dependabot[bot] opened a new pull request, #3147: URL: https://github.com/apache/cxf/pull/3147
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.47. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.47</h2> <h3>Added</h3> <ul> <li>Native Anthropic Messages API runtime in a new <code>atmosphere-anthropic</code> module (<code>1195845304</code>). <code>AnthropicMessagesClient</code> posts directly to <code>https://api.anthropic.com/v1/messages</code>, parses the SSE stream (<code>message_start</code>, <code>content_block_start</code>, <code>content_block_delta</code> with <code>text_delta</code> and <code>input_json_delta</code>, <code>message_delta</code> carrying <code>usage.input_tokens</code>/<code>output_tokens</code>, <code>message_stop</code>), and drives the <code>tool_use</code> → <code>tool_result</code> loop through the shared <code>ToolExecutionHelper.executeWithApproval</code> (max five rounds, cancellation-aware). <code>AnthropicAgentRuntime</code> is registered via <code>ServiceLoader</code> at priority 100 — same posture as every other framework runtime — and inherits <code>executeWithOuterRetry</code> so it claims <code>PER_REQUEST_RETRY</code> honestly alongside <code>TEXT_STREAMING</code>, <code>SYSTEM_PROMPT</code>, <code>STRUCTURED_OUTPUT</code>, <code>TOOL_CALLING</code>, <code>TOOL_APPROVAL</code>, <code>TOKEN_USAGE</code>, <code>CONVERSATION_MEMORY</code>, <code>BUDGET_ENFORCEMENT</code>, <code>CONFIDENCE_SCORES</code>, and <code>PASSIVATION</code>. <code>isAvailable()</code> returns true only when <code>anthropic.api.key</code> (system property or <code>AiConfig.LlmSettings</code>) is present, satisfying Correctness Invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/5";>#5</a> (Runtime Truth). The capability snapshot, capability matrix, and <code>modules/ai/README.md</code> prose were regenerated in the same commit; runtime count is now ten.</li> <li>LangChain4j 1.15.0 parity (<code>9e72c6c6f7</code>): tool-error fallback in <code>ToolExecutionHelper.executeWithApproval</code> wraps null/blank exception messages with the throwable's simple class name so NPEs surface as <code>{"error":"NullPointerException"}</code> to the model instead of opaque <code>{"error":"null"}</code>. Custom HTTP headers on <code>OpenAiCompatibleClient</code> carry proxy / per-tenant / tracing metadata (Helicone, OpenRouter, …); reserved names (<code>Authorization</code>, <code>Content-Type</code>, <code>Accept</code>) are filtered at request-build time. <code>AgentFleet.vote(...)</code> adds consensus dispatch — fans every call out in parallel and returns the result whose normalized text (<code>strip().toLowerCase(Locale.ROOT)</code>) is shared by the most peers, with deterministic insertion-order tie-breaking and a synthetic <code>"vote"</code> failure when every peer fails.</li> <li>JFR observability, declarative tool permissions, first-run sub-agent guard, and episodic memory (<code>63e34f11a4</code>): <ul> <li>JFR events under <code>org.atmosphere.ai.jfr</code> — <code>AiCallEvent</code>, <code>AgentTurnEvent</code>, <code>ToolInvocationEvent</code>, <code>SubAgentDispatchEvent</code>, <code>EpisodicMemoryAccessEvent</code>, <code>SessionLifecycleEvent</code>, <code>AiErrorEvent</code> — emitted by <code>JfrAiMetrics</code>. <code>CompositeAiMetrics</code> lets JFR coexist with Micrometer (and any other backend) instead of one replacing the other.</li> <li><code>ToolPermissionPolicy</code> SPI with the <code>PropertiesToolPermissionPolicy</code> reference impl: declarative ALLOW/DENY rules layered on top of the existing <code>@RequiresApproval</code> annotation gate. Reachable from <code>ToolExecutionHelper</code> so every runtime inherits it.</li> <li>First-run sub-agent dispatch guard in <code>DefaultAgentFleet</code> — the bootstrap pass sequences the first call through every peer individually before the parallel fan-out path is unlocked, so a</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.47] - 2026-05-21</h2> <h3>Added</h3> <ul> <li>Native Anthropic Messages API runtime in a new <code>atmosphere-anthropic</code> module (<code>1195845304</code>). <code>AnthropicMessagesClient</code> posts directly to <code>https://api.anthropic.com/v1/messages</code>, parses the SSE stream (<code>message_start</code>, <code>content_block_start</code>, <code>content_block_delta</code> with <code>text_delta</code> and <code>input_json_delta</code>, <code>message_delta</code> carrying <code>usage.input_tokens</code>/<code>output_tokens</code>, <code>message_stop</code>), and drives the <code>tool_use</code> → <code>tool_result</code> loop through the shared <code>ToolExecutionHelper.executeWithApproval</code> (max five rounds, cancellation-aware). <code>AnthropicAgentRuntime</code> is registered via <code>ServiceLoader</code> at priority 100 — same posture as every other framework runtime — and inherits <code>executeWithOuterRetry</code> so it claims <code>PER_REQUEST_RETRY</code> honestly alongside <code>TEXT_STREAMING</code>, <code>SYSTEM_PROMPT</code>, <code>STRUCTURED_OUTPUT</code>, <code>TOOL_CALLING</code>, <code>TOOL_APPROVAL</code>, <code>TOKEN_USAGE</code>, <code>CONVERSATION_MEMORY</code>, <code>BUDGET_ENFORCEMENT</code>, <code>CONFIDENCE_SCORES</code>, and <code>PASSIVATION</code>. <code>isAvailable()</code> returns true only when <code>anthropic.api.key</code> (system property or <code>AiConfig.LlmSettings</code>) is present, satisfying Correctness Invariant <a href="https://redirect.github.com/Atmosphere/atmosphere/issues/5";>#5</a> (Runtime Truth). The capability snapshot, capability matrix, and <code>modules/ai/README.md</code> prose were regenerated in the same commit; runtime count is now ten.</li> <li>LangChain4j 1.15.0 parity (<code>9e72c6c6f7</code>): tool-error fallback in <code>ToolExecutionHelper.executeWithApproval</code> wraps null/blank exception messages with the throwable's simple class name so NPEs surface as <code>{"error":"NullPointerException"}</code> to the model instead of opaque <code>{"error":"null"}</code>. Custom HTTP headers on <code>OpenAiCompatibleClient</code> carry proxy / per-tenant / tracing metadata (Helicone, OpenRouter, …); reserved names (<code>Authorization</code>, <code>Content-Type</code>, <code>Accept</code>) are filtered at request-build time. <code>AgentFleet.vote(...)</code> adds consensus dispatch — fans every call out in parallel and returns the result whose normalized text (<code>strip().toLowerCase(Locale.ROOT)</code>) is shared by the most peers, with deterministic insertion-order tie-breaking and a synthetic <code>"vote"</code> failure when every peer fails.</li> <li>JFR observability, declarative tool permissions, first-run sub-agent guard, and episodic memory (<code>63e34f11a4</code>): <ul> <li>JFR events under <code>org.atmosphere.ai.jfr</code> — <code>AiCallEvent</code>, <code>AgentTurnEvent</code>, <code>ToolInvocationEvent</code>, <code>SubAgentDispatchEvent</code>, <code>EpisodicMemoryAccessEvent</code>, <code>SessionLifecycleEvent</code>, <code>AiErrorEvent</code> — emitted by <code>JfrAiMetrics</code>. <code>CompositeAiMetrics</code> lets JFR coexist with Micrometer (and any other backend) instead of one replacing the other.</li> <li><code>ToolPermissionPolicy</code> SPI with the <code>PropertiesToolPermissionPolicy</code> reference impl: declarative ALLOW/DENY rules layered on top of the existing <code>@RequiresApproval</code> annotation gate. Reachable from <code>ToolExecutionHelper</code> so every runtime inherits it.</li> <li>First-run sub-agent dispatch guard in <code>DefaultAgentFleet</code> — the bootstrap pass sequences the first call through every peer individually before the parallel fan-out path is unlocked, so a</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/cf9007e0ab4d298b1b80cb5e482aa2abee8128fc";><code>cf9007e</code></a> release: Atmosphere 4.0.47</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a562ecb189b4bb4a63c7f84f612cda90437d1d14";><code>a562ecb</code></a> docs(drift): log AnthropicAgentRuntime PER_REQUEST_RETRY under-claim caught b...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f25a470ba0b0e4241fa4e68c09d17696f6dd22c1";><code>f25a470</code></a> docs: changelog + README — Anthropic runtime, LC4j 1.15 parity, JFR/permissio...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/119584530419da37e2bbec72da3bd60975b57595";><code>1195845</code></a> feat(anthropic): native Anthropic Messages API runtime — SSE streaming + tool...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/9e72c6c6f75f463c5f53702a58737dea08eddaf1";><code>9e72c6c</code></a> feat(ai,coordinator): LC4j 1.15.0 parity — tool-error fallback, customHeaders...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/df19027ab8ebfab6188a1fe236dbdda6128c68d9";><code>df19027</code></a> test(integration): widen GrpcWasyncTransportTest status-poll to 20s for JDK 2...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/63e34f11a4ae1d1ae954d6690b7c0208e324b5c3";><code>63e34f1</code></a> feat(ai): JFR observability, ToolPermissionPolicy, first-run subagent guard, ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/38565e43ef0aedda5099ba5ca2cb36470bb8b64e";><code>38565e4</code></a> fix(coding-agent): case-insensitive README probe + drop dual config</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c1e4d72fd4facf49d5ee337f49810823af76ae54";><code>c1e4d72</code></a> chore(cli): bump version to 4.0.46</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/2d45e655329c4fd4baef15ba387860cfa3326f2d";><code>2d45e65</code></a> chore(js): prepare next development version 5.0.26</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.47";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
