dependabot[bot] opened a new pull request, #3641: URL: https://github.com/apache/cxf/pull/3641
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.76. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.76</h2> <h3>Added</h3> <ul> <li>keep a prompt under the run id its transport mints, shown again on reload at once</li> <li>send a prompt under a run id the client mints, kept before it is sent</li> <li>adopt the run id a client mints for its prompt, running a prompt once per id</li> <li>serve the Atmosphere Console as the sample UI</li> <li>keep the picked room across a page reload</li> </ul> <h3>Fixed</h3> <ul> <li>ai-tools lets atmosphere.ai.mode and model apply when LLM_MODE and LLM_MODEL are unset</li> <li>log a refused cleartext key once and a tool failure without a stack</li> <li>new --runtime without --force warns when the template pins another adapter</li> <li>startup-team web_search card ends as failed when the search did not run</li> <li>ai-tools derives llm.base-url after atmosphere.ai.* is mapped onto llm.*</li> <li>a timed-out <a href="https://github.com/Prompt";><code>@Prompt</code></a> turn ends with an error frame the client keeps, live and on reload</li> <li>every runtime sends an API key over plain http only to a loopback host</li> <li>a workspace tool that fails (read_file on a missing file) ends with a tool-error</li> <li>atmosphere.ai.mode/model/api-key/base-url reach the runtime adapters as llm.*</li> <li>read llm.* between atmosphere.koog.* and LLM_*, first non-blank wins</li> <li>read LLM_MODE trimmed, as AiConfig and the other adapters do</li> <li>the llm.* bridges read LLM_MODE trimmed, as AiConfig does</li> <li>the keyless-model gate reads LLM_MODE trimmed and case-insensitive</li> <li>a blank base URL follows the model in LC4j, Spring AI, Alibaba, AgentScope, SK</li> <li>LLM_MODE=local maps the local endpoint into the openai-custom starter</li> <li>log the ChatModel's model, endpoint and local flag at startup</li> <li>LLM_BASE_URL with /v1 is mapped without it, as Spring AI 1.x appends /v1</li> <li>mcp-server tools report a failure as isError true, not an error-shaped success</li> <li>a2a-agent's ask skill no longer records the user message twice</li> <li>durable-sessions keeps missed messages for the Console's whole reconnect window</li> <li>ms-governance denies a Luhn-valid card number, not every 16-digit integer</li> <li>ai-tools no longer imports LangChain4j, so --runtime X --force compiles</li> <li>LLM_MODE=local builds the auto-configured model for the local endpoint</li> <li>a provider error ends the turn with an error frame, not an answer</li> <li>LLM_MODE=local maps the local Ollama endpoint, not api.openai.com</li> <li>LLM_MODE=local builds the ChatClient for the local endpoint, not api.openai.com</li> <li>a tool call AgentScope rejects before the tool runs ends with a tool-error</li> <li>stream each answer once, not again as the round's and the agent's result</li> <li>a large integer in an answer is not a credit card to PII redaction</li> <li>a bare run of digits in an answer is not a phone number to PII redaction</li> <li>send an API key over plain http only to a loopback host</li> <li>a turn that ended with no text, tool card or error renders no bubble</li> <li>cap the wait between reconnect attempts at 25 s</li> <li>a tool call whose outcome the journal cannot record keeps its one end frame</li> <li>a tool call that failed stays in the lineage record, with its error</li> <li>a cancelled turn's undispatched tool reports nothing once the session closed</li> <li>a failed tool call carries its error over AG-UI and the Console shows it failed</li> <li>a tool call that failed ends with a tool-error, once per call, on every runtime</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.76] - 2026-10-22</h2> <h3>Added</h3> <ul> <li>keep a prompt under the run id its transport mints, shown again on reload at once</li> <li>send a prompt under a run id the client mints, kept before it is sent</li> <li>adopt the run id a client mints for its prompt, running a prompt once per id</li> <li>serve the Atmosphere Console as the sample UI</li> <li>keep the picked room across a page reload</li> </ul> <h3>Fixed</h3> <ul> <li>ai-tools lets atmosphere.ai.mode and model apply when LLM_MODE and LLM_MODEL are unset</li> <li>log a refused cleartext key once and a tool failure without a stack</li> <li>new --runtime without --force warns when the template pins another adapter</li> <li>startup-team web_search card ends as failed when the search did not run</li> <li>ai-tools derives llm.base-url after atmosphere.ai.* is mapped onto llm.*</li> <li>a timed-out <a href="https://github.com/Prompt";><code>@Prompt</code></a> turn ends with an error frame the client keeps, live and on reload</li> <li>every runtime sends an API key over plain http only to a loopback host</li> <li>a workspace tool that fails (read_file on a missing file) ends with a tool-error</li> <li>atmosphere.ai.mode/model/api-key/base-url reach the runtime adapters as llm.*</li> <li>read llm.* between atmosphere.koog.* and LLM_*, first non-blank wins</li> <li>read LLM_MODE trimmed, as AiConfig and the other adapters do</li> <li>the llm.* bridges read LLM_MODE trimmed, as AiConfig does</li> <li>the keyless-model gate reads LLM_MODE trimmed and case-insensitive</li> <li>a blank base URL follows the model in LC4j, Spring AI, Alibaba, AgentScope, SK</li> <li>LLM_MODE=local maps the local endpoint into the openai-custom starter</li> <li>log the ChatModel's model, endpoint and local flag at startup</li> <li>LLM_BASE_URL with /v1 is mapped without it, as Spring AI 1.x appends /v1</li> <li>mcp-server tools report a failure as isError true, not an error-shaped success</li> <li>a2a-agent's ask skill no longer records the user message twice</li> <li>durable-sessions keeps missed messages for the Console's whole reconnect window</li> <li>ms-governance denies a Luhn-valid card number, not every 16-digit integer</li> <li>ai-tools no longer imports LangChain4j, so --runtime X --force compiles</li> <li>LLM_MODE=local builds the auto-configured model for the local endpoint</li> <li>a provider error ends the turn with an error frame, not an answer</li> <li>LLM_MODE=local maps the local Ollama endpoint, not api.openai.com</li> <li>LLM_MODE=local builds the ChatClient for the local endpoint, not api.openai.com</li> <li>a tool call AgentScope rejects before the tool runs ends with a tool-error</li> <li>stream each answer once, not again as the round's and the agent's result</li> <li>a large integer in an answer is not a credit card to PII redaction</li> <li>a bare run of digits in an answer is not a phone number to PII redaction</li> <li>send an API key over plain http only to a loopback host</li> <li>a turn that ended with no text, tool card or error renders no bubble</li> <li>cap the wait between reconnect attempts at 25 s</li> <li>a tool call whose outcome the journal cannot record keeps its one end frame</li> <li>a tool call that failed stays in the lineage record, with its error</li> <li>a cancelled turn's undispatched tool reports nothing once the session closed</li> <li>a failed tool call carries its error over AG-UI and the Console shows it failed</li> <li>a tool call that failed ends with a tool-error, once per call, on every runtime</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/31879a918eb8240acdb6c5e72b6f5b7c9a2bc021";><code>31879a9</code></a> release: Atmosphere 4.0.76</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c74624ab9a5880d436764dc9f9eda223d46d47c8";><code>c74624a</code></a> chore(release): record the pre-4.0.76 sample sweep at 00ac7fb403</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/00ac7fb403c28d4be52aed92dd129a2cd3a83838";><code>00ac7fb</code></a> fix(samples): ai-tools lets atmosphere.ai.mode and model apply when LLM_MODE ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/e89b144b4cc92b0e9a71b614371efd4b129297ff";><code>e89b144</code></a> fix(ai,mcp): log a refused cleartext key once and a tool failure without a stack</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/37ec0a4a91aed1036cc481e1fb5629c860a8e125";><code>37ec0a4</code></a> fix(cli): new --runtime without --force warns when the template pins another ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/5ea6c86215846f9032d75ef80a580e4eaf903e01";><code>5ea6c86</code></a> fix(samples): startup-team web_search card ends as failed when the search did...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f7e1782b7c30853e100b73d25cb435184d602acb";><code>f7e1782</code></a> fix(samples): ai-tools derives llm.base-url after atmosphere.ai.* is mapped o...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/14419b320f087dc2bd52923f8cdc882849cc43f9";><code>14419b3</code></a> fix(ai): a timed-out <a href="https://github.com/Prompt";><code>@Prompt</code></a> turn ends with an error frame the client keeps, ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/ebf5d8743e41a9efee6dfea36f796c3c4afb3861";><code>ebf5d87</code></a> fix(ai): every runtime sends an API key over plain http only to a loopback host</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/6896ef10188471e95dfd62ec7dced597f476f55b";><code>6896ef1</code></a> fix(ai): a workspace tool that fails (read_file on a missing file) ends with ...</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.76";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
