Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.69

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.69.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.69

Added

• add the classic-rooms template and gate the two template maps in lockstep
• add spring-boot-low-level-handlers, the layer under @​ManagedService
• add spring-boot-team-rooms, a classic-annotation multi-room chat

Fixed

• stop the personal assistant overwriting an upstream-resolved ai.userId
• skip cross-session recall when the resolved runtime is the demo fallback
• reattach two Javadoc comments orphaned by the owner-reclaim insert
• stop the CHANGELOG generator crediting reverted commits
• keep the run owner across a recycled request so fact extraction still runs
• make the classic-annotation samples work at runtime, not just in tests
• resolve templated endpoint paths on WebTransport, not just requestURI
• fail a fixture boot as soon as the process dies, not after the timeout
• fail the coverage map on entries for samples that no longer exist
• resolve e2e coverage entries to real specs, projects and CI legs
• resolve @​PathParam on @​RoomService and add it to the servlet scan

Changed

• require evidence in the four matrix rows that certified without it
• log the offline-maven CI regression and the CDI annotation false positive
• register the two classic-annotation samples across every gate and doc
• log the fabricated container-ledger blog claim and the relayed RAG negative grep
• forbid host-network toggles, record the NetInfo assertion as PARTIAL

Atmosphere 4.0.68

Added

• scope workspace RUNTIME.md settings to their agent via AiConfig.configureForAgent First workspace seeds the process default, later ones stay agent-scoped; the built-in runtime serves scoped agents from their own client (registre#39)
• ship the voice-mode endpoint driving the speech-to-speech loop VoiceEndpointHandler resolves RealtimeVoiceProvider per connect; mounted behind atmosphere.ai.voice.enabled on Spring and Quarkus (registre#25)
• per-user MCP credentials via McpTrustProvider, facade on the selection path connectForUser sends the resolved Bearer credential and fails closed unauthorized; ToolSelection composes ToolExtensibilityPoint per request (registre#24)
• arm durable approval-expiry timers for journaled approvals DurableApprovalExpiry is DurableTimerService's production consumer, wired by both durable-run installers; markFailed never demotes COMMITTED (registre#26)
• implement expose, snapshot and hibernate on both shipped backends Docker uses pause/commit/port-publishing recreation, in-process copies its workdir (registre#5); README stops naming non-existent backend modules
• execute saved workflow manifests through AgentFleet with run/approval endpoints WorkflowRunner dispatches agent/condition/fan-out/join/approval/output nodes (registre#1); Quarkus gains the workflow surface and live coordinator wiring
• read WEBTRANSPORT_PROTOCOL knob to install custom WebTransport protocols Custom protocol owns message/lifecycle callbacks (registre#28); tool/voice SPI docs made truthful (registre#24, registre#25); exec-maven-plugin version pinned
• expose fleet health, make VerifyCli launchable, honest fan-out contract GET /coordinators/{name}/health reads AgentFleet.health(); exec mainClass pinned for the verifier CLI; FanOutStreamingSession documented app-constructed (registre#43)
• surface priced call cost as business.session.cost response metadata CostAccountant gains priceUsd; the accounting session emits the real figure and BusinessMetadata docs now state who writes what (registre#42)
• emit MESSAGES_SNAPSHOT at run start and document the produced event set 23 of 27 AG-UI types now have producers; the chunked/raw alternates are documented parse-only by design (registre#29)
• stream reasoning and citations as first-class AiEvents Anthropic thinking blocks and Cohere citations now produce ReasoningDelta/ReasoningComplete/Citation, mapped to AG-UI's REASONING_* and CUSTOM (registre#16)
• wire the agent-state control plane to both admin transports StateController serves the live per-agent AgentState registry with guarded mutations; the vacuous [200,404] e2e now discriminates (registre#21)
• register live protocol bridges and list them on the admin plane Processors install Mcp/A2a/AgUi/InMemory bridges via ProtocolBridgeRegistry.install; GET /api/admin/protocols reports runtime truth and the false SPI comments are corrected (registre#22)
• render the coordination causal tree from the journaled lineage GET /journal/{id}/tree reads CoordinationProjection on both admin transports, giving the envelope lineage its production consumer (registre#23)
• route shared-channel free text by address, default agent, or sole binding @​name/name: addressing beats registration order; atmosphere.channels.default-agent catches the rest; ambiguity now warns (registre#34)

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.69] - 2026-08-30

Added

• add the classic-rooms template and gate the two template maps in lockstep
• add spring-boot-low-level-handlers, the layer under @​ManagedService
• add spring-boot-team-rooms, a classic-annotation multi-room chat

Fixed

• stop the personal assistant overwriting an upstream-resolved ai.userId
• skip cross-session recall when the resolved runtime is the demo fallback
• reattach two Javadoc comments orphaned by the owner-reclaim insert
• stop the CHANGELOG generator crediting reverted commits
• keep the run owner across a recycled request so fact extraction still runs
• make the classic-annotation samples work at runtime, not just in tests
• resolve templated endpoint paths on WebTransport, not just requestURI
• fail a fixture boot as soon as the process dies, not after the timeout
• fail the coverage map on entries for samples that no longer exist
• resolve e2e coverage entries to real specs, projects and CI legs
• resolve @​PathParam on @​RoomService and add it to the servlet scan

Changed

• require evidence in the four matrix rows that certified without it
• log the offline-maven CI regression and the CDI annotation false positive
• register the two classic-annotation samples across every gate and doc
• log the fabricated container-ledger blog claim and the relayed RAG negative grep
• forbid host-network toggles, record the NetInfo assertion as PARTIAL

[4.0.68] - 2026-08-23

Added

• scope workspace RUNTIME.md settings to their agent via AiConfig.configureForAgent First workspace seeds the process default, later ones stay agent-scoped; the built-in runtime serves scoped agents from their own client (registre#39)
• ship the voice-mode endpoint driving the speech-to-speech loop VoiceEndpointHandler resolves RealtimeVoiceProvider per connect; mounted behind atmosphere.ai.voice.enabled on Spring and Quarkus (registre#25)
• per-user MCP credentials via McpTrustProvider, facade on the selection path connectForUser sends the resolved Bearer credential and fails closed unauthorized; ToolSelection composes ToolExtensibilityPoint per request (registre#24)
• arm durable approval-expiry timers for journaled approvals DurableApprovalExpiry is DurableTimerService's production consumer, wired by both durable-run installers; markFailed never demotes COMMITTED (registre#26)
• implement expose, snapshot and hibernate on both shipped backends Docker uses pause/commit/port-publishing recreation, in-process copies its workdir (registre#5); README stops naming non-existent backend modules
• execute saved workflow manifests through AgentFleet with run/approval endpoints WorkflowRunner dispatches agent/condition/fan-out/join/approval/output nodes (registre#1); Quarkus gains the workflow surface and live coordinator wiring
• read WEBTRANSPORT_PROTOCOL knob to install custom WebTransport protocols Custom protocol owns message/lifecycle callbacks (registre#28); tool/voice SPI docs made truthful (registre#24, registre#25); exec-maven-plugin version pinned
• expose fleet health, make VerifyCli launchable, honest fan-out contract GET /coordinators/{name}/health reads AgentFleet.health(); exec mainClass pinned for the verifier CLI; FanOutStreamingSession documented app-constructed (registre#43)
• surface priced call cost as business.session.cost response metadata CostAccountant gains priceUsd; the accounting session emits the real figure and BusinessMetadata docs now state who writes what (registre#42)
• emit MESSAGES_SNAPSHOT at run start and document the produced event set 23 of 27 AG-UI types now have producers; the chunked/raw alternates are documented parse-only by design (registre#29)
• stream reasoning and citations as first-class AiEvents Anthropic thinking blocks and Cohere citations now produce ReasoningDelta/ReasoningComplete/Citation, mapped to AG-UI's REASONING_* and CUSTOM (registre#16)
• wire the agent-state control plane to both admin transports StateController serves the live per-agent AgentState registry with guarded mutations; the vacuous [200,404] e2e now discriminates (registre#21)
• register live protocol bridges and list them on the admin plane Processors install Mcp/A2a/AgUi/InMemory bridges via ProtocolBridgeRegistry.install; GET /api/admin/protocols reports runtime truth and the false SPI comments are corrected (registre#22)
• render the coordination causal tree from the journaled lineage GET /journal/{id}/tree reads CoordinationProjection on both admin transports, giving the envelope lineage its production consumer (registre#23)
• route shared-channel free text by address, default agent, or sole binding @​name/name: addressing beats registration order; atmosphere.channels.default-agent catches the rest; ambiguity now warns (registre#34)

... (truncated)

Commits

• eecf192 release: Atmosphere 4.0.69
• 55772cc fix(samples): stop the personal assistant overwriting an upstream-resolved ai...
• a7e2f86 fix(e2e): skip cross-session recall when the resolved runtime is the demo fal...
• 628a62c fix(ai): reattach two Javadoc comments orphaned by the owner-reclaim insert
• 07ed397 docs(sweep): require evidence in the four matrix rows that certified without it
• ed91e0f fix(release): stop the CHANGELOG generator crediting reverted commits
• bd07559 fix(ai): keep the run owner across a recycled request so fact extraction stil...
• 72890af fix(samples): make the classic-annotation samples work at runtime, not just i...
• 945ff83 fix(ai): resolve templated endpoint paths on WebTransport, not just requestURI
• 394d43a fix(e2e): fail a fixture boot as soon as the process dies, not after the timeout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3447.