Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.65

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.65.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.65

Added

• index annotated classes at compile time via an annotation processor Auto-discovered by javac from atmosphere-runtime, so discovery works in any build without Spring AOT or Quarkus augmentation
• ship GraalVM metadata inside atmosphere-runtime Generated from the SPI and read automatically, so a deployment with no Spring starter or Quarkus extension needs no configuration
• let each module declare its own native-image metadata via SPI Replaces one list transcribed into three integration modules; atmosphere-ai/-mcp/-agent load classes by name and had no way to contribute
• resolve Atmosphere annotations at build time for native image Classpath scanning finds nothing in a native image, so the scan now runs during AOT and the runtime reads the recorded list

Fixed

• register broadcaster caches so annotated endpoints can be created Loaded by name, so a native image could not build any Broadcaster; the failure was logged and swallowed, silently unregistering every @​ManagedService
• stop the console-bundle gate firing on the release version bump Masks the package's own version from the fingerprint; it cannot change the emitted bundle but blocked the first commit after every release

Changed

• describe what the native lanes assert, and what they do not The previous text documented a limitation that these fixes removed; it now states the verified path and enumerates the unverified ones
• drive a real connection and assert the annotated @​Ready ran Handler registration is silent, so behaviour is the only honest signal; validated against a JVM run first
• assert the annotated handler is installed, not just that a port answers Both native smoke tests curled a liveness URL that responds whether or not Atmosphere registered anything
• prepare next development version 5.0.40
• bump version to 4.0.64
• prepare for next development iteration 4.0.65-SNAPSHOT

Atmosphere 4.0.64

Added

• bound the default gateway and make checkpoint encryption readable safeDefault replaces a 1M/hour non-limiter with an anonymous bucket sized above the per-principal one; CheckpointStore.encryptsAtRest reports posture instead of only logging it
• bind tool-loop caps on AgentScope and CrewAI, discover TokenPricing AgentScope maxIters per request, CrewAI max_iter across the sidecar wire; ToolLoopGuard survey now names why SK/SpringAI/Alibaba cannot be capped
• beforeCompletion interceptor hook fires before the terminal frame Metadata emitted from postProcess was silently dropped at the closed leaf; the hook runs LIFO pre-terminal with Throwable isolation, consume-once arming, error-path invalidation and a reentrancy latch
• screen tool output for injection by default, marking not deleting Tri-state OFF/ANNOTATE/SANITIZE defaulting to ANNOTATE; bounded 256KB scan; init-param bridge; OWASP A04 now COVERED
• add LiteLLM proxy quick factory to OpenAiCompatibleClient
• resolve ACS manifest extends chains with upstream additive-merge semantics Depth-first chain resolution with canonical trust-root confinement, atomic policy bindings, cycle/depth/conflict errors mirroring Microsoft's resolver; URL extends rejected fail-closed and bundle refs rebased per declaring file
• relay HITL approvals across nodes so any node can answer Publishes an unresolved approval on a cluster broadcaster channel; the owning node completes the parked future, non-owners no-op on UNKNOWN_ID
• response-cache parity on @​AiEndpoint, CrewAI schema facets, ADK step cap Consumers: AiStreamingSession gate + ResponseCacheConfig install at AiEndpointProcessor; ToolBridgeUtils schema on the CrewAI sidecar wire; LlmAgent.maxSteps opt-in
• parse and enforce MS Agent Control Specification manifests YamlPolicyParser routes the ACS root key to intervention-point bindings with fail-closed opa-backed rego verdicts; weekly conformance diffs upstream's own contract fixtures on main, retiring the pre-ACS pin
• carry enum, array and nested facets into Koog and Embabel schemas Both bridges flattened every structural facet to a string; Koog gains Enum/List/Object types, Embabel its enum/properties/itemType slots
• Tier-3 polish — observability, TCK depth, invariants, security defaults, DX Consumers: percentile+cached-token meters and console tab on both runtimes; behavioural CANCELLATION TCK + capability meta-gate across 12 runtimes; session-map sweeper and MCP teardown; Anthropic cache_control/tool-deltas/model enumeration; JDBC schema versioning; A2A raw-handler admission; webhook dedup; Kotlin agent DSL; markdown/sentence chunkers; 20 e2e tests returned to live coverage
• tool-call correctness — schemas, arg parsing, execution bound, MCP fail-closed Consumers: McpProtocolHandler tools/call gate; parseJsonArgs at 6 bridges; ToolExecutionHelper seam on all 11 runtimes; schema emitters for Built-in/Anthropic/Cohere/SpringAI/Alibaba; MetricsCapturingSession + admin snapshot
• error taxonomy, reranker, OpenAI serving, prompt registry, eval runner, cost parity Consumers: classifier at 12 runtime error seams + typed outer retry; over-fetch rerank on the retrieval path; /atmosphere/v1 via AiPipeline (default off); prompt: resolution at 3 processor seams; POST /api/admin/evals/run + CI smoke; Quarkus CostAccountantHolder install + servlet guardrail bridge
• opt-in tape redaction hook and checkpoint encryption at rest TapeRedactor SPI + PII redactor on both tape write paths; AES-256-GCM CheckpointCipher with legacy-plaintext migration; plaintext startup WARN
• wire GenerationParams into ADK, Semantic Kernel, Cohere, Koog adapters Contract test now forces every runtime to declare honor-vs-cede; README honoring matrix updated
• feed cost and tool-call meters at the shared metrics seam TokenPricingHolder gates dollars (no fabricated $0); starters install pricing; admin snapshot exposes costUsdTotal + tool timer
• record HITL approval decisions in the durable effect journal Crash-resume replays a committed approve/deny without re-prompting; timeouts and cross-principal re-drives re-prompt
• add SQLite durable-timer and run-journal backends
• add CheckpointStore producer and console parity
• add web-search tool and pluggable WebSearchEngine SPI
• add model context-window catalog for model-aware compaction
• add evaluator-driven refineUntil supervisor loop

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.65] - 2026-08-07

Added

• index annotated classes at compile time via an annotation processor Auto-discovered by javac from atmosphere-runtime, so discovery works in any build without Spring AOT or Quarkus augmentation
• ship GraalVM metadata inside atmosphere-runtime Generated from the SPI and read automatically, so a deployment with no Spring starter or Quarkus extension needs no configuration
• let each module declare its own native-image metadata via SPI Replaces one list transcribed into three integration modules; atmosphere-ai/-mcp/-agent load classes by name and had no way to contribute
• resolve Atmosphere annotations at build time for native image Classpath scanning finds nothing in a native image, so the scan now runs during AOT and the runtime reads the recorded list

Fixed

• register broadcaster caches so annotated endpoints can be created Loaded by name, so a native image could not build any Broadcaster; the failure was logged and swallowed, silently unregistering every @​ManagedService
• stop the console-bundle gate firing on the release version bump Masks the package's own version from the fingerprint; it cannot change the emitted bundle but blocked the first commit after every release

Changed

• describe what the native lanes assert, and what they do not The previous text documented a limitation that these fixes removed; it now states the verified path and enumerates the unverified ones
• drive a real connection and assert the annotated @​Ready ran Handler registration is silent, so behaviour is the only honest signal; validated against a JVM run first
• assert the annotated handler is installed, not just that a port answers Both native smoke tests curled a liveness URL that responds whether or not Atmosphere registered anything
• prepare next development version 5.0.40
• bump version to 4.0.64
• prepare for next development iteration 4.0.65-SNAPSHOT

[4.0.64] - 2026-08-06

Added

• bound the default gateway and make checkpoint encryption readable safeDefault replaces a 1M/hour non-limiter with an anonymous bucket sized above the per-principal one; CheckpointStore.encryptsAtRest reports posture instead of only logging it
• bind tool-loop caps on AgentScope and CrewAI, discover TokenPricing AgentScope maxIters per request, CrewAI max_iter across the sidecar wire; ToolLoopGuard survey now names why SK/SpringAI/Alibaba cannot be capped
• beforeCompletion interceptor hook fires before the terminal frame Metadata emitted from postProcess was silently dropped at the closed leaf; the hook runs LIFO pre-terminal with Throwable isolation, consume-once arming, error-path invalidation and a reentrancy latch
• screen tool output for injection by default, marking not deleting Tri-state OFF/ANNOTATE/SANITIZE defaulting to ANNOTATE; bounded 256KB scan; init-param bridge; OWASP A04 now COVERED
• add LiteLLM proxy quick factory to OpenAiCompatibleClient
• resolve ACS manifest extends chains with upstream additive-merge semantics Depth-first chain resolution with canonical trust-root confinement, atomic policy bindings, cycle/depth/conflict errors mirroring Microsoft's resolver; URL extends rejected fail-closed and bundle refs rebased per declaring file
• relay HITL approvals across nodes so any node can answer Publishes an unresolved approval on a cluster broadcaster channel; the owning node completes the parked future, non-owners no-op on UNKNOWN_ID
• response-cache parity on @​AiEndpoint, CrewAI schema facets, ADK step cap Consumers: AiStreamingSession gate + ResponseCacheConfig install at AiEndpointProcessor; ToolBridgeUtils schema on the CrewAI sidecar wire; LlmAgent.maxSteps opt-in
• parse and enforce MS Agent Control Specification manifests YamlPolicyParser routes the ACS root key to intervention-point bindings with fail-closed opa-backed rego verdicts; weekly conformance diffs upstream's own contract fixtures on main, retiring the pre-ACS pin
• carry enum, array and nested facets into Koog and Embabel schemas Both bridges flattened every structural facet to a string; Koog gains Enum/List/Object types, Embabel its enum/properties/itemType slots
• Tier-3 polish — observability, TCK depth, invariants, security defaults, DX Consumers: percentile+cached-token meters and console tab on both runtimes; behavioural CANCELLATION TCK + capability meta-gate across 12 runtimes; session-map sweeper and MCP teardown; Anthropic cache_control/tool-deltas/model enumeration; JDBC schema versioning; A2A raw-handler admission; webhook dedup; Kotlin agent DSL; markdown/sentence chunkers; 20 e2e tests returned to live coverage
• tool-call correctness — schemas, arg parsing, execution bound, MCP fail-closed Consumers: McpProtocolHandler tools/call gate; parseJsonArgs at 6 bridges; ToolExecutionHelper seam on all 11 runtimes; schema emitters for Built-in/Anthropic/Cohere/SpringAI/Alibaba; MetricsCapturingSession + admin snapshot
• error taxonomy, reranker, OpenAI serving, prompt registry, eval runner, cost parity Consumers: classifier at 12 runtime error seams + typed outer retry; over-fetch rerank on the retrieval path; /atmosphere/v1 via AiPipeline (default off); prompt: resolution at 3 processor seams; POST /api/admin/evals/run + CI smoke; Quarkus CostAccountantHolder install + servlet guardrail bridge
• opt-in tape redaction hook and checkpoint encryption at rest TapeRedactor SPI + PII redactor on both tape write paths; AES-256-GCM CheckpointCipher with legacy-plaintext migration; plaintext startup WARN
• wire GenerationParams into ADK, Semantic Kernel, Cohere, Koog adapters Contract test now forces every runtime to declare honor-vs-cede; README honoring matrix updated
• feed cost and tool-call meters at the shared metrics seam TokenPricingHolder gates dollars (no fabricated $0); starters install pricing; admin snapshot exposes costUsdTotal + tool timer
• record HITL approval decisions in the durable effect journal Crash-resume replays a committed approve/deny without re-prompting; timeouts and cross-principal re-drives re-prompt
• add SQLite durable-timer and run-journal backends
• add CheckpointStore producer and console parity
• add web-search tool and pluggable WebSearchEngine SPI
• add model context-window catalog for model-aware compaction
• add evaluator-driven refineUntil supervisor loop

... (truncated)

Commits

• 18eea8c release: Atmosphere 4.0.65
• 6b68358 docs(native): describe what the native lanes assert, and what they do not
• 76018db feat(native): index annotated classes at compile time via an annotation proce...
• 05f9005 feat(native): ship GraalVM metadata inside atmosphere-runtime
• 44cc650 feat(native): let each module declare its own native-image metadata via SPI
• 48e6663 fix(native): register broadcaster caches so annotated endpoints can be created
• da6228c feat(spring-boot): resolve Atmosphere annotations at build time for native image
• 10db447 ci(native): drive a real connection and assert the annotated @​Ready ran
• 0a3bd3d ci(native): assert the annotated handler is installed, not just that a port a...
• 31c2ce8 fix(scripts): stop the console-bundle gate firing on the release version bump
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3377.