Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.67

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.67.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.67

Fixed

• make the vector store opt-in so keyless retrieval keeps its provider An empty store becomes the retrieval source and starves the demo path — the rag-chat-commands e2e caught it.
• scrub SPRING_AI_* and read warnings from binary sample logs Relaxed binding let an ambient SPRING_AI_OPENAI_BASE_URL redirect samples off the keyless-local backend.
• reject flag-shaped project names and unknown checkpoint options atmosphere new --list-templates scaffolded a directory named after the flag; checkpoint silently ignored --url.
• build the vector store so retrieval is actually grounded Un-exclude OpenAiEmbeddingAutoConfiguration and gate the bean on a property, not @​ConditionalOnBean.
• treat unreachable container daemon as engine unavailable

Changed

• allowlist ConditionalOnBean/ConditionalOnProperty doc symbols Sibling Spring conditions were already listed; these two were missing.
• document the transport headers replay requires A bare curl returns 200 with an empty body because reattach only runs for WS/SSE/long-polling.
• unwire mcp-client spec until its build moves out of the hook
• stop dependabot rewriting the maven wrapper
• hold the Maven wrapper on 3.x in dependabot
• bump Embabel to 1.5.0 and MCP Java SDK to 2.0.0
• bump Spring Boot 4.0.7 to 4.1.0
• bump org.jetbrains.kotlinx:kotlinx-serialization-core-jvm (#2748)
• bump every version-bearing file in one commit
• prepare next development version 5.0.42
• bump version to 4.0.66
• prepare for next development iteration 4.0.67-SNAPSHOT

Atmosphere 4.0.66

Added

• add opt-in durable batch job API at /atmosphere/v1/batches riding AiPipeline SQLite-backed submit/poll/results/cancel, default off; eval dataset runner is the first consumer
• opt-in Ed25519 state sealing wires AgentStateIntegrity into FileSystemAgentState
• give the classroom a @​RoomService chat channel with history A templated @​RoomService path created one shared room for every path value, so two classrooms saw each other's members and history

Fixed

• report a non-runnable sample before checking the JDK
• scaffold from the ref that matches the pinned version, and make compose work anywhere
• stop provider defaults from shadowing a local backend
• boot the reactor version, never the newest jar lying in target/
• never drop a React Native send, and ship the types we advertise
• send tool-call arguments as a JSON object on the OpenAI wire
• screen tool-call arguments in deny lists and reach local Koog backends
• treat a local backend as reachable without a credential
• report the ms-governance rule count from the loaded policies
• render every streamed chunk and scope tool cards to their turn
• build a default model for keyless local backends
• boot exec-type samples through the helper instead of by hand grpc-chat is the matrix's only exec sample and the helper died on it, so it had to be started manually with the LLM env scrubbed by hand
• use the Session-bearing SendResult constructors WebSocket 2.2 deprecates the no-Session forms and the build is -Werror.
• register @​Message payload types in the Quarkus deployment processor The Spring AOT half landed separately on main; this is the Jandex-side equivalent, so the Quarkus native lane stops dying on the payload
• stop the demo runtime shadowing a locally served model A local backend needs no key, so a blank key was the wrong test for "no backend" — LLM_MODE=local reached Ollama and still answered from the canned script

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.67] - 2026-08-17

Fixed

• make the vector store opt-in so keyless retrieval keeps its provider An empty store becomes the retrieval source and starves the demo path — the rag-chat-commands e2e caught it.
• scrub SPRING_AI_* and read warnings from binary sample logs Relaxed binding let an ambient SPRING_AI_OPENAI_BASE_URL redirect samples off the keyless-local backend.
• reject flag-shaped project names and unknown checkpoint options atmosphere new --list-templates scaffolded a directory named after the flag; checkpoint silently ignored --url.
• build the vector store so retrieval is actually grounded Un-exclude OpenAiEmbeddingAutoConfiguration and gate the bean on a property, not @​ConditionalOnBean.
• treat unreachable container daemon as engine unavailable

Changed

• allowlist ConditionalOnBean/ConditionalOnProperty doc symbols Sibling Spring conditions were already listed; these two were missing.
• document the transport headers replay requires A bare curl returns 200 with an empty body because reattach only runs for WS/SSE/long-polling.
• unwire mcp-client spec until its build moves out of the hook
• stop dependabot rewriting the maven wrapper
• hold the Maven wrapper on 3.x in dependabot
• bump Embabel to 1.5.0 and MCP Java SDK to 2.0.0
• bump Spring Boot 4.0.7 to 4.1.0
• bump org.jetbrains.kotlinx:kotlinx-serialization-core-jvm (#2748)
• bump every version-bearing file in one commit
• prepare next development version 5.0.42
• bump version to 4.0.66
• prepare for next development iteration 4.0.67-SNAPSHOT

[4.0.66] - 2026-08-09

Added

• add opt-in durable batch job API at /atmosphere/v1/batches riding AiPipeline SQLite-backed submit/poll/results/cancel, default off; eval dataset runner is the first consumer
• opt-in Ed25519 state sealing wires AgentStateIntegrity into FileSystemAgentState
• give the classroom a @​RoomService chat channel with history A templated @​RoomService path created one shared room for every path value, so two classrooms saw each other's members and history

Fixed

• report a non-runnable sample before checking the JDK
• scaffold from the ref that matches the pinned version, and make compose work anywhere
• stop provider defaults from shadowing a local backend
• boot the reactor version, never the newest jar lying in target/
• never drop a React Native send, and ship the types we advertise
• send tool-call arguments as a JSON object on the OpenAI wire
• screen tool-call arguments in deny lists and reach local Koog backends
• treat a local backend as reachable without a credential
• report the ms-governance rule count from the loaded policies
• render every streamed chunk and scope tool cards to their turn
• build a default model for keyless local backends
• boot exec-type samples through the helper instead of by hand grpc-chat is the matrix's only exec sample and the helper died on it, so it had to be started manually with the LLM env scrubbed by hand
• use the Session-bearing SendResult constructors WebSocket 2.2 deprecates the no-Session forms and the build is -Werror.
• register @​Message payload types in the Quarkus deployment processor The Spring AOT half landed separately on main; this is the Jandex-side equivalent, so the Quarkus native lane stops dying on the payload
• stop the demo runtime shadowing a locally served model A local backend needs no key, so a blank key was the wrong test for "no backend" — LLM_MODE=local reached Ollama and still answered from the canned script

... (truncated)

Commits

• bc47390 release: Atmosphere 4.0.67
• f7c5768 fix(rag-chat): make the vector store opt-in so keyless retrieval keeps its pr...
• 8ecd9f8 chore(harness): allowlist ConditionalOnBean/ConditionalOnProperty doc symbols
• a6eb4b6 docs(reattach-harness): document the transport headers replay requires
• bbad7b9 fix(sweep): scrub SPRING_AI_* and read warnings from binary sample logs
• 0a4df37 fix(cli): reject flag-shaped project names and unknown checkpoint options
• 5841b50 fix(rag-chat): build the vector store so retrieval is actually grounded
• b600b8a ci(e2e): unwire mcp-client spec until its build moves out of the hook
• c06204a ci(deps): stop dependabot rewriting the maven wrapper
• 80a4a2d ci(deps): hold the Maven wrapper on 3.x in dependabot
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)