dependabot[bot] opened a new pull request, #3569: URL: https://github.com/apache/cxf/pull/3569
Bumps [org.atmosphere:atmosphere-runtime](https://github.com/Atmosphere/atmosphere) from 3.1.0 to 4.0.72. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/releases";>org.atmosphere:atmosphere-runtime's releases</a>.</em></p> <blockquote> <h2>Atmosphere 4.0.72</h2> <h3>Added</h3> <ul> <li>add a bounded, strictly decoded request body read to IOUtils</li> <li>add atmosphere-ai-decision-typesafe, a DecisionModel over the TypeSafe System One API</li> <li>route each request to a handler, the LLM or a person before dispatch</li> <li>signal injected governance guidance and assert CARRY on it in the e2e</li> <li>add the DecisionModel SPI and route the LLM injection tier through it</li> <li>score the decision field's value distribution, not the fluency of every token</li> <li>route completed turns on confidence (ACT/CONFIRM/ESCALATE, unknown fails closed)</li> <li>add carnet issue claims, the bilan completion score and remote-first vault sync</li> </ul> <h3>Fixed</h3> <ul> <li>RoomProtocolInterceptor reads at most maxBytes+1 of a POST body looking for a room command</li> <li>route slash commands and <a href="https://github.com/Message";><code>@Message</code></a> inputs from SSE and long-polling POSTs</li> <li>HeartbeatInterceptor peeks at most padding+1 bytes instead of reading every POST whole</li> <li>render raw HTML in chat text literally so <!-- raw HTML omitted --> and List<!-- raw HTML omitted --> are not dropped</li> <li>bound prompt POST bodies; answer 413 when oversize and 400 when malformed</li> <li>deliver a whole AI reply to the next long-poll instead of its first frame</li> <li>complete a long-poll resumed before its suspension took effect</li> <li>pin checkpoint-temporal's Jackson 2 to the root jackson2.version (2.22.3)</li> <li>dispatch an agent handoff as a prompt of the same connection</li> <li>close the Sept-Oct Jackson + npm advisory batch, one property for the Boot Jackson line</li> <li>run a prompt only on a connection of its sender's identity</li> <li>keep a run reattach replay off the cluster filters</li> <li>keep cache replays off the cluster and send room messages to other nodes again</li> <li>wait for the next poll when a prompt's connection was resumed or recycled</li> <li>give a DSL agent the protocol handshake recorder</li> <li>run a prompt only on a connection its own endpoint suspended</li> <li>keep a broadcast to chosen resources off the cluster filters</li> <li>subscribe the classroom Expo client with the Atmosphere protocol on</li> <li>dispatch a prompt to its connection directly, never through the path's filters</li> <li>keep half the repoll waiter slots from handshake-only ids, forget closed ids</li> <li>run <a href="https://github.com/Prompt";><code>@Prompt</code></a> only for a prompt dispatched to the receiving connection</li> <li>wait on a handshake-assigned tracking id only within the repoll wait</li> <li>name a session in the WebSocket refusal frame so subscribeStreaming reports it</li> <li>never send a deferred stream end to every subscriber after a disconnect</li> <li>read a deferred stream end's recipient while its terminal frame is filtered</li> <li>send a filter's deferred stream-end frame to the sender, never to the whole path</li> <li>answer a WebSocket prompt whose connection is gone with an error frame over its socket</li> <li>keep a client-chosen tracking id across reconnects</li> <li>new client tracking id per HTTP subscription, resend under the current one</li> <li>answer a malformed prompt tracking id 400, let a prompt wait on a long-polling handshake id</li> <li>open protocol long-polling after its handshake; hooks keep state on send errors</li> <li>name HTTP subscriptions without the protocol; Console frees a refused prompt</li> <li>bound waiting prompts across every <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>, refuse them at once on destroy</li> <li>never fan a prompt out to every subscriber of an <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a> path</li> <li>resend an HTTP push the server answers 503, report one it refuses</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Atmosphere/atmosphere/blob/main/CHANGELOG.md";>org.atmosphere:atmosphere-runtime's changelog</a>.</em></p> <blockquote> <h2>[4.0.72] - 2026-10-05</h2> <h3>Added</h3> <ul> <li>add a bounded, strictly decoded request body read to IOUtils</li> <li>add atmosphere-ai-decision-typesafe, a DecisionModel over the TypeSafe System One API</li> <li>route each request to a handler, the LLM or a person before dispatch</li> <li>signal injected governance guidance and assert CARRY on it in the e2e</li> <li>add the DecisionModel SPI and route the LLM injection tier through it</li> <li>score the decision field's value distribution, not the fluency of every token</li> <li>route completed turns on confidence (ACT/CONFIRM/ESCALATE, unknown fails closed)</li> <li>add carnet issue claims, the bilan completion score and remote-first vault sync</li> </ul> <h3>Fixed</h3> <ul> <li>RoomProtocolInterceptor reads at most maxBytes+1 of a POST body looking for a room command</li> <li>route slash commands and <a href="https://github.com/Message";><code>@Message</code></a> inputs from SSE and long-polling POSTs</li> <li>HeartbeatInterceptor peeks at most padding+1 bytes instead of reading every POST whole</li> <li>render raw HTML in chat text literally so <!-- raw HTML omitted --> and List<!-- raw HTML omitted --> are not dropped</li> <li>bound prompt POST bodies; answer 413 when oversize and 400 when malformed</li> <li>deliver a whole AI reply to the next long-poll instead of its first frame</li> <li>complete a long-poll resumed before its suspension took effect</li> <li>pin checkpoint-temporal's Jackson 2 to the root jackson2.version (2.22.3)</li> <li>dispatch an agent handoff as a prompt of the same connection</li> <li>close the Sept-Oct Jackson + npm advisory batch, one property for the Boot Jackson line</li> <li>run a prompt only on a connection of its sender's identity</li> <li>keep a run reattach replay off the cluster filters</li> <li>keep cache replays off the cluster and send room messages to other nodes again</li> <li>wait for the next poll when a prompt's connection was resumed or recycled</li> <li>give a DSL agent the protocol handshake recorder</li> <li>run a prompt only on a connection its own endpoint suspended</li> <li>keep a broadcast to chosen resources off the cluster filters</li> <li>subscribe the classroom Expo client with the Atmosphere protocol on</li> <li>dispatch a prompt to its connection directly, never through the path's filters</li> <li>keep half the repoll waiter slots from handshake-only ids, forget closed ids</li> <li>run <a href="https://github.com/Prompt";><code>@Prompt</code></a> only for a prompt dispatched to the receiving connection</li> <li>wait on a handshake-assigned tracking id only within the repoll wait</li> <li>name a session in the WebSocket refusal frame so subscribeStreaming reports it</li> <li>never send a deferred stream end to every subscriber after a disconnect</li> <li>read a deferred stream end's recipient while its terminal frame is filtered</li> <li>send a filter's deferred stream-end frame to the sender, never to the whole path</li> <li>answer a WebSocket prompt whose connection is gone with an error frame over its socket</li> <li>keep a client-chosen tracking id across reconnects</li> <li>new client tracking id per HTTP subscription, resend under the current one</li> <li>answer a malformed prompt tracking id 400, let a prompt wait on a long-polling handshake id</li> <li>open protocol long-polling after its handshake; hooks keep state on send errors</li> <li>name HTTP subscriptions without the protocol; Console frees a refused prompt</li> <li>bound waiting prompts across every <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a>, refuse them at once on destroy</li> <li>never fan a prompt out to every subscriber of an <a href="https://github.com/AiEndpoint";><code>@AiEndpoint</code></a> path</li> <li>resend an HTTP push the server answers 503, report one it refuses</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Atmosphere/atmosphere/commit/a61d19248322ba2561b6735cee3dc5661c142a68";><code>a61d192</code></a> release: Atmosphere 4.0.72</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/c01c50ccd426328979f6ae6f77e79aa4c1875b77";><code>c01c50c</code></a> test(ai): ignore JDK class-initialization pins in the TypeSafe probe pinning ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/0996c041cce98698f06fc68ea95e0004ca5bb74a";><code>0996c04</code></a> fix(cpr): RoomProtocolInterceptor reads at most maxBytes+1 of a POST body loo...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/2a2da96809b7d0dad50d92133ec29c5222851afe";><code>2a2da96</code></a> fix(agent): route slash commands and <a href="https://github.com/Message";><code>@Message</code></a> inputs from SSE and long-pollin...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/0b1d4465dbcda3225909a7c607abdbd2bfce20fa";><code>0b1d446</code></a> fix(cpr): HeartbeatInterceptor peeks at most padding+1 bytes instead of readi...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/518e00d6b267375e848b746e95bf70f28400e33c";><code>518e00d</code></a> fix(console): render raw HTML in chat text literally so <base64> and List<Str...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/157c9722e130f4ff5e2440d2a4dc743f699a86b8";><code>157c972</code></a> fix(ai): bound prompt POST bodies; answer 413 when oversize and 400 when malf...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/3d7a712799552ba8baef3819159b77aba2dd6198";><code>3d7a712</code></a> feat(cpr): add a bounded, strictly decoded request body read to IOUtils</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/71b3f6f38277db2c890cf571c83c16e5fb045324";><code>71b3f6f</code></a> fix(ai): deliver a whole AI reply to the next long-poll instead of its first ...</li> <li><a href="https://github.com/Atmosphere/atmosphere/commit/0951502d5b1735c3bc1d970e40100e854989da9c";><code>0951502</code></a> fix(cpr): complete a long-poll resumed before its suspension took effect</li> <li>Additional commits viewable in <a href="https://github.com/Atmosphere/atmosphere/compare/atmosphere-project-3.1.0...atmosphere-4.0.72";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
