dependabot[bot] opened a new pull request, #3047: URL: https://github.com/apache/cxf/pull/3047
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.37. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.37</h2> <h2>✨ Added</h2> <ul> <li><strong>4.0.36 e2e coverage sweep + framework fixes from audit Ten gap specs, two samples, five framework fixes (checkpoint/cache/binary/capability/HITL).</strong></li> <li><strong>rewrite cloned sample pom.xml for standalone compile Drops relativePath so atmosphere-project parent resolves from Maven Central, pins SNAPSHOT to release, skips repo-local checkstyle/pmd.</strong></li> <li><strong>runtime capability honesty pass — 7 runtimes declare honest capabilities</strong></li> <li><strong>clone samples for 'atmosphere new' instead of mustache templates Deletes AtmosphereInit.java + handler mustache + bash fallback; compose generator untouched.</strong></li> </ul> <h2>🐛 Fixed</h2> <ul> <li>drop PromptCacheDemoChat (requires 4.0.37-SNAPSHOT APIs) Sample demo used AiPipeline.setDefaultCachePolicy which is 4.0.37-only; sparse-clone against 4.0.36 parent broke ai-chat standalone compile. Framework cache-hit signal stays tested in ai-cache.spec.ts.</li> <li>await broadcaster subscribers in WAsync long-polling test Replaces brittle 10x5s retry loop with a subscriber-count precondition to eliminate the CI flake on slow runners.</li> <li>drop setDefaultCachePolicy from cloned ai-chat sample Method is 4.0.37-SNAPSHOT-only; sparse-clone compile against 4.0.36 parent fails at step 6.</li> <li>drop standalone-compile assertions from e2e runtime tests Clone-from-sample pom.xml inherits from the reactor parent; assert structure only. Also fix stale a2a-agent→agent template reference.</li> <li>align test-cli.sh + npx wrapper with sample-clone 'atmosphere new' Rewrites sections 12/12b/13 for the sparse-clone path; npx becomes a thin delegating shim.</li> <li>LC4j drops post-cancel errors; Settable records first-writer terminal reason RetryPolicy.isInheritSentinel formalises DEFAULT-as-inheritance contract</li> <li>use repository-dispatch + SITE_DISPATCH_TOKEN for docs sync Rewrites the atmosphere.github.io sync step to mirror the existing trigger-site-rebuild.yml pattern: fire a repository_dispatch event with the version in client_payload, let the sibling repo's own sync-version.yml workflow run its update script with its own GITHUB_TOKEN. No cross-repo cloning, no new token — reuses SITE_DISPATCH_TOKEN which already has dispatch scope on atmosphere.github.io.</li> <li>sync atmosphere.github.io sibling repo after Maven Central push New step in release-maven job clones atmosphere.github.io with DOCS_SITE_TOKEN, runs its own scripts/update-doc-versions.sh, and pushes. The sibling repo shipped 4.0.36 with 23 stale SNAPSHOT references and a 6-runtime Hero stat because the release workflow never touched it — this closes the cross-repo automation gap. When DOCS_SITE_TOKEN is unset the step emits a ::warning:: and exits 0 so missing auth is visible in CI instead of silent.</li> <li>catch two stale version patterns the doc-version script missed README.md "Current release: `X.Y.Z`" inline-code pattern and cli/sdkman/SUBMISSION.md "publish.sh X.Y.Z" example command both slipped past the tag-only and json-key regexes — 4.0.36 shipped with 4.0.36-SNAPSHOT and 4.0.35 respectively in these files. Adds two new sections to update-doc-versions.sh so the release-4x.yml workflow catches them next release, and backfills the current state to 4.0.36.</li> <li>paid nightly real-LLM workflow must build integration-tests module Same ClassNotFoundException on AiFeatureTestServer as the Ollama workflow had — the -pl target only installed modules/ai and modules/ai-test, but the Playwright fixture spawns exec:java inside modules/integration-tests which needs its own classes compiled. Mirror the Ollama workflow fix: -pl modules/integration-tests with -am pulls all transitive dependencies.</li> </ul> <h2>🔧 Changed</h2> <ul> <li>drop hardcoded atmosphere SNAPSHOT version from README Parenthetical auto-rots on every release; update-doc-versions.sh only rewrites JAR-artifact patterns, not prose references.</li> <li>update README/CHANGELOG/AGENTS for sample-clone atmosphere new Nine templates, standalone compile from Central parent, npx thin shim, samples/README points at the new flow.</li> <li>rewrite 4.0.36 CHANGELOG with verified claims + add hallucination rule</li> <li>pin runtime capability declarations to prevent docs drift</li> <li>add 4.0.36 CHANGELOG entry covering Waves 1-6 + fixes</li> <li>bump svelte from 5.55.0 to 5.55.2 in /atmosphere.js</li> <li>bump <code>@vitest/ui</code> from 4.1.2 to 4.1.4 in /atmosphere.js</li> <li>bump actions/checkout from 4 to 6</li> <li>bump actions/upload-artifact from 4 to 7</li> <li>bump org.apache.maven.plugins:maven-jxr-plugin</li> <li>bump org.apache.maven.plugins:maven-shade-plugin</li> <li>bump kotlinx.coroutines.version from 1.10.1 to 1.10.2</li> <li>bump version to 4.0.36</li> <li>prepare for next development iteration 4.0.37-SNAPSHOT</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-4.0.36...atmosphere-4.0.37";>https://github.com/Atmosphere/atmosphere/compare/atmosphere-4.0.36...atmosphere-4.0.37</a></p> <h2>Atmosphere 4.0.36</h2> <h2>✨ Added</h2> <ul> <li><strong>InMemoryResponseCache.purgeExpired for eager TTL reclamation Documents the LRU-vs-TTL interaction (expired entries occupy slots until touched) and adds a walk-once purgeExpired() so callers who schedule a background sweeper can reclaim dead slots eagerly. Default lazy-on-get path stays zero-overhead.</strong></li> <li><strong>Tier-1 Ollama real-LLM workflow with structural assertions New e2e-real-llm.yml workflow runs against a local Ollama service container with qwen2.5:0.5b. Covers basic chat through the Built-in runtime to catch wire-protocol regressions against a real provider. RealLlmChatTestHandler registers at /ai/real/chat when LLM_MODE starts with real-. real-llm-chat.spec.ts skips unless LLM_MODE is set and asserts >= 1 text-delta + clean complete within 30s.</strong></li> <li><strong>CLI cache-rebuild detection widened, samples showcase Wave 1-6 features CLI e2e test 9 now matches more rebuild indicators (downloading, resolving, BUILD SUCCESS, atmosphere-runtime marker) in addition to mismatch/building. spring-boot-ai-chat demonstrates promptCache=CONSERVATIVE on <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>. spring-boot-ai-tools adds ToolAuditListener showcasing AgentLifecycleListener with onToolCall/onToolResult.</strong></li> <li><strong><a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>.promptCache() + <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>.retry() annotation surfaces Adds promptCache = CachePolicy attribute and retry = <a href="https://github.com/Retry";><code>@Retry</code></a> nested annotation to <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>. AiEndpointProcessor reads both and calls setters on the handler; AiEndpointHandler propagates to AiStreamingSession which merges CacheHint into request metadata and threads the RetryPolicy onto the AgentExecutionContext. Also closes F-P1 with a buildRequest pass-through test that verifies the default-policy context leaves request.retryPolicy() null so the client-builder policy fires.</strong></li> <li><strong>add pipeline-level ResponseCache that replays cached runs across all runtimes New cache/ package: ResponseCache SPI, InMemoryResponseCache (LRU bounded), CacheKey (SHA-256 over content fields, session-ID-independent), CachingStreamingSession (captures send() output on miss, stores on complete). AiPipeline.setResponseCache() installs the cache; streamText consults it when CacheHint is opted in and short-circuits the runtime on hit. Works for every runtime regardless of provider-side cache support, including Koog where Prompt has no custom-fields extensibility.</strong></li> <li><strong>ADK ContextCacheConfig bootstrap, Koog coroutine Job.cancel, resolver lazy scan ADK Runners now build via App.Builder with ContextCacheConfig when setCacheConfig() is called at startup — enables Gemini prompt caching at the application level. Koog executeWithHandle stores the runBlocking coroutine Job and cancels it from ExecutionHandle.cancel() for immediate cancellation instead of soft-poll. EmbeddingRuntimeResolver re-scans on empty results to tolerate AiConfig startup-order races. SK README tightened on reactor-core 3.4.38 VT pinning risk.</strong></li> <li><strong>add EmbeddingRuntime bridges for Embabel and Semantic Kernel Embabel wraps com.embabel.common.ai.model.EmbeddingService (already 1:1 with the Atmosphere SPI). Semantic Kernel wraps TextEmbeddingGenerationService with a Mono.block() inside the sync SPI boundary and unwraps Embedding.getVector() List<!-- raw HTML omitted --> to float[]. Closes the Wave-5 exclusion overstatement flagged in the review gist.</strong></li> <li><strong>thread per-request RetryPolicy through AgentExecutionContext to Built-in client RetryPolicy becomes the 19th canonical field on AgentExecutionContext (default RetryPolicy.DEFAULT) and the 12th on ChatCompletionRequest. BuiltInAgentRuntime threads it into OpenAiCompatibleClient.sendWithRetry as a per-request override; framework runtimes (Spring AI, LC4j, ADK, Koog, Embabel) inherit their native retry layers.</strong></li> <li><strong>add EmbeddingRuntime SPI implementations for Spring AI, LC4j, and Built-in SPI was scaffold-only since Phase 8; this adds the three runtimes whose embedding APIs Atmosphere actually depends on, plus an EmbeddingRuntimeResolver and a cross-runtime contract test base. modules/rag is unchanged because both ContextProvider impls already operate at the higher-level retriever abstraction (Spring AI VectorStore, LC4j ContentRetriever) and never call EmbeddingModel directly.</strong></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1d41b224a50323c85012d027ccece2b1f8c0f61f";><code>1d41b22</code></a> release: Atmosphere 4.0.37</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/fa1c12d03bbd955d5485fe0e41f81d07c88088fc";><code>fa1c12d</code></a> fix(samples): drop PromptCacheDemoChat (requires 4.0.37-SNAPSHOT APIs)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/977786b422b88fca13093b209b5d1be277eed7de";><code>977786b</code></a> fix(samples): await broadcaster subscribers in WAsync long-polling test</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f4a2a9b46cdf2c7613d897bda6ce300151a83646";><code>f4a2a9b</code></a> fix(samples): drop setDefaultCachePolicy from cloned ai-chat sample</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/18f57e886ddf43808d649c8dd3667e1102147313";><code>18f57e8</code></a> feat(ai): 4.0.36 e2e coverage sweep + framework fixes from audit</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/7edc701f23de0042d51f5697651bbb1dbe321fdd";><code>7edc701</code></a> docs(samples): drop hardcoded atmosphere SNAPSHOT version from README</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/32c00a47097af5d38a5b6b6704f3a948796a04ae";><code>32c00a4</code></a> docs: update README/CHANGELOG/AGENTS for sample-clone atmosphere new</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/0b9a8f194d4ba3f7b52a08112640eb6ba58b3b83";><code>0b9a8f1</code></a> feat(cli): rewrite cloned sample pom.xml for standalone compile</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a259f0c401929f7592995d296f0eb5680abfa077";><code>a259f0c</code></a> fix(cli): drop standalone-compile assertions from e2e runtime tests</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/944b190f43720f5d2e22484bd4b01bb6fff18378";><code>944b190</code></a> fix(cli): align test-cli.sh + npx wrapper with sample-clone 'atmosphere new'</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.37";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
