dependabot[bot] opened a new pull request, #3377: URL: https://github.com/apache/cxf/pull/3377
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.66. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.66</h2> <h3>Added</h3> <ul> <li>add opt-in durable batch job API at /atmosphere/v1/batches riding AiPipeline SQLite-backed submit/poll/results/cancel, default off; eval dataset runner is the first consumer</li> <li>opt-in Ed25519 state sealing wires AgentStateIntegrity into FileSystemAgentState</li> <li>give the classroom a <a href="https://github.com/RoomService";><code>@RoomService</code></a> chat channel with history A templated <a href="https://github.com/RoomService";><code>@RoomService</code></a> path created one shared room for every path value, so two classrooms saw each other's members and history</li> </ul> <h3>Fixed</h3> <ul> <li>report a non-runnable sample before checking the JDK</li> <li>scaffold from the ref that matches the pinned version, and make compose work anywhere</li> <li>stop provider defaults from shadowing a local backend</li> <li>boot the reactor version, never the newest jar lying in target/</li> <li>never drop a React Native send, and ship the types we advertise</li> <li>send tool-call arguments as a JSON object on the OpenAI wire</li> <li>screen tool-call arguments in deny lists and reach local Koog backends</li> <li>treat a local backend as reachable without a credential</li> <li>report the ms-governance rule count from the loaded policies</li> <li>render every streamed chunk and scope tool cards to their turn</li> <li>build a default model for keyless local backends</li> <li>boot exec-type samples through the helper instead of by hand grpc-chat is the matrix's only exec sample and the helper died on it, so it had to be started manually with the LLM env scrubbed by hand</li> <li>use the Session-bearing SendResult constructors WebSocket 2.2 deprecates the no-Session forms and the build is -Werror.</li> <li>register <a href="https://github.com/Message";><code>@Message</code></a> payload types in the Quarkus deployment processor The Spring AOT half landed separately on main; this is the Jandex-side equivalent, so the Quarkus native lane stops dying on the payload</li> <li>stop the demo runtime shadowing a locally served model A local backend needs no key, so a blank key was the wrong test for "no backend" — LLM_MODE=local reached Ollama and still answered from the canned script</li> <li>restore the request body after reading it for a room command Draining the stream without writing it back meant a <a href="https://github.com/Message";><code>@Message</code></a> sent over long-polling or SSE never reached the annotated method</li> <li>register the payload types an annotated method carries Encoders were registered but not the DTO they convert, so a native image invoked the codec and then failed on the payload</li> <li>register RoomServiceProcessor so <a href="https://github.com/RoomService";><code>@RoomService</code></a> works under GraalVM It was the one <a href="https://github.com/AtmosphereAnnotation";><code>@AtmosphereAnnotation</code></a> processor missing from the registry; the guarding test only checked the list was non-empty, so it never bit</li> <li>scrub ambient LLM env in the launcher; raise boot timeout to 300s Inherited LLM_BASE_URL sent local-mode samples to Gemini; also logs the 2026-08-07 drift.</li> <li>stage cli/samples.json with the docs it is validated against Every release landed one commit where the docs named the new version and the guard's source of truth still named the old one, turning CI red</li> </ul> <h3>Changed</h3> <ul> <li>pin JDK 21 in the CLI unit job to match the CLI's own baseline</li> <li>log the false-green prime and the premature stops Two 2026-08-08 slips: -Pfastinstall disarmed -Werror; halting on actionable work.</li> <li>stop asserting which sweeper evicts the expired session Two sweepers race at a 1ms TTL; assert the eviction outcome, not the count.</li> <li>state the personal-assistant workspace's real persistence scope</li> <li>websocket-api 2.2.0 + client-api, kotlinx 1.11.0, setup-python v7 The API split at 2.1.0; client types need the companion artifact. Lands <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2750";>#2750</a>/<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2748";>#2748</a>/<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2751";>#2751</a>.</li> <li>exclude unpatchable fastjson 1.x from the Alibaba framework GHSA-crf3-v9rr-v7hj critical RCE; 1.2.83 is the last 1.x and no fix exists.</li> <li>make three tests hermetic against machine state Pin fake LLM mode, drain to quiescence after join, retry the Docker probe.</li> <li>micrometer 1.16.6, pin jsoup 1.23.1 Closes GHSA-g3pr-3p32-fp23 + GHSA-w737-wx49-qj23 (server DoS) and GHSA-pmhh-3w7g-xqp8.</li> <li>drive WebSocket, SSE and the room protocol against the native binaries A JDK-only probe proves fan-out, <a href="https://github.com/Message";><code>@Message</code></a> codecs and rooms; READMEs drop the now-false unproven lists</li> <li>drop hard counts that drift, and scope the gRPC native section The counts went stale within hours of being written; gRPC is registered but built natively by no lane</li> <li>re-add the AI dispatch job now that discovery survives native image The blocker that forced its removal is fixed; whether <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a> works natively stays unproven until this job is green</li> <li>correct LLM_MODE=local endpoint claim after shakedown run Runtime resolves mode=local to Gemini on the Spring path; add jstack + boot-hang triage.</li> <li>add release-sample-sweep skill and contributor doc Covers 31 samples, the Expo client and the atmosphere CLI as pre-release gates.</li> <li>prepare next development version 5.0.41</li> <li>bump version to 4.0.65</li> <li>prepare for next development iteration 4.0.66-SNAPSHOT</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.66] - 2026-08-09</h2> <h3>Added</h3> <ul> <li>add opt-in durable batch job API at /atmosphere/v1/batches riding AiPipeline SQLite-backed submit/poll/results/cancel, default off; eval dataset runner is the first consumer</li> <li>opt-in Ed25519 state sealing wires AgentStateIntegrity into FileSystemAgentState</li> <li>give the classroom a <a href="https://github.com/RoomService";><code>@RoomService</code></a> chat channel with history A templated <a href="https://github.com/RoomService";><code>@RoomService</code></a> path created one shared room for every path value, so two classrooms saw each other's members and history</li> </ul> <h3>Fixed</h3> <ul> <li>report a non-runnable sample before checking the JDK</li> <li>scaffold from the ref that matches the pinned version, and make compose work anywhere</li> <li>stop provider defaults from shadowing a local backend</li> <li>boot the reactor version, never the newest jar lying in target/</li> <li>never drop a React Native send, and ship the types we advertise</li> <li>send tool-call arguments as a JSON object on the OpenAI wire</li> <li>screen tool-call arguments in deny lists and reach local Koog backends</li> <li>treat a local backend as reachable without a credential</li> <li>report the ms-governance rule count from the loaded policies</li> <li>render every streamed chunk and scope tool cards to their turn</li> <li>build a default model for keyless local backends</li> <li>boot exec-type samples through the helper instead of by hand grpc-chat is the matrix's only exec sample and the helper died on it, so it had to be started manually with the LLM env scrubbed by hand</li> <li>use the Session-bearing SendResult constructors WebSocket 2.2 deprecates the no-Session forms and the build is -Werror.</li> <li>register <a href="https://github.com/Message";><code>@Message</code></a> payload types in the Quarkus deployment processor The Spring AOT half landed separately on main; this is the Jandex-side equivalent, so the Quarkus native lane stops dying on the payload</li> <li>stop the demo runtime shadowing a locally served model A local backend needs no key, so a blank key was the wrong test for "no backend" — LLM_MODE=local reached Ollama and still answered from the canned script</li> <li>restore the request body after reading it for a room command Draining the stream without writing it back meant a <a href="https://github.com/Message";><code>@Message</code></a> sent over long-polling or SSE never reached the annotated method</li> <li>register the payload types an annotated method carries Encoders were registered but not the DTO they convert, so a native image invoked the codec and then failed on the payload</li> <li>register RoomServiceProcessor so <a href="https://github.com/RoomService";><code>@RoomService</code></a> works under GraalVM It was the one <a href="https://github.com/AtmosphereAnnotation";><code>@AtmosphereAnnotation</code></a> processor missing from the registry; the guarding test only checked the list was non-empty, so it never bit</li> <li>scrub ambient LLM env in the launcher; raise boot timeout to 300s Inherited LLM_BASE_URL sent local-mode samples to Gemini; also logs the 2026-08-07 drift.</li> <li>stage cli/samples.json with the docs it is validated against Every release landed one commit where the docs named the new version and the guard's source of truth still named the old one, turning CI red</li> </ul> <h3>Changed</h3> <ul> <li>pin JDK 21 in the CLI unit job to match the CLI's own baseline</li> <li>log the false-green prime and the premature stops Two 2026-08-08 slips: -Pfastinstall disarmed -Werror; halting on actionable work.</li> <li>stop asserting which sweeper evicts the expired session Two sweepers race at a 1ms TTL; assert the eviction outcome, not the count.</li> <li>state the personal-assistant workspace's real persistence scope</li> <li>websocket-api 2.2.0 + client-api, kotlinx 1.11.0, setup-python v7 The API split at 2.1.0; client types need the companion artifact. Lands <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2750";>#2750</a>/<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2748";>#2748</a>/<a href="https://redirect.github.com/Atmosphere/atmosphere/issues/2751";>#2751</a>.</li> <li>exclude unpatchable fastjson 1.x from the Alibaba framework GHSA-crf3-v9rr-v7hj critical RCE; 1.2.83 is the last 1.x and no fix exists.</li> <li>make three tests hermetic against machine state Pin fake LLM mode, drain to quiescence after join, retry the Docker probe.</li> <li>micrometer 1.16.6, pin jsoup 1.23.1 Closes GHSA-g3pr-3p32-fp23 + GHSA-w737-wx49-qj23 (server DoS) and GHSA-pmhh-3w7g-xqp8.</li> <li>drive WebSocket, SSE and the room protocol against the native binaries A JDK-only probe proves fan-out, <a href="https://github.com/Message";><code>@Message</code></a> codecs and rooms; READMEs drop the now-false unproven lists</li> <li>drop hard counts that drift, and scope the gRPC native section The counts went stale within hours of being written; gRPC is registered but built natively by no lane</li> <li>re-add the AI dispatch job now that discovery survives native image The blocker that forced its removal is fixed; whether <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a> works natively stays unproven until this job is green</li> <li>correct LLM_MODE=local endpoint claim after shakedown run Runtime resolves mode=local to Gemini on the Spring path; add jstack + boot-hang triage.</li> <li>add release-sample-sweep skill and contributor doc Covers 31 samples, the Expo client and the atmosphere CLI as pre-release gates.</li> <li>prepare next development version 5.0.41</li> <li>bump version to 4.0.65</li> <li>prepare for next development iteration 4.0.66-SNAPSHOT</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/603c8cc755f36bf57d13dc2c97ed6812b2ccc9ce";><code>603c8cc</code></a> release: Atmosphere 4.0.66</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/741e4a83fc95d2f439830b6832c9af120e5ade40";><code>741e4a8</code></a> ci(cli): pin JDK 21 in the CLI unit job to match the CLI's own baseline</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/8e0bbf2d4771a4b0d17dd944df1e3609dfc50845";><code>8e0bbf2</code></a> fix(cli): report a non-runnable sample before checking the JDK</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/7c4c26a5ecbd71ae7c70e8f9fc7f77ff8dabc174";><code>7c4c26a</code></a> fix(cli): scaffold from the ref that matches the pinned version, and make com...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/db88f5c2bea6890189b5deca88126872d3c0ac2a";><code>db88f5c</code></a> fix(samples): stop provider defaults from shadowing a local backend</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/368f60cfd6b0d840f17d535b1f48e899ac136e53";><code>368f60c</code></a> fix(ci): boot the reactor version, never the newest jar lying in target/</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/dbb3bc72d9640d0687eff49f110781fd96922ad6";><code>dbb3bc7</code></a> fix(atmosphere.js): never drop a React Native send, and ship the types we adv...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/ffbbec92b48862f86aeb243496e933bb2bf36b58";><code>ffbbec9</code></a> fix(koog): send tool-call arguments as a JSON object on the OpenAI wire</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/9deec7a27ee754866ed4d6514533107985e63d0d";><code>9deec7a</code></a> docs(harness): log the false-green prime and the premature stops</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/2e7d72699d8b3b442f1e8cbbe534b46dea220ac8";><code>2e7d726</code></a> test(mcp): stop asserting which sweeper evicts the expired session</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.66";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
