fix: preserve release variants and refresh dependencies for 3.2.3

Author: arvindand

.mvn/wrapper/maven-wrapper.properties

@@ -14,6 +14,7 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.10.0/apache-maven-3.10.0-bin.zip
+distributionSha256Sum=1f6d9909266510f039f59aa0e13dcd2c66da85f043e56276e41f2918f8bddaff

CHANGELOG.md

@@ -7,10 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Changed (Unreleased)
+## [3.2.3] - 2026-10-04
 
+### Fixed (3.2.3)
+
+- Preserve recognized release variants such as Guava `jre`/`android` and JDBC `jre11`/`jre17` when comparing versions and recommending POM upgrades. Keep snapshot, release-candidate and unknown qualifiers conservative.
+- Resolve OSV fixed boundaries to actual published, compatible Maven versions before verification. Keep vulnerability findings visible if metadata or verification fails; never invent remediation versions.
+- Correct the documented default stability filter for `get_latest_version` to `PREFER_STABLE`.
+
+### Changed (3.2.3)
+
+- Update Tomcat to 11.0.26, embedded Maven components and the build distribution to 3.10.0, and the Apache Maven wrapper to 3.3.4 with a verified distribution checksum.
+- Update the optional Python agent runtime and development dependencies, including GitHub Copilot SDK 1.0.16. Adapt client configuration, awaited response handling and session disconnection to the current SDK API.
+- Normalize SDK session errors for CLI reporting and complete client cleanup even when session disconnection fails. Cleanup exception groups do not discard completed reviews.
+- Align project, runtime, registry and build fallback versions at 3.2.3.
 - Align architecture, setup, tool schemas, examples, certificate guidance and agent documentation with the released 3.2.2 behavior and known response-field limitations.
-- Start the 3.2.3-SNAPSHOT development cycle. Published registry metadata and build fallback versions remain at 3.2.2.
 
 ## [3.2.2] - 2026-09-06
 
@@ -769,7 +780,8 @@ This major release updates tool names and adds stability parameters while mainta
 - Unit and integration tests
 - Maven Central API integration
 
-[Unreleased]: https://github.com/arvindand/maven-tools-mcp/compare/v3.2.2...HEAD
+[Unreleased]: https://github.com/arvindand/maven-tools-mcp/compare/v3.2.3...HEAD
+[3.2.3]: https://github.com/arvindand/maven-tools-mcp/compare/v3.2.2...v3.2.3
 [3.2.2]: https://github.com/arvindand/maven-tools-mcp/compare/v3.2.1...v3.2.2
 [3.2.0]: https://github.com/arvindand/maven-tools-mcp/compare/v3.1.2...v3.2.0
 [3.1.2]: https://github.com/arvindand/maven-tools-mcp/compare/v3.1.1...v3.1.2

agents/copilot-maven-tools-agent/README.md

@@ -28,6 +28,13 @@ Apache Maven on the server resolves the effective model. The Python editor uses
 pip install .
 ```
 
+The agent requires Python 3.12 or later and uses Copilot SDK 1.0.16. The SDK
+downloads and verifies its matching runtime on first managed use; an existing
+runtime can be selected with `COPILOT_CLI_PATH`. Only `--mode major` starts a
+Copilot session. Dependency checks in the other modes call MCP directly.
+Major-review mode waits for the final assistant reply rather than concatenating
+streaming events. Session cleanup disconnects the session and stops its runtime.
+
 ### Run
 
 ```bash

agents/copilot-maven-tools-agent/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=61.0", "wheel"]
+requires = ["setuptools>=84.0.0", "wheel>=0.48.0"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -22,21 +22,21 @@ classifiers = [
 ]
 
 dependencies = [
-    "aiohttp>=3.13.3",
-    "pydantic>=2.12.5",
-    "click>=8.1.8",
-    "rich>=14.3.2",
-    "github-copilot-sdk==0.2.0",
+    "aiohttp>=3.14.3,<4",
+    "pydantic>=2.13.5,<3",
+    "click>=8.5.0,<9",
+    "rich>=15.0.0,<16",
+    "github-copilot-sdk==1.0.16",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "pytest>=8.4.2",
-    "pytest-asyncio>=1.2.0",
-    "pytest-cov>=7.0.0",
-    "black>=25.11.0",
-    "ruff>=0.14.14",
-    "mypy>=1.19.1",
+    "pytest>=9.1.1,<10",
+    "pytest-asyncio>=1.4.0,<2",
+    "pytest-cov>=7.1.0,<8",
+    "black>=26.5.1",
+    "ruff>=0.16.10,<0.17",
+    "mypy>=2.4.0,<3",
 ]
 
 [project.scripts]

agents/copilot-maven-tools-agent/requirements.txt

@@ -1,14 +1,14 @@
 # Core dependencies
-aiohttp>=3.13.3
-pydantic>=2.12.5
-click>=8.1.8
-rich>=14.3.2
-github-copilot-sdk>=0.2.0
+aiohttp>=3.14.3,<4
+pydantic>=2.13.5,<3
+click>=8.5.0,<9
+rich>=15.0.0,<16
+github-copilot-sdk==1.0.16
 
 # Development dependencies
-pytest>=8.4.2
-pytest-asyncio>=1.2.0
-pytest-cov>=7.0.0
-black>=25.11.0
-ruff>=0.14.14
-mypy>=1.19.1
+pytest>=9.1.1,<10
+pytest-asyncio>=1.4.0,<2
+pytest-cov>=7.1.0,<8
+black>=26.5.1
+ruff>=0.16.10,<0.17
+mypy>=2.4.0,<3

agents/copilot-maven-tools-agent/src/copilot/sdk_client.py

@@ -9,7 +9,6 @@
 
 from __future__ import annotations
 
-import asyncio
 import copy
 import json
 import logging
@@ -43,7 +42,7 @@ class CopilotSDKClient:
             "command": "docker",
             "args": ["run", "-i", "--rm", "arvindand/maven-tools-mcp:latest"],
             "tools": ["*"],
-            "timeout": 60000
+            "timeout": 60000,
         }
     }
 
@@ -53,7 +52,7 @@ class CopilotSDKClient:
             "type": "http",
             "url": "http://localhost:8080/mcp",
             "tools": ["*"],
-            "timeout": 60000
+            "timeout": 60000,
         }
     }
 
@@ -86,24 +85,25 @@ def __init__(
     async def start(self) -> None:
         """Start the Copilot client."""
         try:
-            from copilot import CopilotClient, PermissionHandler, SubprocessConfig
+            from copilot import CopilotClient, PermissionHandler
         except ImportError:
             raise ImportError(
                 "github-copilot-sdk not installed. Run: pip install github-copilot-sdk"
             )
 
-        # Build subprocess config for the Copilot CLI (SDK 0.2.0+ dataclass API)
+        # SDK 1.x configures the managed runtime through keyword arguments.
         token = get_github_token()
         if not token:
-            logger.warning("No GitHub token found in COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN")
+            logger.warning(
+                "No GitHub token found in COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN"
+            )
 
-        subprocess_config = SubprocessConfig(
-            cwd=self.working_dir,
+        self._client = CopilotClient(
+            working_directory=self.working_dir,
             log_level="warning",
             github_token=token,
         )
 
-        self._client = CopilotClient(subprocess_config)
         await self._client.start()
         logger.info("Copilot SDK client started")
 
@@ -123,25 +123,29 @@ async def start(self) -> None:
         self._session = await self._client.create_session(
             on_permission_request=PermissionHandler.approve_all,
             model=self.model,
-            streaming=True,
+            streaming=False,
             mcp_servers=mcp_servers,
         )
         logger.info(f"Session created with model {self.model}")
 
     async def stop(self) -> None:
         """Stop the Copilot client."""
-        if self._session:
-            try:
-                await self._session.destroy()
-            except (RuntimeError, OSError) as e:
-                logger.debug(f"Session destroy error: {e}")
-            self._session = None
-        if self._client:
-            try:
-                await self._client.stop()
-            except (RuntimeError, OSError) as e:
-                logger.debug(f"Client stop error: {e}")
-            self._client = None
+        session, self._session = self._session, None
+        client, self._client = self._client, None
+        try:
+            if session:
+                try:
+                    await session.disconnect()
+                except Exception as error:
+                    logger.debug("Session disconnect error: %s", error)
+        finally:
+            if client:
+                try:
+                    await client.stop()
+                except Exception as error:
+                    # SDK1.x may report cleanup failures as ExceptionGroup.
+                    # Cleanup must not replace a completed review or its error.
+                    logger.debug("Client stop error: %s", error)
         logger.info("Copilot SDK client stopped")
 
     async def __aenter__(self) -> "CopilotSDKClient":
@@ -167,24 +171,19 @@ async def submit(self, prompt: str, timeout: float = 300.0) -> str:
         if not self._session:
             raise RuntimeError("Session not started")
 
-        result_parts: list[str] = []
-        done = asyncio.Event()
-        error_holder: dict[str, Optional[str]] = {"error": None}
-
-        handler = _create_event_handler(result_parts, done, error_holder)
-        self._session.on(handler)
-
         try:
-            await self._session.send(prompt)
-            async with asyncio.timeout(timeout):
-                await done.wait()
-        except (TimeoutError, asyncio.TimeoutError):
-            raise RuntimeError(f"Timeout waiting for response after {timeout}s")
+            response = await self._session.send_and_wait(prompt, timeout=timeout)
+        except TimeoutError as error:
+            raise RuntimeError(f"Timeout waiting for response after {timeout}s") from error
+        except Exception as error:
+            raise RuntimeError(f"Copilot error: {error}") from error
 
-        if error_holder["error"]:
-            raise RuntimeError(f"Copilot error: {error_holder['error']}")
+        if response is None:
+            raise RuntimeError("Copilot session became idle without an assistant response")
 
-        return "".join(result_parts)
+        # send_and_wait returns the final root assistant message, excluding tool
+        # progress, streaming deltas and responses from child agents.
+        return response.data.content
 
     async def analyze_dependencies(self, pom_content: str) -> dict[str, Any]:
         """
@@ -263,45 +262,6 @@ async def get_latest_version(self, dependency: str) -> str:
             return versions[-1]
         return response.strip()
 
-def _get_event_type(event: Any) -> str:
-    """Extract event type string from event object."""
-    return event.type.value if hasattr(event.type, "value") else str(event.type)
-
-
-def _create_event_handler(
-    result_parts: list[str],
-    done: asyncio.Event,
-    error_holder: dict[str, Optional[str]],
-) -> Any:
-    """Create an event handler for SDK session events."""
-
-    def on_event(event: Any) -> None:
-        event_type = _get_event_type(event)
-
-        if event_type == "assistant.message":
-            _handle_message_event(event, result_parts)
-        elif event_type == "assistant.message_delta":
-            _handle_delta_event(event, result_parts)
-        elif event_type == "session.idle":
-            done.set()
-        elif event_type == "error":
-            error_holder["error"] = str(event.data) if hasattr(event, "data") else "Unknown error"
-            done.set()
-
-    return on_event
-
-
-def _handle_message_event(event: Any, result_parts: list[str]) -> None:
-    """Handle assistant.message event."""
-    if hasattr(event.data, "content") and event.data.content:
-        result_parts.append(event.data.content)
-
-
-def _handle_delta_event(event: Any, result_parts: list[str]) -> None:
-    """Handle assistant.message_delta event."""
-    if hasattr(event.data, "delta_content") and event.data.delta_content:
-        result_parts.append(event.data.delta_content)
-
 
 def _extract_json_object(response: str) -> dict[str, Any]:
     """Extract first complete JSON object from response."""