dependabot[bot] opened a new pull request, #3605: URL: https://github.com/apache/cxf/pull/3605
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.73. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.73</h2> <h3>Added</h3> <ul> <li>expose the server tracking id as Subscription.uuid (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2787";>#2787</a>)</li> <li>tag error events with willRetry and attempt (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2790";>#2790</a>)</li> <li>honor RetryStrategy with a single reconnect-delay calculator (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2788";>#2788</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>dispatch <a href="https://github.com/Disconnect";><code>@Disconnect</code></a> once per resource when a broadcast races the close</li> <li>report unknown run samples and key the jar cache on the override version</li> <li>pin import's Spring Boot parent to the reactor pom and ship mvnw</li> <li>make the composed coordinator jar runnable and discoverable</li> <li>destroy the framework after the admin lifecycle stops, not before</li> <li>decode CONNECT-stream capsules instead of dispatching them as messages</li> <li>stop a broadcast reaching a closing resource from re-running <a href="https://github.com/Disconnect";><code>@Disconnect</code></a></li> <li>bump Spring Boot to 4.1.1 for Spring Framework 7.0.9 across the Boot 4 line</li> <li>pin lz4-java to 1.11.4 for the yawkat LZ4 advisories</li> <li>stop release preflight flagging the atmosphere.js docs URL as a stale asset path</li> <li>keep query values decoding to control characters raw; WebTransport spells spaces %20</li> <li>percent-decode query parameters mapped to request headers</li> <li>guard the IIFE window globals with a tsup footer. Fixes <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2791";>#2791</a></li> <li>send request headers as real headers on same-origin fetch (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2789";>#2789</a>)</li> <li>open long-polling after subscribe() resolves and the handshake (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2784";>#2784</a>)</li> <li>send the close message on close() and pagehide (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2783";>#2783</a>)</li> <li>make react-markdown and remark-gfm optional peer deps (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2786";>#2786</a>)</li> <li>derive VERSION from package.json at build time (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2785";>#2785</a>)</li> <li>make an explicit WebSocket/WebTransport close terminal (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2782";>#2782</a>)</li> <li>parse the handshake only when one is expected (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2781";>#2781</a>)</li> </ul> <h3>Changed</h3> <ul> <li>label the issues a release fixed with its version</li> <li>assert the raw control-character values directly; note Boot 4.1.1 manages pgjdbc 42.7.13</li> <li>bump vue to 3.5.44 in atmosphere.js and Console for npm advisories</li> <li>bump jsoup to 1.23.2 and align spring-ai-alibaba to Spring 7.0.9</li> <li>derive Atmosphere versions in release scripts and gate hardcoded literals</li> <li>cite the moved ACS extends resolver and fixtures, and name the drift source</li> <li>diff ACS fixtures against responsibleai/agent-control-spec</li> <li>getHeader returns decoded query-parameter values</li> <li>publish the legacy atmosphere.js 4.x npm package from release-4x via Trusted Publishing</li> <li>add workflow publishing the legacy atmosphere.js 4.x client to npm</li> <li>reconnect is off unless the request sets it</li> <li>cover an empty first long-polling body under the protocol (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2784";>#2784</a>)</li> <li>bump Google ADK to 1.11.0 and LangChain4j to 1.21.0</li> <li>stop publishing the legacy assembly distribution to Maven Central</li> </ul> <h2>Atmosphere 4.0.72</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.73] - 2026-10-14</h2> <h3>Added</h3> <ul> <li>expose the server tracking id as Subscription.uuid (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2787";>#2787</a>)</li> <li>tag error events with willRetry and attempt (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2790";>#2790</a>)</li> <li>honor RetryStrategy with a single reconnect-delay calculator (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2788";>#2788</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>dispatch <a href="https://github.com/Disconnect";><code>@Disconnect</code></a> once per resource when a broadcast races the close</li> <li>report unknown run samples and key the jar cache on the override version</li> <li>pin import's Spring Boot parent to the reactor pom and ship mvnw</li> <li>make the composed coordinator jar runnable and discoverable</li> <li>destroy the framework after the admin lifecycle stops, not before</li> <li>decode CONNECT-stream capsules instead of dispatching them as messages</li> <li>stop a broadcast reaching a closing resource from re-running <a href="https://github.com/Disconnect";><code>@Disconnect</code></a></li> <li>bump Spring Boot to 4.1.1 for Spring Framework 7.0.9 across the Boot 4 line</li> <li>pin lz4-java to 1.11.4 for the yawkat LZ4 advisories</li> <li>stop release preflight flagging the atmosphere.js docs URL as a stale asset path</li> <li>keep query values decoding to control characters raw; WebTransport spells spaces %20</li> <li>percent-decode query parameters mapped to request headers</li> <li>guard the IIFE window globals with a tsup footer. Fixes <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2791";>#2791</a></li> <li>send request headers as real headers on same-origin fetch (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2789";>#2789</a>)</li> <li>open long-polling after subscribe() resolves and the handshake (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2784";>#2784</a>)</li> <li>send the close message on close() and pagehide (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2783";>#2783</a>)</li> <li>make react-markdown and remark-gfm optional peer deps (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2786";>#2786</a>)</li> <li>derive VERSION from package.json at build time (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2785";>#2785</a>)</li> <li>make an explicit WebSocket/WebTransport close terminal (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2782";>#2782</a>)</li> <li>parse the handshake only when one is expected (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2781";>#2781</a>)</li> </ul> <h3>Changed</h3> <ul> <li>label the issues a release fixed with its version</li> <li>assert the raw control-character values directly; note Boot 4.1.1 manages pgjdbc 42.7.13</li> <li>bump vue to 3.5.44 in atmosphere.js and Console for npm advisories</li> <li>bump jsoup to 1.23.2 and align spring-ai-alibaba to Spring 7.0.9</li> <li>derive Atmosphere versions in release scripts and gate hardcoded literals</li> <li>cite the moved ACS extends resolver and fixtures, and name the drift source</li> <li>diff ACS fixtures against responsibleai/agent-control-spec</li> <li>getHeader returns decoded query-parameter values</li> <li>publish the legacy atmosphere.js 4.x npm package from release-4x via Trusted Publishing</li> <li>add workflow publishing the legacy atmosphere.js 4.x client to npm</li> <li>reconnect is off unless the request sets it</li> <li>cover an empty first long-polling body under the protocol (<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2784";>#2784</a>)</li> <li>bump Google ADK to 1.11.0 and LangChain4j to 1.21.0</li> <li>stop publishing the legacy assembly distribution to Maven Central</li> </ul> <h2>[4.0.72] - 2026-10-05</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/e633f1feac0f1d8947f91cf0ffc34a6fe729159d";><code>e633f1f</code></a> release: Atmosphere 4.0.73</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/3267a2354120560dcfd3983e8576f338e9e04002";><code>3267a23</code></a> fix(cpr): dispatch <a href="https://github.com/Disconnect";><code>@Disconnect</code></a> once per resource when a broadcast races the c...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f014d31e34c5a9c5ae83b15560682fa00514a630";><code>f014d31</code></a> fix(cli): report unknown run samples and key the jar cache on the override ve...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/3a8921e648d85919e197bfc687bb929d61b1001c";><code>3a8921e</code></a> fix(cli): pin import's Spring Boot parent to the reactor pom and ship mvnw</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/d333c7f036b3af78f4e7e98add83dde0a6c4bdba";><code>d333c7f</code></a> fix(generator): make the composed coordinator jar runnable and discoverable</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/afbfaa21c9d7673adc58d40763b420c3d6de36c2";><code>afbfaa2</code></a> fix(spring-boot): destroy the framework after the admin lifecycle stops, not ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a66e2c48b278cb124d4cad4f71ff24aa46572f35";><code>a66e2c4</code></a> fix(webtransport): decode CONNECT-stream capsules instead of dispatching them...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/01d8151e8855b41a25d0b34b54b3439bd121b8b4";><code>01d8151</code></a> fix(cpr): stop a broadcast reaching a closing resource from re-running <a href="https://github.com/Disco";><code>@Disco</code></a>...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/8fd13def5a76f1b51d2bdea28f1f82cee63e7799";><code>8fd13de</code></a> ci(release): label the issues a release fixed with its version</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/70fd698a0c586d288626e70a067127c21924d5a2";><code>70fd698</code></a> test(cpr): assert the raw control-character values directly; note Boot 4.1.1 ...</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.73";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
