Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.41

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.41.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.41

Changed — A2A v1.0.0 alignment (wire-breaking)

• atmosphere-a2a retracked to A2A v1.0.0 (a2aproject/A2A@v1.0.0, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (message/send, tasks/get, …) and a polymorphic Part envelope; both are gone in v1.0.0.
• JSON-RPC method names switched to PascalCase per spec §9.4 — SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, SubscribeToTask, the four {Create,Get,List,Delete}TaskPushNotificationConfig operations, and GetExtendedAgentCard. The pre-1.0 slash names and the old tasks/pushNotification/* path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.
• HTTP+JSON / REST binding added — colon-verb endpoints (POST /tasks/{id}:cancel, POST /tasks/{id}:subscribe, POST /message:send / :stream), pushNotificationConfigs CRUD URLs, and GET /extendedAgentCard are recognized by A2aHandler. REST requests are translated to JSON-RPC envelopes and dispatched through the same handler so the two bindings agree by construction (Mode Parity invariant #7).
• Type schema rewrite under org.atmosphere.a2a.types:
  • Part collapses three legacy subtypes (TextPart / FilePart / DataPart) into a single record carrying a text | raw | url | data oneof plus shared metadata, filename, mediaType. The deserializer continues to accept the pre-1.0 {"type":"text",…} / {"kind":"text",…} envelopes for migration.
  • Message.role is now the Role enum (ROLE_USER / ROLE_AGENT per ADR-001 ProtoJSON). Lower-case legacy forms parse for back-compat.
  • TaskState adds SUBMITTED (the v1.0.0 ack-before-work state) and emits its proto-JSON name on the wire (TASK_STATE_WORKING, …).
  • Task.messages is renamed to Task.history; TaskStatus is promoted to a top-level type and carries a timestamp; both update events (TaskStatusUpdateEvent, TaskArtifactUpdateEvent) gain contextId and metadata and drop the redundant final flag.
  • AgentCard gains supportedInterfaces (so an agent can advertise JSON-RPC + HTTP+JSON at distinct URLs), structured AgentProvider, AgentCardSignature, iconUrl, structured SecurityScheme/SecurityRequirement, and extendedAgentCard moves into AgentCapabilities (was supportsAuthenticatedExtendedCard). The pre-1.0 top-level guardrails field is no longer modeled — guardrails surface as an AgentExtension on AgentCapabilities.extensions under

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.41] - 2026-04-29

Changed — A2A v1.0.0 alignment (wire-breaking)

• atmosphere-a2a retracked to A2A v1.0.0 (a2aproject/A2A@v1.0.0, released 2026-03-12). The pre-1.0 wire surface was the slash-style method names (message/send, tasks/get, …) and a polymorphic Part envelope; both are gone in v1.0.0.
• JSON-RPC method names switched to PascalCase per spec §9.4 — SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, SubscribeToTask, the four {Create,Get,List,Delete}TaskPushNotificationConfig operations, and GetExtendedAgentCard. The pre-1.0 slash names and the old tasks/pushNotification/* path are aliased to their v1.0.0 equivalents at handler entry, with a one-time WARN per legacy method seen — existing Atmosphere clients keep working through the transition.
• HTTP+JSON / REST binding added — colon-verb endpoints (POST /tasks/{id}:cancel, POST /tasks/{id}:subscribe, POST /message:send / :stream), pushNotificationConfigs CRUD URLs, and GET /extendedAgentCard are recognized by A2aHandler. REST requests are translated to JSON-RPC envelopes and dispatched through the same handler so the two bindings agree by construction (Mode Parity invariant #7).
• Type schema rewrite under org.atmosphere.a2a.types:
  • Part collapses three legacy subtypes (TextPart / FilePart / DataPart) into a single record carrying a text | raw | url | data oneof plus shared metadata, filename, mediaType. The deserializer continues to accept the pre-1.0 {"type":"text",…} / {"kind":"text",…} envelopes for migration.
  • Message.role is now the Role enum (ROLE_USER / ROLE_AGENT per ADR-001 ProtoJSON). Lower-case legacy forms parse for back-compat.
  • TaskState adds SUBMITTED (the v1.0.0 ack-before-work state) and emits its proto-JSON name on the wire (TASK_STATE_WORKING, …).
  • Task.messages is renamed to Task.history; TaskStatus is promoted to a top-level type and carries a timestamp; both update events (TaskStatusUpdateEvent, TaskArtifactUpdateEvent) gain contextId and metadata and drop the redundant final flag.
  • AgentCard gains supportedInterfaces (so an agent can advertise JSON-RPC + HTTP+JSON at distinct URLs), structured AgentProvider, AgentCardSignature, iconUrl, structured SecurityScheme/SecurityRequirement, and extendedAgentCard moves into AgentCapabilities (was supportsAuthenticatedExtendedCard). The pre-1.0 top-level guardrails field is no longer modeled — guardrails surface as an AgentExtension on AgentCapabilities.extensions under

... (truncated)

Commits

• 1cd8fa6 release: Atmosphere 4.0.41
• f4f81d6 ci(cli): rename overlay-e2e step to "(7 runtimes)" — matrix is now complete
• 1e8bac1 test(cli): boot all 7 runtimes via overlay e2e (was 4 of 7)
• f5ee2eb test(cli): add semantic-kernel to overlay e2e matrix
• 9a897fe docs(cli): document --runtime --force in root + cli READMEs
• c18ac55 fix(cli): drop --force boot e2e — strip works but ai-tools has provider-coupl...
• 606b453 feat(cli): --runtime <X> --force strips pre-pinned adapters before injecting
• 1e1eadb fix(ai): boot ai-chat with only LLM_API_KEY across spring-ai/lc4j adapters
• e2da9e2 fix(cli): make overlay e2e survive a single failure (set -e + 300s timeout)
• a472fbc test(cli): two-tier --runtime overlay e2e — scaffold+compile + boot+assert
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3084.