the workflow surface and live coordinator wiring</li> <li>read WEBTRANSPORT_PROTOCOL knob to install custom WebTransport protocols Custom protocol owns message/lifecycle callbacks (registre#28); tool/voice SPI docs made truthful (registre#24, registre#25); exec-maven-plugin version pinned</li> <li>expose fleet health, make VerifyCli launchable, honest fan-out contract GET /coordinators/{name}/health reads AgentFleet.health(); exec mainClass pinned for the verifier CLI; FanOutStreamingSession documented app-constructed (registre#43)</li> <li>surface priced call cost as business.session.cost response metadata CostAccountant gains priceUsd; the accounting session emits the real figure and BusinessMetadata docs now state who writes what (registre#42)</li> <li>emit MESSAGES_SNAPSHOT at run start and document the produced event set 23 of 27 AG-UI types now have producers; the chunked/raw alternates are documented parse-only by design (registre#29)</li> <li>stream reasoning and citations as first-class AiEvents Anthropic thinking blocks and Cohere citations now produce ReasoningDelta/ReasoningComplete/Citation, mapped to AG-UI's REASONING_* and CUSTOM (registre#16)</li> <li>wire the agent-state control plane to both admin transports StateController serves the live per-agent AgentState registry with guarded mutations; the vacuous [200,404] e2e now discriminates (registre#21)</li> <li>register live protocol bridges and list them on the admin plane Processors install Mcp/A2a/AgUi/InMemory bridges via ProtocolBridgeRegistry.install; GET /api/admin/protocols reports runtime truth and the false SPI comments are corrected (registre#22)</li> <li>render the coordination causal tree from the journaled lineage GET /journal/{id}/tree reads CoordinationProjection on both admin transports, giving the envelope lineage its production consumer (registre#23)</li> <li>route shared-channel free text by address, default agent, or sole binding <code>@name/name</code>: addressing beats registration order; atmosphere.channels.default-agent catches the rest; ambiguity now warns (registre#34)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/eecf192ba59a41bab5d43dcc64d8d1594ec17314";><code>eecf192</code></a> release: Atmosphere 4.0.69</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/55772ccfbb88b79b7bdb5fa99ca05d4185a39d7f";><code>55772cc</code></a> fix(samples): stop the personal assistant overwriting an upstream-resolved ai...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a7e2f86644d51dbd75ee3785cc06324188a0d048";><code>a7e2f86</code></a> fix(e2e): skip cross-session recall when the resolved runtime is the demo fal...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/628a62cf37d65bd4a26b6e9aaabeccd27345d10f";><code>628a62c</code></a> fix(ai): reattach two Javadoc comments orphaned by the owner-reclaim insert</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/07ed39798e5985ba93da45ab590d2a05221c8fd5";><code>07ed397</code></a> docs(sweep): require evidence in the four matrix rows that certified without it</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/ed91e0f178883cad3f4d29323c802164f0ed1c3b";><code>ed91e0f</code></a> fix(release): stop the CHANGELOG generator crediting reverted commits</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/bd0755933d67c5da3ba85550769a69f54da22c9e";><code>bd07559</code></a> fix(ai): keep the run owner across a recycled request so fact extraction stil...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/72890afd255ddbf7eaf897b1affe8813997142f1";><code>72890af</code></a> fix(samples): make the classic-annotation samples work at runtime, not just i...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/945ff83d1b3807d1cc817f54c8987ecd453fe792";><code>945ff83</code></a> fix(ai): resolve templated endpoint paths on WebTransport, not just requestURI</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/394d43a49dec6ae1fbeca2e8fb959e1b74ba602e";><code>394d43a</code></a> fix(e2e): fail a fixture boot as soon as the process dies, not after the timeout</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.69";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
