Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.43

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.43.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.43

Added

• per-request runtime extension helpers (f1493c3f9c) — small attach(context, ...) / from(context) helpers (modeled on the existing CacheHint) that let callers stash framework-native composition objects in AgentExecutionContext.metadata(), so a runtime can apply them per-request without growing the unified AgentRuntime SPI with framework-specific knobs. Runtimes covered: SpringAiAdvisors (Spring AI Advisor chain — RAG / memory / guardrails / observability), LangChain4jAiServices (LangChain4j AiServices / TokenStream), KoogStrategy (Koog AIAgentGraphStrategy DSL), AdkRootAgent (ADK BaseAgent / SequentialAgent / ParallelAgent / LoopAgent topology), and ToolLoopPolicies (per-request ToolLoopPolicy honored by BuiltInAgentRuntime's OpenAI-compatible tool loop). The other shipped runtimes (AgentScope, Embabel, SemanticKernel, SpringAiAlibaba) do not yet have a per-request bridge — Embabel got native streaming via StreamingPromptRunnerBuilder.streaming().generateStream() in the same merge but no sidecar. Also added: AgentLifecycleListener.onModelStart / onModelEnd / onModelError hooks with fireXxx fan-out helpers, and AiEventForwardingListener adapter that translates lifecycle hooks to wire-format AiEvent.Progress frames (opt-in via context.withListeners(...)). Each bridge ships with a unit-level *BridgeTest proving the runtime honors the sidecar.

Fixed

• Quarkus extension closes the /api/console/info parity gap — the bundled Atmosphere Console UI gets the same subtitle / endpoint / runtime / mode payload it gets from the Spring Boot starter, instead of falling through to the Vue defaults on a 404. New AtmosphereConsoleInfoServlet (HttpServlet, registered at build time via a second ServletBuildItem mapped to /api/console/info) reuses the same package-prefix mode-detection heuristic as AtmosphereConsoleInfoEndpoint (org.atmosphere.{ai,agent,coordinator}.* → "ai", anything else including ManagedAtmosphereHandler → "broadcast"). Endpoint auto-detection prefers the canonical /atmosphere/ai-chat when registered (samples like quarkus-ai-chat ship multiple @AiEndpoints), then /atmosphere/agent/*, then any other /atmosphere/*. New config keys quarkus.atmosphere.console-subtitle and quarkus.atmosphere.console-endpoint mirror the Spring atmosphere.console-subtitle / atmosphere.console-endpoint properties. JSON is hand-rolled so the runtime POM stays Jackson-free; AgentRuntimeResolver is reached via reflection so the servlet keeps no compile-time link to modules/ai. Empirically verified in chrome-devtools against quarkus-ai-chat — /api/console/info now returns {"subtitle":"Runtime: langchain4j","endpoint":"/atmosphere/ai-chat","runtime":"langchain4j","mode":"ai"}, the Vue Console shows the runtime label in the header subtitle, and the cross-tab isolation matrix continues to pass on the Quarkus leg.
• bundled Atmosphere Console now auto-detects AI vs. broadcast endpoints (c1e8e36c7b) — /api/console/info adds a mode field ("ai" for @AiEndpoint / @Agent / @Coordinator, "broadcast" for @ManagedService chats); AtmosphereConsoleInfoEndpoint#detectMode classifies via the registered handler's package prefix (org.atmosphere.{ai,agent,coordinator}.* → ai, everything else including ManagedAtmosphereHandler → broadcast), so the check stays compile-time independent of modules/ai and modules/agent. The Vue frontend swaps empty-state copy ("Start a conversation" + "AI assistant" → "Start a broadcast" + "every connected client on this endpoint will receive it") and the default subtitle ("Runtime: " → "Multi-client broadcast chat") based on the detected mode. Closes the misleading-UI half of the cross-tab leak follow-up: pre-fix, spring-boot-mcp-server and spring-boot-otel-chat rendered the AI-assistant copy despite being broadcast-shared by design. Empirically verified in chrome-devtools against both broadcast samples and spring-boot-ai-chat. Per-sample atmosphere.console-subtitle overrides still win over the mode-aware default. 5 new contract tests in AtmosphereConsoleInfoEndpointModeTest pin the four classification paths plus the override interaction.
• cross-tab isolation matrix extended from 11 → 15 samples (c1e8e36c7b) — adds quarkus-ai-chat (cross-runtime parity, proves the targeted-dispatch fix from 1fbb0958f0 survives Quarkus's distinct QuarkusJSR356AsyncSupport path), spring-boot-checkpoint-agent (@Coordinator with analyzer/approver fleet + checkpoint store), spring-boot-ms-governance-chat (@AiEndpoint with @AgentScope classification interceptors stacked in front), and spring-boot-channels-chat (omnichannel @AiEndpoint with Telegram/Slack/WhatsApp/Messenger channel-bridge adapters). New fixture entries in e2e/fixtures/sample-server.ts for the checkpoint and ms-governance samples; quarkus-ai-chat reuses the existing fixture. Out-of-scope docstring corrected to remove spring-boot-channels-chat (it's actually an isolated @AiEndpoint, not a broadcast chat) and to explicitly tag spring-boot-a2a-agent as out-of-scope (A2A JSON-RPC has no two-tab Console scenario). All 15 cases pass locally in 3.5m.
• OpenAiCompatibleClient Javadoc placement broke JDK 26 strict mode (28703ea064) — two stacked Javadoc blocks on forwardResponsesApiUsage raised documentation comment is not attached to any declaration under -Xlint:all -Werror on JDK 26 (silent on JDK 21). Merged into a single coherent block; CI: Core (JDK 21/26) green.
• cli/samples.json and cli/atmosphere template map referenced deleted spring-boot-embabel-chat sample (3a9373e875) — cli/test-cli.sh failed with "samples missing README.md: spring-boot-embabel-chat". Entry removed from samples.json + template-map case statement.

Atmosphere 4.0.42

Added

• atmosphere-verifier — plan-and-verify (Meijer "Guardians of the Agents") New module modules/verifier/ + sample samples/spring-boot-guarded-email-agent/ — sealed Workflow AST, ServiceLoader-discovered PlanVerifier chain (Allowlist/WellFormed/Capability/Taint/Automaton/SmtChecker SPI), @​Sink + @​RequiresCapability scanners, PlanAndVerify orchestrator, WorkflowExecutor with partial-env on failure, verify CLI; sample REST + UI exercises the inbox-exfiltration scenario end-to-end (refused before any tool fires) — 74 unit + 4 boot + 6 Playwright tests, all CI green on the feature branch.

Fixed

• fail-closed verifier empty-chain, JSON-escape govern. deny, deflake wasync PlanAndVerify.withDefaults + VerifyCli runChain throw / emit chain-empty violations when ServiceLoader yields no providers (P1: silent fail-open under shading / native-image / fat-jar relocation); governance-deny tool result routes every interpolated field through ToolBridgeUtils.escapeJson via a new buildGovernanceDenyJson helper (P2: backslash/newline/control char break); ChatIntegrationTest.socketStatusTransitions polls for status transition rather than asserting in the same instant the OPEN handler fires (release-pipeline timing flake). 5 new verifier tests + 6 governance-JSON tests.

Changed

• drop org.json:json — Jackson 3 only (CVE hygiene) RoomProtocolCodec + SimpleRestInterceptor migrated to tools.jackson; brace-balanced reader preserves SwaggerSocket header/body chunk semantics; ALLOW_SINGLE_QUOTES kept for wire compatibility; org.json removed from parent + 3 spring-boot samples.
• bump version to 4.0.41
• prepare for next development iteration 4.0.42-SNAPSHOT

Atmosphere 4.0.41

Changed — A2A v1.0.0 alignment (wire-breaking)

• atmosphere-a2a retracked to A2A v1.0.0 (a2aproject/A2A@v1.0.0, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (message/send, tasks/get, …) and a polymorphic Part envelope; both are gone in v1.0.0.
• JSON-RPC method names switched to PascalCase per spec §9.4 — SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, SubscribeToTask, the four {Create,Get,List,Delete}TaskPushNotificationConfig operations, and GetExtendedAgentCard. The pre-1.0 slash names and the old tasks/pushNotification/* path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.
• HTTP+JSON / REST binding added — colon-verb endpoints (POST /tasks/{id}:cancel, POST /tasks/{id}:subscribe, POST /message:send / :stream), pushNotificationConfigs CRUD

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.43] - 2026-05-06

Added

• per-request runtime extension helpers — small attach(context, ...) / from(context) helpers (modeled on the existing CacheHint) that let callers stash framework-native composition objects in AgentExecutionContext.metadata(), so a runtime can apply them per-request without growing the unified AgentRuntime SPI with framework-specific knobs. The matrix closes on 4.0.43: all eight framework runtimes have a sidecar — SpringAiAdvisors (Spring AI Advisor chain — RAG / memory / guardrails / observability), LangChain4jAiServices (LangChain4j AiServices / TokenStream), KoogStrategy (Koog AIAgentGraphStrategy DSL), AdkRootAgent (ADK BaseAgent / SequentialAgent / ParallelAgent / LoopAgent topology), EmbabelPromptRunner (UnaryOperator<PromptRunner> customizer applied AFTER default wiring), AgentScopeAgent (per-request ReActAgent), SemanticKernelInvocation (per-request InvocationContext — unlocks KernelHooks, withMaxAutoInvokeAttempts, custom PromptExecutionSettings), SpringAiAlibabaRunnableConfig (per-request Alibaba RunnableConfig for threadId/checkPointId/streamMode/metadata/store), plus the cross-runtime ToolLoopPolicies honored by BuiltInAgentRuntime's OpenAI-compatible tool loop. Initial five sidecars landed via f1493c3f9c; the remaining four runtimes plus the lifecycle hook fan-out below landed via eec98890fe. Also added: AgentLifecycleListener.onModelStart / onModelEnd / onModelError hooks with fireXxx fan-out helpers wired in all 8 framework runtimes (was Built-in only), and AiEventForwardingListener adapter that translates lifecycle hooks to wire-format AiEvent.Progress frames (opt-in via context.withListeners(...)). Each bridge ships with a unit-level *BridgeTest proving the runtime honors the sidecar.

Fixed

• Quarkus extension closes the /api/console/info parity gap — the bundled Atmosphere Console UI gets the same subtitle / endpoint / runtime / mode payload it gets from the Spring Boot starter, instead of falling through to the Vue defaults on a 404. New AtmosphereConsoleInfoServlet (HttpServlet, registered at build time via a second ServletBuildItem mapped to /api/console/info) reuses the same package-prefix mode-detection heuristic as AtmosphereConsoleInfoEndpoint (org.atmosphere.{ai,agent,coordinator}.* → "ai", anything else including ManagedAtmosphereHandler → "broadcast"). Endpoint auto-detection prefers the canonical /atmosphere/ai-chat when registered (samples like quarkus-ai-chat ship multiple @AiEndpoints), then /atmosphere/agent/*, then any other /atmosphere/*. New config keys quarkus.atmosphere.console-subtitle and quarkus.atmosphere.console-endpoint mirror the Spring atmosphere.console-subtitle / atmosphere.console-endpoint properties. JSON is hand-rolled so the runtime POM stays Jackson-free; AgentRuntimeResolver is reached via reflection so the servlet keeps no compile-time link to modules/ai. Empirically verified in chrome-devtools against quarkus-ai-chat — /api/console/info now returns {"subtitle":"Runtime: langchain4j","endpoint":"/atmosphere/ai-chat","runtime":"langchain4j","mode":"ai"}, the Vue Console shows the runtime label in the header subtitle, and the cross-tab isolation matrix continues to pass on the Quarkus leg.
• bundled Atmosphere Console now auto-detects AI vs. broadcast endpoints (c1e8e36c7b) — /api/console/info adds a mode field ("ai" for @AiEndpoint / @Agent / @Coordinator, "broadcast" for @ManagedService chats); AtmosphereConsoleInfoEndpoint#detectMode classifies via the registered handler's package prefix (org.atmosphere.{ai,agent,coordinator}.* → ai, everything else including ManagedAtmosphereHandler → broadcast), so the check stays compile-time independent of modules/ai and modules/agent. The Vue frontend swaps empty-state copy ("Start a conversation" + "AI assistant" → "Start a broadcast" + "every connected client on this endpoint will receive it") and the default subtitle ("Runtime: " → "Multi-client broadcast chat") based on the detected mode. Closes the misleading-UI half of the cross-tab leak follow-up: pre-fix, spring-boot-mcp-server and spring-boot-otel-chat rendered the AI-assistant copy despite being broadcast-shared by design. Empirically verified in chrome-devtools against both broadcast samples and spring-boot-ai-chat. Per-sample atmosphere.console-subtitle overrides still win over the mode-aware default. 5 new contract tests in AtmosphereConsoleInfoEndpointModeTest pin the four classification paths plus the override interaction.
• cross-tab isolation matrix extended from 11 → 15 samples (c1e8e36c7b) — adds quarkus-ai-chat (cross-runtime parity, proves the targeted-dispatch fix from 1fbb0958f0 survives Quarkus's distinct QuarkusJSR356AsyncSupport path), spring-boot-checkpoint-agent (@Coordinator with analyzer/approver fleet + checkpoint store), spring-boot-ms-governance-chat (@AiEndpoint with @AgentScope classification interceptors stacked in front), and spring-boot-channels-chat (omnichannel @AiEndpoint with Telegram/Slack/WhatsApp/Messenger channel-bridge adapters). New fixture entries in e2e/fixtures/sample-server.ts for the checkpoint and ms-governance samples; quarkus-ai-chat reuses the existing fixture. Out-of-scope docstring corrected to remove spring-boot-channels-chat (it's actually an isolated @AiEndpoint, not a broadcast chat) and to explicitly tag spring-boot-a2a-agent as out-of-scope (A2A JSON-RPC has no two-tab Console scenario). All 15 cases pass locally in 3.5m.
• OpenAiCompatibleClient Javadoc placement broke JDK 26 strict mode (28703ea064) — two stacked Javadoc blocks on forwardResponsesApiUsage raised documentation comment is not attached to any declaration under -Xlint:all -Werror on JDK 26 (silent on JDK 21). Merged into a single coherent block; CI: Core (JDK 21/26) green.
• cli/samples.json and cli/atmosphere template map referenced deleted spring-boot-embabel-chat sample (3a9373e875) — cli/test-cli.sh failed with "samples missing README.md: spring-boot-embabel-chat". Entry removed from samples.json + template-map case statement.

[4.0.42] - 2026-05-01

Added

• atmosphere-verifier — plan-and-verify (Meijer "Guardians of the Agents") New module modules/verifier/ + sample samples/spring-boot-guarded-email-agent/ — sealed Workflow AST, ServiceLoader-discovered PlanVerifier chain (Allowlist/WellFormed/Capability/Taint/Automaton/SmtChecker SPI), @​Sink + @​RequiresCapability scanners, PlanAndVerify orchestrator, WorkflowExecutor with partial-env on failure, verify CLI; sample REST + UI exercises the inbox-exfiltration scenario end-to-end (refused before any tool fires) — 74 unit + 4 boot + 6 Playwright tests, all CI green on the feature branch.

Fixed

• fail-closed verifier empty-chain, JSON-escape govern. deny, deflake wasync PlanAndVerify.withDefaults + VerifyCli runChain throw / emit chain-empty violations when ServiceLoader yields no providers (P1: silent fail-open under shading / native-image / fat-jar relocation); governance-deny tool result routes every interpolated field through ToolBridgeUtils.escapeJson via a new buildGovernanceDenyJson helper (P2: backslash/newline/control char break); ChatIntegrationTest.socketStatusTransitions polls for status transition rather than asserting in the same instant the OPEN handler fires (release-pipeline timing flake). 5 new verifier tests + 6 governance-JSON tests.

Changed

• drop org.json:json — Jackson 3 only (CVE hygiene) RoomProtocolCodec + SimpleRestInterceptor migrated to tools.jackson; brace-balanced reader preserves SwaggerSocket header/body chunk semantics; ALLOW_SINGLE_QUOTES kept for wire compatibility; org.json removed from parent + 3 spring-boot samples.
• bump version to 4.0.41
• prepare for next development iteration 4.0.42-SNAPSHOT

[4.0.41] - 2026-04-29

Changed — A2A v1.0.0 alignment (wire-breaking)

• atmosphere-a2a retracked to A2A v1.0.0 (a2aproject/A2A@v1.0.0, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (message/send, tasks/get, …) and a polymorphic Part envelope; both are gone in v1.0.0.
• JSON-RPC method names switched to PascalCase per spec §9.4 — SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, SubscribeToTask, the four {Create,Get,List,Delete}TaskPushNotificationConfig operations, and GetExtendedAgentCard. The pre-1.0 slash names and the old tasks/pushNotification/* path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.
• HTTP+JSON / REST binding added — colon-verb endpoints (POST /tasks/{id}:cancel, POST /tasks/{id}:subscribe, POST /message:send / :stream), pushNotificationConfigs CRUD

... (truncated)

Commits

• 1c60a3a release: Atmosphere 4.0.43
• 4be7c7f feat(quarkus): port /api/console/info servlet for bundled-Console parity
• 24cc693 chore(scripts): pre-push-validate.sh excludes @​Tag('flaky') tests
• 89965ee fix(console): broadcast empty-state copy must not contain 'connected'
• c9625e8 chore(skills): align SKILL.md and PromptLoader with agentskills.io spec
• 8c0dd0a docs(changelog): record cross-tab gap closures (mode auto-detect + matrix 15)
• c1e8e36 feat(console): auto-detect ai/broadcast mode + extend cross-tab matrix to 15 ...
• 48e6285 test(ai): pin cross-tab isolation across 11 @AiEndpoint/@​Agent samples
• 1fbb095 fix(ai): isolate @​AiEndpoint prompts to the originating client (cross-tab leak)
• a5c7ec9 fix(audit): close 6 deferred surfaces from production tree
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3110.