dependabot[bot] opened a new pull request, #3103: URL: https://github.com/apache/cxf/pull/3103
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.43. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.43</h2> <h3>Added</h3> <ul> <li>per-request runtime extension helpers (<code>f1493c3f9c</code>) — small <code>attach(context, ...)</code> / <code>from(context)</code> helpers (modeled on the existing <code>CacheHint</code>) that let callers stash framework-native composition objects in <code>AgentExecutionContext.metadata()</code>, so a runtime can apply them per-request without growing the unified <code>AgentRuntime</code> SPI with framework-specific knobs. Runtimes covered: <code>SpringAiAdvisors</code> (Spring AI <code>Advisor</code> chain — RAG / memory / guardrails / observability), <code>LangChain4jAiServices</code> (LangChain4j <code>AiServices</code> / <code>TokenStream</code>), <code>KoogStrategy</code> (Koog <code>AIAgentGraphStrategy</code> DSL), <code>AdkRootAgent</code> (ADK <code>BaseAgent</code> / <code>SequentialAgent</code> / <code>ParallelAgent</code> / <code>LoopAgent</code> topology), and <code>ToolLoopPolicies</code> (per-request <code>ToolLoopPolicy</code> honored by <code>BuiltInAg entRuntime</code>'s OpenAI-compatible tool loop). The other shipped runtimes (<code>AgentScope</code>, <code>Embabel</code>, <code>SemanticKernel</code>, <code>SpringAiAlibaba</code>) do not yet have a per-request bridge — Embabel got native streaming via <code>StreamingPromptRunnerBuilder.streaming().generateStream()</code> in the same merge but no sidecar. Also added: <code>AgentLifecycleListener.onModelStart</code> / <code>onModelEnd</code> / <code>onModelError</code> hooks with <code>fireXxx</code> fan-out helpers, and <code>AiEventForwardingListener</code> adapter that translates lifecycle hooks to wire-format <code>AiEvent.Progress</code> frames (opt-in via <code>context.withListeners(...)</code>). Each bridge ships with a unit-level <code>*BridgeTest</code> proving the runtime honors the sidecar.</li> </ul> <h3>Fixed</h3> <ul> <li>Quarkus extension closes the <code>/api/console/info</code> parity gap — the bundled Atmosphere Console UI gets the same <code>subtitle / endpoint / runtime / mode</code> payload it gets from the Spring Boot starter, instead of falling through to the Vue defaults on a 404. New <code>AtmosphereConsoleInfoServlet</code> (HttpServlet, registered at build time via a second <code>ServletBuildItem</code> mapped to <code>/api/console/info</code>) reuses the same package-prefix mode-detection heuristic as <code>AtmosphereConsoleInfoEndpoint</code> (<code>org.atmosphere.{ai,agent,coordinator}.*</code> → <code>"ai"</code>, anything else including <code>ManagedAtmosphereHandler</code> → <code>"broadcast"</code>). Endpoint auto-detection prefers the canonical <code>/atmosphere/ai-chat</code> when registered (samples like <code>quarkus-ai-chat</code> ship multiple <code>@AiEndpoint</code>s), then <code>/atmosphere/agent/*</code>, then any other <code>/atmosphere/* </code>. New config keys <code>quarkus.atmosphere.console-subtitle</code> and <code>quarkus.atmosphere.console-endpoint</code> mirror the Spring <code>atmosphere.console-subtitle</code> / <code>atmosphere.console-endpoint</code> properties. JSON is hand-rolled so the runtime POM stays Jackson-free; <code>AgentRuntimeResolver</code> is reached via reflection so the servlet keeps no compile-time link to <code>modules/ai</code>. Empirically verified in chrome-devtools against <code>quarkus-ai-chat</code> — <code>/api/console/info</code> now returns <code>{"subtitle":"Runtime: langchain4j","endpoint":"/atmosphere/ai-chat","runtime":"langchain4j","mode":"ai"}</code>, the Vue Console shows the runtime label in the header subtitle, and the cross-tab isolation matrix continues to pass on the Quarkus leg.</li> <li>bundled Atmosphere Console now auto-detects AI vs. broadcast endpoints (<code>c1e8e36c7b</code>) — <code>/api/console/info</code> adds a <code>mode</code> field (<code>"ai"</code> for <code>@AiEndpoint</code> / <code>@Agent</code> / <code>@Coordinator</code>, <code>"broadcast"</code> for <code>@ManagedService</code> chats); <code>AtmosphereConsoleInfoEndpoint#detectMode</code> classifies via the registered handler's package prefix (<code>org.atmosphere.{ai,agent,coordinator}.*</code> → ai, everything else including <code>ManagedAtmosphereHandler</code> → broadcast), so the check stays compile-time independent of <code>modules/ai</code> and <code>modules/agent</code>. The Vue frontend swaps empty-state copy ("Start a conversation" + "AI assistant" → "Start a broadcast" + "every connected client on this endpoint will receive it") and the default subtitle ("Runtime: <!-- raw HTML omitted -->" → " Multi-client broadcast chat") based on the detected mode. Closes the misleading-UI half of the cross-tab leak follow-up: pre-fix, <code>spring-boot-mcp-server</code> and <code>spring-boot-otel-chat</code> rendered the AI-assistant copy despite being broadcast-shared by design. Empirically verified in chrome-devtools against both broadcast samples and <code>spring-boot-ai-chat</code>. Per-sample <code>atmosphere.console-subtitle</code> overrides still win over the mode-aware default. 5 new contract tests in <code>AtmosphereConsoleInfoEndpointModeTest</code> pin the four classification paths plus the override interaction.</li> <li>cross-tab isolation matrix extended from 11 → 15 samples (<code>c1e8e36c7b</code>) — adds <code>quarkus-ai-chat</code> (cross-runtime parity, proves the targeted-dispatch fix from <code>1fbb0958f0</code> survives Quarkus's distinct <code>QuarkusJSR356AsyncSupport</code> path), <code>spring-boot-checkpoint-agent</code> (<code>@Coordinator</code> with analyzer/approver fleet + checkpoint store), <code>spring-boot-ms-governance-chat</code> (<code>@AiEndpoint</code> with <code>@AgentScope</code> classification interceptors stacked in front), and <code>spring-boot-channels-chat</code> (omnichannel <code>@AiEndpoint</code> with Telegram/Slack/WhatsApp/Messenger channel-bridge adapters). New fixture entries in <code>e2e/fixtures/sample-server.ts</code> for the checkpoint and ms-governance samples; quarkus-ai-chat reuses the existing fixture. Out-of-scope docstring corrected to remove <code>spring-boot-channels-chat</code> (it's actually an isolated <code>@AiEndpoint</code>, not a broadcast chat) and to explicitly tag <code>spring-boot-a2a-agent</code> as out-of-scope (A2A JSON-RPC has no two-tab Console scenario). All 15 cases pass locally in 3.5m.</li> <li><code>OpenAiCompatibleClient</code> Javadoc placement broke JDK 26 strict mode (<code>28703ea064</code>) — two stacked Javadoc blocks on <code>forwardResponsesApiUsage</code> raised <code>documentation comment is not attached to any declaration</code> under <code>-Xlint:all</code> <code>-Werror</code> on JDK 26 (silent on JDK 21). Merged into a single coherent block; CI: Core (JDK 21/26) green.</li> <li><code>cli/samples.json</code> and <code>cli/atmosphere</code> template map referenced deleted <code>spring-boot-embabel-chat</code> sample (<code>3a9373e875</code>) — <code>cli/test-cli.sh</code> failed with "samples missing README.md: spring-boot-embabel-chat". Entry removed from samples.json + template-map case statement.</li> </ul> <h2>Atmosphere 4.0.42</h2> <h3>Added</h3> <ul> <li>atmosphere-verifier — plan-and-verify (Meijer "Guardians of the Agents") New module modules/verifier/ + sample samples/spring-boot-guarded-email-agent/ — sealed Workflow AST, ServiceLoader-discovered PlanVerifier chain (Allowlist/WellFormed/Capability/Taint/Automaton/SmtChecker SPI), <a href="https://github.com/Sink";><code>@Sink</code></a> + <a href="https://github.com/RequiresCapability";><code>@RequiresCapability</code></a> scanners, PlanAndVerify orchestrator, WorkflowExecutor with partial-env on failure, verify CLI; sample REST + UI exercises the inbox-exfiltration scenario end-to-end (refused before any tool fires) — 74 unit + 4 boot + 6 Playwright tests, all CI green on the feature branch.</li> </ul> <h3>Fixed</h3> <ul> <li>fail-closed verifier empty-chain, JSON-escape govern. deny, deflake wasync PlanAndVerify.withDefaults + VerifyCli runChain throw / emit chain-empty violations when ServiceLoader yields no providers (P1: silent fail-open under shading / native-image / fat-jar relocation); governance-deny tool result routes every interpolated field through ToolBridgeUtils.escapeJson via a new buildGovernanceDenyJson helper (P2: backslash/newline/control char break); ChatIntegrationTest.socketStatusTransitions polls for status transition rather than asserting in the same instant the OPEN handler fires (release-pipeline timing flake). 5 new verifier tests + 6 governance-JSON tests.</li> </ul> <h3>Changed</h3> <ul> <li>drop org.json:json — Jackson 3 only (CVE hygiene) RoomProtocolCodec + SimpleRestInterceptor migrated to tools.jackson; brace-balanced reader preserves SwaggerSocket header/body chunk semantics; ALLOW_SINGLE_QUOTES kept for wire compatibility; org.json removed from parent + 3 spring-boot samples.</li> <li>bump version to 4.0.41</li> <li>prepare for next development iteration 4.0.42-SNAPSHOT</li> </ul> <h2>Atmosphere 4.0.41</h2> <h3>Changed — A2A v1.0.0 alignment (wire-breaking)</h3> <ul> <li><strong><code>atmosphere-a2a</code> retracked to A2A v1.0.0</strong> (<code>a2aproject/[email protected]</code>, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (<code>message/send</code>, <code>tasks/get</code>, …) and a polymorphic <code>Part</code> envelope; both are gone in v1.0.0.</li> <li><strong>JSON-RPC method names switched to PascalCase</strong> per spec §9.4 — <code>SendMessage</code>, <code>SendStreamingMessage</code>, <code>GetTask</code>, <code>ListTasks</code>, <code>CancelTask</code>, <code>SubscribeToTask</code>, the four <code>{Create,Get,List,Delete}TaskPushNotificationConfig</code> operations, and <code>GetExtendedAgentCard</code>. The pre-1.0 slash names and the old <code>tasks/pushNotification/*</code> path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.</li> <li><strong>HTTP+JSON / REST binding added</strong> — colon-verb endpoints (<code>POST /tasks/{id}:cancel</code>, <code>POST /tasks/{id}:subscribe</code>, <code>POST /message:send</code> / <code>:stream</code>), <code>pushNotificationConfigs</code> CRUD</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.43] - 2026-05-06</h2> <h3>Added</h3> <ul> <li>per-request runtime extension helpers — small <code>attach(context, ...)</code> / <code>from(context)</code> helpers (modeled on the existing <code>CacheHint</code>) that let callers stash framework-native composition objects in <code>AgentExecutionContext.metadata()</code>, so a runtime can apply them per-request without growing the unified <code>AgentRuntime</code> SPI with framework-specific knobs. The matrix closes on 4.0.43: all eight framework runtimes have a sidecar — <code>SpringAiAdvisors</code> (Spring AI <code>Advisor</code> chain — RAG / memory / guardrails / observability), <code>LangChain4jAiServices</code> (LangChain4j <code>AiServices</code> / <code>TokenStream</code>), <code>KoogStrategy</code> (Koog <code>AIAgentGraphStrategy</code> DSL), <code>AdkRootAgent</code> (ADK <code>BaseAgent</code> / <code>SequentialAgent</code> / <code>ParallelAgent</code> / <code>LoopAgent</code> topology), <code>EmbabelPromptRunner</code> (<code>UnaryOperator<PromptRunne r></code> customizer applied AFTER default wiring), <code>AgentScopeAgent</code> (per-request <code>ReActAgent</code>), <code>SemanticKernelInvocation</code> (per-request <code>InvocationContext</code> — unlocks <code>KernelHooks</code>, <code>withMaxAutoInvokeAttempts</code>, custom <code>PromptExecutionSettings</code>), <code>SpringAiAlibabaRunnableConfig</code> (per-request Alibaba <code>RunnableConfig</code> for <code>threadId</code>/<code>checkPointId</code>/<code>streamMode</code>/<code>metadata</code>/<code>store</code>), plus the cross-runtime <code>ToolLoopPolicies</code> honored by <code>BuiltInAgentRuntime</code>'s OpenAI-compatible tool loop. Initial five sidecars landed via <code>f1493c3f9c</code>; the remaining four runtimes plus the lifecycle hook fan-out below landed via <code>eec98890fe</code>. Also added: <code>AgentLifecycleListener.onModelStart</code> / <code>onModelEnd</code> / <code>onModelError</code> hooks with <code>fireXxx</code> fan-out helpers wired in all 8 framework runtimes (was Built-in only), and <code>AiEventForwardingListener</code> adapter that translates lifecycle hooks to wire-format <code>AiEvent.Progress</code> frames (opt-in via <code>context.withListeners(...)</code>). Each bridge ships with a unit-level <code>*BridgeTest</code> proving the runtime honors the sidecar.</li> </ul> <h3>Fixed</h3> <ul> <li>Quarkus extension closes the <code>/api/console/info</code> parity gap — the bundled Atmosphere Console UI gets the same <code>subtitle / endpoint / runtime / mode</code> payload it gets from the Spring Boot starter, instead of falling through to the Vue defaults on a 404. New <code>AtmosphereConsoleInfoServlet</code> (HttpServlet, registered at build time via a second <code>ServletBuildItem</code> mapped to <code>/api/console/info</code>) reuses the same package-prefix mode-detection heuristic as <code>AtmosphereConsoleInfoEndpoint</code> (<code>org.atmosphere.{ai,agent,coordinator}.*</code> → <code>"ai"</code>, anything else including <code>ManagedAtmosphereHandler</code> → <code>"broadcast"</code>). Endpoint auto-detection prefers the canonical <code>/atmosphere/ai-chat</code> when registered (samples like <code>quarkus-ai-chat</code> ship multiple <code>@AiEndpoint</code>s), then <code>/atmosphere/agent/*</code>, then any other <code>/atmosphere/* </code>. New config keys <code>quarkus.atmosphere.console-subtitle</code> and <code>quarkus.atmosphere.console-endpoint</code> mirror the Spring <code>atmosphere.console-subtitle</code> / <code>atmosphere.console-endpoint</code> properties. JSON is hand-rolled so the runtime POM stays Jackson-free; <code>AgentRuntimeResolver</code> is reached via reflection so the servlet keeps no compile-time link to <code>modules/ai</code>. Empirically verified in chrome-devtools against <code>quarkus-ai-chat</code> — <code>/api/console/info</code> now returns <code>{"subtitle":"Runtime: langchain4j","endpoint":"/atmosphere/ai-chat","runtime":"langchain4j","mode":"ai"}</code>, the Vue Console shows the runtime label in the header subtitle, and the cross-tab isolation matrix continues to pass on the Quarkus leg.</li> <li>bundled Atmosphere Console now auto-detects AI vs. broadcast endpoints (<code>c1e8e36c7b</code>) — <code>/api/console/info</code> adds a <code>mode</code> field (<code>"ai"</code> for <code>@AiEndpoint</code> / <code>@Agent</code> / <code>@Coordinator</code>, <code>"broadcast"</code> for <code>@ManagedService</code> chats); <code>AtmosphereConsoleInfoEndpoint#detectMode</code> classifies via the registered handler's package prefix (<code>org.atmosphere.{ai,agent,coordinator}.*</code> → ai, everything else including <code>ManagedAtmosphereHandler</code> → broadcast), so the check stays compile-time independent of <code>modules/ai</code> and <code>modules/agent</code>. The Vue frontend swaps empty-state copy ("Start a conversation" + "AI assistant" → "Start a broadcast" + "every connected client on this endpoint will receive it") and the default subtitle ("Runtime: <!-- raw HTML omitted -->" → " Multi-client broadcast chat") based on the detected mode. Closes the misleading-UI half of the cross-tab leak follow-up: pre-fix, <code>spring-boot-mcp-server</code> and <code>spring-boot-otel-chat</code> rendered the AI-assistant copy despite being broadcast-shared by design. Empirically verified in chrome-devtools against both broadcast samples and <code>spring-boot-ai-chat</code>. Per-sample <code>atmosphere.console-subtitle</code> overrides still win over the mode-aware default. 5 new contract tests in <code>AtmosphereConsoleInfoEndpointModeTest</code> pin the four classification paths plus the override interaction.</li> <li>cross-tab isolation matrix extended from 11 → 15 samples (<code>c1e8e36c7b</code>) — adds <code>quarkus-ai-chat</code> (cross-runtime parity, proves the targeted-dispatch fix from <code>1fbb0958f0</code> survives Quarkus's distinct <code>QuarkusJSR356AsyncSupport</code> path), <code>spring-boot-checkpoint-agent</code> (<code>@Coordinator</code> with analyzer/approver fleet + checkpoint store), <code>spring-boot-ms-governance-chat</code> (<code>@AiEndpoint</code> with <code>@AgentScope</code> classification interceptors stacked in front), and <code>spring-boot-channels-chat</code> (omnichannel <code>@AiEndpoint</code> with Telegram/Slack/WhatsApp/Messenger channel-bridge adapters). New fixture entries in <code>e2e/fixtures/sample-server.ts</code> for the checkpoint and ms-governance samples; quarkus-ai-chat reuses the existing fixture. Out-of-scope docstring corrected to remove <code>spring-boot-channels-chat</code> (it's actually an isolated <code>@AiEndpoint</code>, not a broadcast chat) and to explicitly tag <code>spring-boot-a2a-agent</code> as out-of-scope (A2A JSON-RPC has no two-tab Console scenario). All 15 cases pass locally in 3.5m.</li> <li><code>OpenAiCompatibleClient</code> Javadoc placement broke JDK 26 strict mode (<code>28703ea064</code>) — two stacked Javadoc blocks on <code>forwardResponsesApiUsage</code> raised <code>documentation comment is not attached to any declaration</code> under <code>-Xlint:all</code> <code>-Werror</code> on JDK 26 (silent on JDK 21). Merged into a single coherent block; CI: Core (JDK 21/26) green.</li> <li><code>cli/samples.json</code> and <code>cli/atmosphere</code> template map referenced deleted <code>spring-boot-embabel-chat</code> sample (<code>3a9373e875</code>) — <code>cli/test-cli.sh</code> failed with "samples missing README.md: spring-boot-embabel-chat". Entry removed from samples.json + template-map case statement.</li> </ul> <h2>[4.0.42] - 2026-05-01</h2> <h3>Added</h3> <ul> <li>atmosphere-verifier — plan-and-verify (Meijer "Guardians of the Agents") New module modules/verifier/ + sample samples/spring-boot-guarded-email-agent/ — sealed Workflow AST, ServiceLoader-discovered PlanVerifier chain (Allowlist/WellFormed/Capability/Taint/Automaton/SmtChecker SPI), <a href="https://github.com/Sink";><code>@Sink</code></a> + <a href="https://github.com/RequiresCapability";><code>@RequiresCapability</code></a> scanners, PlanAndVerify orchestrator, WorkflowExecutor with partial-env on failure, verify CLI; sample REST + UI exercises the inbox-exfiltration scenario end-to-end (refused before any tool fires) — 74 unit + 4 boot + 6 Playwright tests, all CI green on the feature branch.</li> </ul> <h3>Fixed</h3> <ul> <li>fail-closed verifier empty-chain, JSON-escape govern. deny, deflake wasync PlanAndVerify.withDefaults + VerifyCli runChain throw / emit chain-empty violations when ServiceLoader yields no providers (P1: silent fail-open under shading / native-image / fat-jar relocation); governance-deny tool result routes every interpolated field through ToolBridgeUtils.escapeJson via a new buildGovernanceDenyJson helper (P2: backslash/newline/control char break); ChatIntegrationTest.socketStatusTransitions polls for status transition rather than asserting in the same instant the OPEN handler fires (release-pipeline timing flake). 5 new verifier tests + 6 governance-JSON tests.</li> </ul> <h3>Changed</h3> <ul> <li>drop org.json:json — Jackson 3 only (CVE hygiene) RoomProtocolCodec + SimpleRestInterceptor migrated to tools.jackson; brace-balanced reader preserves SwaggerSocket header/body chunk semantics; ALLOW_SINGLE_QUOTES kept for wire compatibility; org.json removed from parent + 3 spring-boot samples.</li> <li>bump version to 4.0.41</li> <li>prepare for next development iteration 4.0.42-SNAPSHOT</li> </ul> <h2>[4.0.41] - 2026-04-29</h2> <h3>Changed — A2A v1.0.0 alignment (wire-breaking)</h3> <ul> <li><strong><code>atmosphere-a2a</code> retracked to A2A v1.0.0</strong> (<code>a2aproject/[email protected]</code>, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (<code>message/send</code>, <code>tasks/get</code>, …) and a polymorphic <code>Part</code> envelope; both are gone in v1.0.0.</li> <li><strong>JSON-RPC method names switched to PascalCase</strong> per spec §9.4 — <code>SendMessage</code>, <code>SendStreamingMessage</code>, <code>GetTask</code>, <code>ListTasks</code>, <code>CancelTask</code>, <code>SubscribeToTask</code>, the four <code>{Create,Get,List,Delete}TaskPushNotificationConfig</code> operations, and <code>GetExtendedAgentCard</code>. The pre-1.0 slash names and the old <code>tasks/pushNotification/*</code> path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.</li> <li><strong>HTTP+JSON / REST binding added</strong> — colon-verb endpoints (<code>POST /tasks/{id}:cancel</code>, <code>POST /tasks/{id}:subscribe</code>, <code>POST /message:send</code> / <code>:stream</code>), <code>pushNotificationConfigs</code> CRUD</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1c60a3a66dd9b7bf87d8eda06ac09185337efdc4";><code>1c60a3a</code></a> release: Atmosphere 4.0.43</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/4be7c7f0ad1d6b62b4b6453e50e7b8251a95fde6";><code>4be7c7f</code></a> feat(quarkus): port /api/console/info servlet for bundled-Console parity</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/24cc693aad10d06a26e4812bd1861dc1d5cdd447";><code>24cc693</code></a> chore(scripts): pre-push-validate.sh excludes <a href="https://github.com/Tag";><code>@Tag</code></a>('flaky') tests</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/89965ee68ec63f2a8cd790d60fcb062e16fa8ff4";><code>89965ee</code></a> fix(console): broadcast empty-state copy must not contain 'connected'</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c9625e8b4169adcc9b443d46058a96f454342219";><code>c9625e8</code></a> chore(skills): align SKILL.md and PromptLoader with agentskills.io spec</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/8c0dd0a09543c26b67f1a4c399a1fe49022cf3f0";><code>8c0dd0a</code></a> docs(changelog): record cross-tab gap closures (mode auto-detect + matrix 15)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c1e8e36c7b7a2e11ae06c97ab2c1f961ccad8e11";><code>c1e8e36</code></a> feat(console): auto-detect ai/broadcast mode + extend cross-tab matrix to 15 ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/48e62859a94c45f1d78455e37ff87ada9daf52fb";><code>48e6285</code></a> test(ai): pin cross-tab isolation across 11 @AiEndpoint/<a href="https://github.com/Agent";><code>@Agent</code></a> samples</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/1fbb0958f0890d6d482262d85ba6d000b9973192";><code>1fbb095</code></a> fix(ai): isolate <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a> prompts to the originating client (cross-tab leak)</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a5c7ec978978c9cc0e919e39c8c018b338e834c9";><code>a5c7ec9</code></a> fix(audit): close 6 deferred surfaces from production tree</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.43";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
