dependabot[bot] opened a new pull request, #3033: URL: https://github.com/apache/cxf/pull/3033
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.35. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.35</h2> <h2>✨ Added</h2> <ul> <li><strong>build SDKMAN-compatible archive and attach to GitHub Release</strong></li> </ul> <h2>🐛 Fixed</h2> <ul> <li>plexus-utils 4.0.3 override, CodeQL XSS sanitizer hints</li> <li>skip NPM publish when atmosphere.js version already published</li> </ul> <h2>🔧 Changed</h2> <ul> <li>vendor submission kit — publish script and onboarding guide</li> <li>bump version to 4.0.34</li> <li>prepare for next development iteration 4.0.35-SNAPSHOT</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-4.0.34...atmosphere-4.0.35";>https://github.com/Atmosphere/atmosphere/compare/atmosphere-4.0.34...atmosphere-4.0.35</a></p> <h2>Atmosphere 4.0.34</h2> <h2>✨ Added</h2> <ul> <li><strong>add validation gates for unchecked returns + no-op tests Architectural validation now fails on unchecked offer() and expect(true).toBe(true). Fixed 4 offer() calls (use add() or check return). Replaced 4 no-op specs with test.skip().</strong></li> <li><strong>bundle atmosphere-skills as classpath JAR for CI reliability</strong></li> <li><strong>migrate all skills to atmosphere-skills registry, remove local prompts</strong></li> <li><strong>SkillFileLoader with GitHub fallback + SHA-256 integrity, AgentRuntime.generate() PromptLoader.loadSkill() searches classpath -> disk cache -> GitHub with registry.json hash verification. skill: prefix in @Agent/<a href="https://github.com/Coordinator";><code>@Coordinator</code></a> skillFile. CollectingSession + generate() eliminate 4 duplicated sync adapters.</strong></li> <li><strong>add LlmResultEvaluator, rename QualityEvaluator to SanityCheck LLM judge uses active AgentRuntime; prompt from META-INF/skills/llm-judge/SKILL.md. Hardcoded evaluator renamed to SanityCheckEvaluator.</strong></li> <li><strong>configurable A2A timeouts, SqliteCheckpointStore, QualityResultEvaluator A2aAgentTransport.Timeouts record replaces magic numbers; CO_LOCATED preset for same-host agents. SqliteCheckpointStore persists checkpoints to SQLite. QualityResultEvaluator scores on length/structure/errors.</strong></li> <li><strong>add SqliteCheckpointStore and QualityResultEvaluator Persistent checkpoint store backed by SQLite (reuses durable-sessions pattern); built-in ResultEvaluator scoring on length, error indicators, and structure — no LLM required</strong></li> <li><strong>enable real A2A transport in multi-agent team, fix subtitle</strong></li> <li><strong>URL override forces A2A transport, enable in multi-agent sample</strong></li> <li><strong>extract pluggable RetryPolicy from hardcoded backoff Sealed RetryPolicy hierarchy (ExponentialBackoff, LinearBackoff, NoRetry) replaces hardcoded backoff in DefaultAgentProxy; backward-compatible via fromMaxRetries()</strong></li> <li><strong>add OpenAI Responses API support with previous_response_id continuation</strong></li> <li><strong>add per-agent resource limits and cancellable execution handles AgentLimits(timeout, maxTurns) via <a href="https://github.com/AgentRef";><code>@AgentRef</code></a>(timeoutMs=N), AgentExecution sealed interface with cancel()/join(), parallelCancellable() for non-blocking fan-out</strong></li> <li><strong>add agent activity model with real-time streaming AgentActivity sealed interface + StreamingActivityListener bridges fleet state to AiEvent.AgentStep over WebSocket; also adds remark-gfm for markdown table rendering</strong></li> </ul> <h2>🐛 Fixed</h2> <ul> <li>cli-runtime tests use pre-built JARs, not atmosphere run</li> <li>switch to auth-free sample, scope admin agents tab selector</li> <li>protocol mismatch fixes, selector ambiguities, skip incompatible tests</li> <li>improved WebTransport and admin test resilience</li> <li>inject auth token for admin event stream WebSocket connection</li> <li>WebTransport tests tolerate missing QUIC, admin timeout increase</li> <li>update 6 test specs for console UI migration</li> <li>correct CLI path resolution in cli-runtime.spec.ts</li> <li>move path collision check into hasUserDefinedAiEndpoint</li> <li>prevent default AI endpoint from overriding <a href="https://github.com/ManagedService";><code>@ManagedService</code></a> handlers</li> <li>add console-endpoint property, fix spring-boot-chat CI failure</li> <li>add tool-card/tool-activity test IDs, unskip demo-compatible tests</li> <li>skip LLM-dependent agui-chat UI tests to prevent CI failures</li> <li>add test IDs to console Vue components, fix E2E tests for console migration</li> <li>console endpoint detection for <a href="https://github.com/ManagedService";><code>@ManagedService</code></a> samples</li> <li>add atmosphere-ai dep for console-migrated samples</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/92f0c990c18b7a6cafedbc8dbb9e839466281165";><code>92f0c99</code></a> release: Atmosphere 4.0.35</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/9b382e3f2ab91660833e7a0ef96cffc2c5ec8cf1";><code>9b382e3</code></a> docs(sdkman): vendor submission kit — publish script and onboarding guide</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/428b4472f6a3826d918700bfaa676d4cb4030326";><code>428b447</code></a> feat(release): build SDKMAN-compatible archive and attach to GitHub Release</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/7b6b65ddd621aec10fcff97b47dff513cd0e9677";><code>7b6b65d</code></a> fix(security): plexus-utils 4.0.3 override, CodeQL XSS sanitizer hints</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/4bc7ebb0febf00bd24091483149f588ae85537e2";><code>4bc7ebb</code></a> fix(release): skip NPM publish when atmosphere.js version already published</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/dae5dcfcbf06fd33c2acbb00de71284476567bc8";><code>dae5dcf</code></a> chore(cli): bump version to 4.0.34</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/d0979c2f49415e0b0e0649cfd296199845f8d2c8";><code>d0979c2</code></a> chore: prepare for next development iteration 4.0.35-SNAPSHOT</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1611e8b53b89ea7e904793b31cf19f359e6b4bda";><code>1611e8b</code></a> release: Atmosphere 4.0.34</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/b8f1fe6528fabf09e38fa02fec169b39c6d4d16b";><code>b8f1fe6</code></a> test(e2e): skip XSS and admin agents-tab tests pending <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2598";>#2598</a> selector fix</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/9a4575125491b20eceed6ceb277d924c0d6b4b13";><code>9a45751</code></a> fix(e2e): cli-runtime tests use pre-built JARs, not atmosphere run</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.35";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
