dependabot[bot] opened a new pull request, #3077: URL: https://github.com/apache/cxf/pull/3077
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.41. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.41</h2> <h3>Changed — A2A v1.0.0 alignment (wire-breaking)</h3> <ul> <li><strong><code>atmosphere-a2a</code> retracked to A2A v1.0.0</strong> (<code>a2aproject/[email protected]</code>, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (<code>message/send</code>, <code>tasks/get</code>, …) and a polymorphic <code>Part</code> envelope; both are gone in v1.0.0.</li> <li><strong>JSON-RPC method names switched to PascalCase</strong> per spec §9.4 — <code>SendMessage</code>, <code>SendStreamingMessage</code>, <code>GetTask</code>, <code>ListTasks</code>, <code>CancelTask</code>, <code>SubscribeToTask</code>, the four <code>{Create,Get,List,Delete}TaskPushNotificationConfig</code> operations, and <code>GetExtendedAgentCard</code>. The pre-1.0 slash names and the old <code>tasks/pushNotification/*</code> path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.</li> <li><strong>HTTP+JSON / REST binding added</strong> — colon-verb endpoints (<code>POST /tasks/{id}:cancel</code>, <code>POST /tasks/{id}:subscribe</code>, <code>POST /message:send</code> / <code>:stream</code>), <code>pushNotificationConfigs</code> CRUD URLs, and <code>GET /extendedAgentCard</code> are recognized by <code>A2aHandler</code>. REST requests are translated to JSON-RPC envelopes and dispatched through the same handler so the two bindings agree by construction (Mode Parity invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/7";>#7</a>).</li> <li><strong>Type schema rewrite under <code>org.atmosphere.a2a.types</code></strong>: <ul> <li><code>Part</code> collapses three legacy subtypes (<code>TextPart</code> / <code>FilePart</code> / <code>DataPart</code>) into a single record carrying a <code>text | raw | url | data</code> oneof plus shared <code>metadata</code>, <code>filename</code>, <code>mediaType</code>. The deserializer continues to accept the pre-1.0 <code>{"type":"text",…}</code> / <code>{"kind":"text",…}</code> envelopes for migration.</li> <li><code>Message.role</code> is now the <code>Role</code> enum (<code>ROLE_USER</code> / <code>ROLE_AGENT</code> per ADR-001 ProtoJSON). Lower-case legacy forms parse for back-compat.</li> <li><code>TaskState</code> adds <code>SUBMITTED</code> (the v1.0.0 ack-before-work state) and emits its proto-JSON name on the wire (<code>TASK_STATE_WORKING</code>, …).</li> <li><code>Task.messages</code> is renamed to <code>Task.history</code>; <code>TaskStatus</code> is promoted to a top-level type and carries a <code>timestamp</code>; both update events (<code>TaskStatusUpdateEvent</code>, <code>TaskArtifactUpdateEvent</code>) gain <code>contextId</code> and <code>metadata</code> and drop the redundant <code>final</code> flag.</li> <li><code>AgentCard</code> gains <code>supportedInterfaces</code> (so an agent can advertise JSON-RPC + HTTP+JSON at distinct URLs), structured <code>AgentProvider</code>, <code>AgentCardSignature</code>, <code>iconUrl</code>, structured <code>SecurityScheme</code>/<code>SecurityRequirement</code>, and <code>extendedAgentCard</code> moves into <code>AgentCapabilities</code> (was <code>supportsAuthenticatedExtendedCard</code>). The pre-1.0 top-level <code>guardrails</code> field is no longer modeled — guardrails surface as an <code>AgentExtension</code> on <code>AgentCapabilities.extensions</code> under</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.41] - 2026-04-29</h2> <h3>Changed — A2A v1.0.0 alignment (wire-breaking)</h3> <ul> <li><strong><code>atmosphere-a2a</code> retracked to A2A v1.0.0</strong> (<code>a2aproject/[email protected]</code>, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (<code>message/send</code>, <code>tasks/get</code>, …) and a polymorphic <code>Part</code> envelope; both are gone in v1.0.0.</li> <li><strong>JSON-RPC method names switched to PascalCase</strong> per spec §9.4 — <code>SendMessage</code>, <code>SendStreamingMessage</code>, <code>GetTask</code>, <code>ListTasks</code>, <code>CancelTask</code>, <code>SubscribeToTask</code>, the four <code>{Create,Get,List,Delete}TaskPushNotificationConfig</code> operations, and <code>GetExtendedAgentCard</code>. The pre-1.0 slash names and the old <code>tasks/pushNotification/*</code> path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.</li> <li><strong>HTTP+JSON / REST binding added</strong> — colon-verb endpoints (<code>POST /tasks/{id}:cancel</code>, <code>POST /tasks/{id}:subscribe</code>, <code>POST /message:send</code> / <code>:stream</code>), <code>pushNotificationConfigs</code> CRUD URLs, and <code>GET /extendedAgentCard</code> are recognized by <code>A2aHandler</code>. REST requests are translated to JSON-RPC envelopes and dispatched through the same handler so the two bindings agree by construction (Mode Parity invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/7";>#7</a>).</li> <li><strong>Type schema rewrite under <code>org.atmosphere.a2a.types</code></strong>: <ul> <li><code>Part</code> collapses three legacy subtypes (<code>TextPart</code> / <code>FilePart</code> / <code>DataPart</code>) into a single record carrying a <code>text | raw | url | data</code> oneof plus shared <code>metadata</code>, <code>filename</code>, <code>mediaType</code>. The deserializer continues to accept the pre-1.0 <code>{"type":"text",…}</code> / <code>{"kind":"text",…}</code> envelopes for migration.</li> <li><code>Message.role</code> is now the <code>Role</code> enum (<code>ROLE_USER</code> / <code>ROLE_AGENT</code> per ADR-001 ProtoJSON). Lower-case legacy forms parse for back-compat.</li> <li><code>TaskState</code> adds <code>SUBMITTED</code> (the v1.0.0 ack-before-work state) and emits its proto-JSON name on the wire (<code>TASK_STATE_WORKING</code>, …).</li> <li><code>Task.messages</code> is renamed to <code>Task.history</code>; <code>TaskStatus</code> is promoted to a top-level type and carries a <code>timestamp</code>; both update events (<code>TaskStatusUpdateEvent</code>, <code>TaskArtifactUpdateEvent</code>) gain <code>contextId</code> and <code>metadata</code> and drop the redundant <code>final</code> flag.</li> <li><code>AgentCard</code> gains <code>supportedInterfaces</code> (so an agent can advertise JSON-RPC + HTTP+JSON at distinct URLs), structured <code>AgentProvider</code>, <code>AgentCardSignature</code>, <code>iconUrl</code>, structured <code>SecurityScheme</code>/<code>SecurityRequirement</code>, and <code>extendedAgentCard</code> moves into <code>AgentCapabilities</code> (was <code>supportsAuthenticatedExtendedCard</code>). The pre-1.0 top-level <code>guardrails</code> field is no longer modeled — guardrails surface as an <code>AgentExtension</code> on <code>AgentCapabilities.extensions</code> under</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1cd8fa65cec3de3a6e39be202193f961a1ccfab8";><code>1cd8fa6</code></a> release: Atmosphere 4.0.41</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f4f81d6d1c5c5d0b6fd15e678fa25f5779ef8ee8";><code>f4f81d6</code></a> ci(cli): rename overlay-e2e step to "(7 runtimes)" — matrix is now complete</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1e8bac16df930a3065dd954c7dc5707408148f62";><code>1e8bac1</code></a> test(cli): boot all 7 runtimes via overlay e2e (was 4 of 7)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f5ee2eb7d5777974ebfcaced19d2ee5c1a1ed09c";><code>f5ee2eb</code></a> test(cli): add semantic-kernel to overlay e2e matrix</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/9a897fe784a16cc2021b2629f674d8b5cdd0c033";><code>9a897fe</code></a> docs(cli): document --runtime --force in root + cli READMEs</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c18ac55c56bb197966e40b845e5091753244fbbc";><code>c18ac55</code></a> fix(cli): drop --force boot e2e — strip works but ai-tools has provider-coupl...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/606b45398e98d2316669e838307d22c9262466ea";><code>606b453</code></a> feat(cli): --runtime <X> --force strips pre-pinned adapters before injecting</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1e1eadb5d99cb74063e6acfce5ab36500d1a9cba";><code>1e1eadb</code></a> fix(ai): boot ai-chat with only LLM_API_KEY across spring-ai/lc4j adapters</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/e2da9e28c78f11a74e0a27a00b3b6e1fa8a71ff8";><code>e2da9e2</code></a> fix(cli): make overlay e2e survive a single failure (set -e + 300s timeout)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a472fbceccb549b7e6945c193512072a1a68f0ef";><code>a472fbc</code></a> test(cli): two-tier --runtime overlay e2e — scaffold+compile + boot+assert</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.41";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
