dependabot[bot] opened a new pull request, #3366: URL: https://github.com/apache/cxf/pull/3366
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.64. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.64</h2> <h3>Added</h3> <ul> <li>bound the default gateway and make checkpoint encryption readable safeDefault replaces a 1M/hour non-limiter with an anonymous bucket sized above the per-principal one; CheckpointStore.encryptsAtRest reports posture instead of only logging it</li> <li>bind tool-loop caps on AgentScope and CrewAI, discover TokenPricing AgentScope maxIters per request, CrewAI max_iter across the sidecar wire; ToolLoopGuard survey now names why SK/SpringAI/Alibaba cannot be capped</li> <li>beforeCompletion interceptor hook fires before the terminal frame Metadata emitted from postProcess was silently dropped at the closed leaf; the hook runs LIFO pre-terminal with Throwable isolation, consume-once arming, error-path invalidation and a reentrancy latch</li> <li>screen tool output for injection by default, marking not deleting Tri-state OFF/ANNOTATE/SANITIZE defaulting to ANNOTATE; bounded 256KB scan; init-param bridge; OWASP A04 now COVERED</li> <li>add LiteLLM proxy quick factory to OpenAiCompatibleClient</li> <li>resolve ACS manifest extends chains with upstream additive-merge semantics Depth-first chain resolution with canonical trust-root confinement, atomic policy bindings, cycle/depth/conflict errors mirroring Microsoft's resolver; URL extends rejected fail-closed and bundle refs rebased per declaring file</li> <li>relay HITL approvals across nodes so any node can answer Publishes an unresolved approval on a cluster broadcaster channel; the owning node completes the parked future, non-owners no-op on UNKNOWN_ID</li> <li>response-cache parity on <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>, CrewAI schema facets, ADK step cap Consumers: AiStreamingSession gate + ResponseCacheConfig install at AiEndpointProcessor; ToolBridgeUtils schema on the CrewAI sidecar wire; LlmAgent.maxSteps opt-in</li> <li>parse and enforce MS Agent Control Specification manifests YamlPolicyParser routes the ACS root key to intervention-point bindings with fail-closed opa-backed rego verdicts; weekly conformance diffs upstream's own contract fixtures on main, retiring the pre-ACS pin</li> <li>carry enum, array and nested facets into Koog and Embabel schemas Both bridges flattened every structural facet to a string; Koog gains Enum/List/Object types, Embabel its enum/properties/itemType slots</li> <li>Tier-3 polish — observability, TCK depth, invariants, security defaults, DX Consumers: percentile+cached-token meters and console tab on both runtimes; behavioural CANCELLATION TCK + capability meta-gate across 12 runtimes; session-map sweeper and MCP teardown; Anthropic cache_control/tool-deltas/model enumeration; JDBC schema versioning; A2A raw-handler admission; webhook dedup; Kotlin agent DSL; markdown/sentence chunkers; 20 e2e tests returned to live coverage</li> <li>tool-call correctness — schemas, arg parsing, execution bound, MCP fail-closed Consumers: McpProtocolHandler tools/call gate; parseJsonArgs at 6 bridges; ToolExecutionHelper seam on all 11 runtimes; schema emitters for Built-in/Anthropic/Cohere/SpringAI/Alibaba; MetricsCapturingSession + admin snapshot</li> <li>error taxonomy, reranker, OpenAI serving, prompt registry, eval runner, cost parity Consumers: classifier at 12 runtime error seams + typed outer retry; over-fetch rerank on the retrieval path; /atmosphere/v1 via AiPipeline (default off); prompt: resolution at 3 processor seams; POST /api/admin/evals/run + CI smoke; Quarkus CostAccountantHolder install + servlet guardrail bridge</li> <li>opt-in tape redaction hook and checkpoint encryption at rest TapeRedactor SPI + PII redactor on both tape write paths; AES-256-GCM CheckpointCipher with legacy-plaintext migration; plaintext startup WARN</li> <li>wire GenerationParams into ADK, Semantic Kernel, Cohere, Koog adapters Contract test now forces every runtime to declare honor-vs-cede; README honoring matrix updated</li> <li>feed cost and tool-call meters at the shared metrics seam TokenPricingHolder gates dollars (no fabricated $0); starters install pricing; admin snapshot exposes costUsdTotal + tool timer</li> <li>record HITL approval decisions in the durable effect journal Crash-resume replays a committed approve/deny without re-prompting; timeouts and cross-principal re-drives re-prompt</li> <li>add SQLite durable-timer and run-journal backends</li> <li>add CheckpointStore producer and console parity</li> <li>add web-search tool and pluggable WebSearchEngine SPI</li> <li>add model context-window catalog for model-aware compaction</li> <li>add evaluator-driven refineUntil supervisor loop</li> </ul> <h3>Fixed</h3> <ul> <li>register managed-service interceptors and bind the prompt method by name Reflective instantiation failures were caught and logged, so the AI endpoint silently never registered under GraalVM</li> <li>declare the concrete store type on the lifecycle <a href="https://github.com/Bean";><code>@Bean</code></a> Spring AOT hinted CheckpointStore.start() while the container invoked it on InMemoryCheckpointStore, failing native startup</li> <li>runtime-init the two OpenSsl private-key-method interfaces too Their constants getstatic the tcnative JNI values ReferenceCountedOpenSslContext now reaches; native build verified locally in the mandrel container</li> <li>runtime-init io.netty.internal.tcnative for native image netty 4.1.136's SslContext reaches SSLPrivateKeyMethod during analysis; its JNI init fails in the builder (sslSignRsaPkcsSha1 UnsatisfiedLinkError)</li> <li>make the PII email regex linear-time on long local-part runs Negative lookbehind + possessive quantifier close CodeQL java/polynomial-redos; matches unchanged, regression test scans 500k chars</li> <li>patch every open Dependabot alert across Maven and npm manifests netty 4.2.16/4.1.136, quarkus 3.36.3, jetty 12.0.36, jackson 3.2.1/3.1.5/2.22.1, spring 6.2.19, lz4/spring-retry/postgresql pins, npm lockfiles + console bundle refresh</li> <li>ai-tools cost badge rides beforeCompletion without clobbering the router routing.* moves off the dead postProcess path and yields to RoutingLlmClient's genuine values; reset copy no longer narrates success before the approval verdict; e2e asserts the rendered chips</li> <li>merge server metadata frames by their wire shape The handler read msg.data but Atmosphere metadata frames carry top-level key/value, so routing chips never rendered from server emissions; bundle resynced to all committed consumers</li> <li>bound cost-ceiling tenant buckets and roll accrual over The map was keyed by a caller-supplied MDC tag with no cap and never decayed; 500 tags made 500 entries and one breach blocked forever</li> <li>size the compaction budget to the endpoint model, not the app default CompactionConfig.resolve(cfg, model) had zero callers, so <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>(model=) got the configured model window - 1M instead of 128k</li> <li>register console assets by pattern so native stops pruning the SPA Both hardcoded hashes had gone stale; the old test compared the registration to itself and passed. Also: meta-gate bite test, DatabaseAgentState doc-truth</li> <li>route keyless demo mode through the pipeline runtime across the AI samples DemoResponseProducer bypasses become DemoAgentRuntime strategies (agui/dentist/orchestration/ai-tools; quarkus documents its bridge-only truth); ai-tools drives real tools and the real approval registry via new AiStreamingSession.unwrap, with HITL/tool-activity specs strengthened to match</li> <li>close open text and tool frames on completion, gate post-terminal emits Pipeline dispatches never emitted TEXT_MESSAGE_END (only the agui sample's hand-rolled TextComplete did) and a dangling TOOL_CALL_START leaked on complete; both AG-UI sessions now close innermost-first and drop frames after RUN_FINISHED/RUN_ERROR</li> <li>route the ai-chat demo fallback through the framework dispatch seam The <a href="https://github.com/Prompt";><code>@Prompt</code></a> short-circuit bypassed DispatchDecorators, so no key meant no dev-inspector/tape/metrics; SB3 starter gains the inspector for parity</li> <li>gate the dev inspector on its own type, not a neighbouring module Top-level placement broke servlet-only apps with NoClassDefFoundError; the coordinator gate silently skipped the recorder</li> <li>install the dev inspector without requiring the coordinator The bean sat inside the coordinator-gated config, so plain AI apps recorded nothing despite the flag</li> <li>relay a worker-observed interrupt across the bounded dispatch hop An interrupt raised inside the agent body now reaches the coordinating thread so refineUntil stops at its turn boundary</li> <li>unify dispatch decorator stacks behind one shared composer Budget+confidence now on <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>; cost+lineage+dev-inspector now on the pipeline path; parity test pins the order</li> <li>HTTP-layer retry with Retry-After in the shared SSE base 429/500/502/503/408 now retried for Anthropic and Cohere; error emitted once after budget; cancel-aware bounded backoff</li> <li>rag-chat queries the real vector store via similaritySearch Endpoint + <a href="https://github.com/AiTool";><code>@AiTool</code></a> paths ride SpringAiVectorStoreContextProvider in keyed mode; keyword provider keeps only the A04 demo doc</li> <li>add opt-in tool-output injection screen; downgrade OWASP A04 to PARTIAL Screen at the shared finishAndEmit seam (rule-based, fail-closed, audited); matrix prose no longer claims tool outputs are stripped by default</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.64] - 2026-08-06</h2> <h3>Added</h3> <ul> <li>bound the default gateway and make checkpoint encryption readable safeDefault replaces a 1M/hour non-limiter with an anonymous bucket sized above the per-principal one; CheckpointStore.encryptsAtRest reports posture instead of only logging it</li> <li>bind tool-loop caps on AgentScope and CrewAI, discover TokenPricing AgentScope maxIters per request, CrewAI max_iter across the sidecar wire; ToolLoopGuard survey now names why SK/SpringAI/Alibaba cannot be capped</li> <li>beforeCompletion interceptor hook fires before the terminal frame Metadata emitted from postProcess was silently dropped at the closed leaf; the hook runs LIFO pre-terminal with Throwable isolation, consume-once arming, error-path invalidation and a reentrancy latch</li> <li>screen tool output for injection by default, marking not deleting Tri-state OFF/ANNOTATE/SANITIZE defaulting to ANNOTATE; bounded 256KB scan; init-param bridge; OWASP A04 now COVERED</li> <li>add LiteLLM proxy quick factory to OpenAiCompatibleClient</li> <li>resolve ACS manifest extends chains with upstream additive-merge semantics Depth-first chain resolution with canonical trust-root confinement, atomic policy bindings, cycle/depth/conflict errors mirroring Microsoft's resolver; URL extends rejected fail-closed and bundle refs rebased per declaring file</li> <li>relay HITL approvals across nodes so any node can answer Publishes an unresolved approval on a cluster broadcaster channel; the owning node completes the parked future, non-owners no-op on UNKNOWN_ID</li> <li>response-cache parity on <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>, CrewAI schema facets, ADK step cap Consumers: AiStreamingSession gate + ResponseCacheConfig install at AiEndpointProcessor; ToolBridgeUtils schema on the CrewAI sidecar wire; LlmAgent.maxSteps opt-in</li> <li>parse and enforce MS Agent Control Specification manifests YamlPolicyParser routes the ACS root key to intervention-point bindings with fail-closed opa-backed rego verdicts; weekly conformance diffs upstream's own contract fixtures on main, retiring the pre-ACS pin</li> <li>carry enum, array and nested facets into Koog and Embabel schemas Both bridges flattened every structural facet to a string; Koog gains Enum/List/Object types, Embabel its enum/properties/itemType slots</li> <li>Tier-3 polish — observability, TCK depth, invariants, security defaults, DX Consumers: percentile+cached-token meters and console tab on both runtimes; behavioural CANCELLATION TCK + capability meta-gate across 12 runtimes; session-map sweeper and MCP teardown; Anthropic cache_control/tool-deltas/model enumeration; JDBC schema versioning; A2A raw-handler admission; webhook dedup; Kotlin agent DSL; markdown/sentence chunkers; 20 e2e tests returned to live coverage</li> <li>tool-call correctness — schemas, arg parsing, execution bound, MCP fail-closed Consumers: McpProtocolHandler tools/call gate; parseJsonArgs at 6 bridges; ToolExecutionHelper seam on all 11 runtimes; schema emitters for Built-in/Anthropic/Cohere/SpringAI/Alibaba; MetricsCapturingSession + admin snapshot</li> <li>error taxonomy, reranker, OpenAI serving, prompt registry, eval runner, cost parity Consumers: classifier at 12 runtime error seams + typed outer retry; over-fetch rerank on the retrieval path; /atmosphere/v1 via AiPipeline (default off); prompt: resolution at 3 processor seams; POST /api/admin/evals/run + CI smoke; Quarkus CostAccountantHolder install + servlet guardrail bridge</li> <li>opt-in tape redaction hook and checkpoint encryption at rest TapeRedactor SPI + PII redactor on both tape write paths; AES-256-GCM CheckpointCipher with legacy-plaintext migration; plaintext startup WARN</li> <li>wire GenerationParams into ADK, Semantic Kernel, Cohere, Koog adapters Contract test now forces every runtime to declare honor-vs-cede; README honoring matrix updated</li> <li>feed cost and tool-call meters at the shared metrics seam TokenPricingHolder gates dollars (no fabricated $0); starters install pricing; admin snapshot exposes costUsdTotal + tool timer</li> <li>record HITL approval decisions in the durable effect journal Crash-resume replays a committed approve/deny without re-prompting; timeouts and cross-principal re-drives re-prompt</li> <li>add SQLite durable-timer and run-journal backends</li> <li>add CheckpointStore producer and console parity</li> <li>add web-search tool and pluggable WebSearchEngine SPI</li> <li>add model context-window catalog for model-aware compaction</li> <li>add evaluator-driven refineUntil supervisor loop</li> </ul> <h3>Fixed</h3> <ul> <li>register managed-service interceptors and bind the prompt method by name Reflective instantiation failures were caught and logged, so the AI endpoint silently never registered under GraalVM</li> <li>declare the concrete store type on the lifecycle <a href="https://github.com/Bean";><code>@Bean</code></a> Spring AOT hinted CheckpointStore.start() while the container invoked it on InMemoryCheckpointStore, failing native startup</li> <li>runtime-init the two OpenSsl private-key-method interfaces too Their constants getstatic the tcnative JNI values ReferenceCountedOpenSslContext now reaches; native build verified locally in the mandrel container</li> <li>runtime-init io.netty.internal.tcnative for native image netty 4.1.136's SslContext reaches SSLPrivateKeyMethod during analysis; its JNI init fails in the builder (sslSignRsaPkcsSha1 UnsatisfiedLinkError)</li> <li>make the PII email regex linear-time on long local-part runs Negative lookbehind + possessive quantifier close CodeQL java/polynomial-redos; matches unchanged, regression test scans 500k chars</li> <li>patch every open Dependabot alert across Maven and npm manifests netty 4.2.16/4.1.136, quarkus 3.36.3, jetty 12.0.36, jackson 3.2.1/3.1.5/2.22.1, spring 6.2.19, lz4/spring-retry/postgresql pins, npm lockfiles + console bundle refresh</li> <li>ai-tools cost badge rides beforeCompletion without clobbering the router routing.* moves off the dead postProcess path and yields to RoutingLlmClient's genuine values; reset copy no longer narrates success before the approval verdict; e2e asserts the rendered chips</li> <li>merge server metadata frames by their wire shape The handler read msg.data but Atmosphere metadata frames carry top-level key/value, so routing chips never rendered from server emissions; bundle resynced to all committed consumers</li> <li>bound cost-ceiling tenant buckets and roll accrual over The map was keyed by a caller-supplied MDC tag with no cap and never decayed; 500 tags made 500 entries and one breach blocked forever</li> <li>size the compaction budget to the endpoint model, not the app default CompactionConfig.resolve(cfg, model) had zero callers, so <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>(model=) got the configured model window - 1M instead of 128k</li> <li>register console assets by pattern so native stops pruning the SPA Both hardcoded hashes had gone stale; the old test compared the registration to itself and passed. Also: meta-gate bite test, DatabaseAgentState doc-truth</li> <li>route keyless demo mode through the pipeline runtime across the AI samples DemoResponseProducer bypasses become DemoAgentRuntime strategies (agui/dentist/orchestration/ai-tools; quarkus documents its bridge-only truth); ai-tools drives real tools and the real approval registry via new AiStreamingSession.unwrap, with HITL/tool-activity specs strengthened to match</li> <li>close open text and tool frames on completion, gate post-terminal emits Pipeline dispatches never emitted TEXT_MESSAGE_END (only the agui sample's hand-rolled TextComplete did) and a dangling TOOL_CALL_START leaked on complete; both AG-UI sessions now close innermost-first and drop frames after RUN_FINISHED/RUN_ERROR</li> <li>route the ai-chat demo fallback through the framework dispatch seam The <a href="https://github.com/Prompt";><code>@Prompt</code></a> short-circuit bypassed DispatchDecorators, so no key meant no dev-inspector/tape/metrics; SB3 starter gains the inspector for parity</li> <li>gate the dev inspector on its own type, not a neighbouring module Top-level placement broke servlet-only apps with NoClassDefFoundError; the coordinator gate silently skipped the recorder</li> <li>install the dev inspector without requiring the coordinator The bean sat inside the coordinator-gated config, so plain AI apps recorded nothing despite the flag</li> <li>relay a worker-observed interrupt across the bounded dispatch hop An interrupt raised inside the agent body now reaches the coordinating thread so refineUntil stops at its turn boundary</li> <li>unify dispatch decorator stacks behind one shared composer Budget+confidence now on <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>; cost+lineage+dev-inspector now on the pipeline path; parity test pins the order</li> <li>HTTP-layer retry with Retry-After in the shared SSE base 429/500/502/503/408 now retried for Anthropic and Cohere; error emitted once after budget; cancel-aware bounded backoff</li> <li>rag-chat queries the real vector store via similaritySearch Endpoint + <a href="https://github.com/AiTool";><code>@AiTool</code></a> paths ride SpringAiVectorStoreContextProvider in keyed mode; keyword provider keeps only the A04 demo doc</li> <li>add opt-in tool-output injection screen; downgrade OWASP A04 to PARTIAL Screen at the shared finishAndEmit seam (rule-based, fail-closed, audited); matrix prose no longer claims tool outputs are stripped by default</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/d8c0e3c4d09a9a95c6ba031352222b2c56aebc7a";><code>d8c0e3c</code></a> release: Atmosphere 4.0.64</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/be8a4b23393fa1a413073579f8d3024d0882c368";><code>be8a4b2</code></a> docs(native): state the annotation-discovery limitation next to the native cl...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/702dabc2ad4b5ca805cfa62f2deb044effbe89ae";><code>702dabc</code></a> ci(native): drop the AI dispatch job until annotation discovery works natively</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/cdda6bb1ba49c737656cb63151ef365f8d8c1f26";><code>cdda6bb</code></a> fix(native): register managed-service interceptors and bind the prompt method...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/25783163b6939659a7efeb91ca81d8f1db398e76";><code>2578316</code></a> ci(native): watch every module the native samples depend on</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/eeaef71237a4eeb1a9f8664ec8957a438af923ab";><code>eeaef71</code></a> fix(checkpoint): declare the concrete store type on the lifecycle <a href="https://github.com/Bean";><code>@Bean</code></a></li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f6e1fe9c08b8c18c989cae3e5e8dccc9c965e599";><code>f6e1fe9</code></a> ci(native): dispatch a real agent turn under Native Image</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/f879aeeb8076d2f82a8a6182b6c10db7fcff1f53";><code>f879aee</code></a> feat(ai): bound the default gateway and make checkpoint encryption readable</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/d10a7a91e512dad8906af945a72878079d0dff92";><code>d10a7a9</code></a> feat(ai): bind tool-loop caps on AgentScope and CrewAI, discover TokenPricing</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/916ea403b6f026bd9f129b8b9d14f2becf1bac89";><code>916ea40</code></a> build(deps): handlebars 4.5.4</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.64";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
