AgentWorks BOM

​

Overview

​

Maven

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>io.github.markpollack</groupId>
            <artifactId>agentworks-bom</artifactId>
            <version>1.18.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

<!-- Then just: -->
<dependency>
    <groupId>io.github.markpollack</groupId>
    <artifactId>experiment-core</artifactId>
    <!-- version managed by BOM -->
</dependency>

​

What’s new in 1.18.0

• 1.18.0: a currency repin, and the point at which the BOM caught up with its members — every managed coordinate is now that project’s current release: Agent Client 0.29.3, Agent Journal 1.8.2, Agent Judge 0.15.1, Agent Workflow 0.12.1, the acp-java family 0.16.1, Agent Hooks 0.8.2, Agent Sandbox 0.10.2, Agent Experiment 0.7.1, Agent Bench 0.6.1, Agent Memory 0.5.1, Claude Agent SDK 1.5.1. The work behind 1.17.0 and 1.18.0 was predominantly security and SBOM hardening, not features. Managed members grew 46 → 72 as more published modules came under management (Agent Client 12 → 28, Agent Judge 4 → 10, Agent Journal 3 → 6).
• 1.16.0: the broadest repin since the org migration — Agent Client 0.28.0, Agent Journal 1.7.0, Agent Hooks 0.7.0, Agent Judge 0.15.0, Agent Sandbox 0.10.0, Agent Bench 0.6.0, Agent Experiment 0.6.0, Agent Memory 0.4.0, Claude Agent SDK 1.5.0, and the acp-java family 0.15.0. loopy is no longer a managed member; depend on it directly.
• 1.15.0: repins the Agent Client family to 0.25.0 — fixes Spring Boot auto-configuration for all providers. The org migration had left the auto-config registration files (.imports/spring.factories) pointing at the old org.springaicommunity package, so the starters failed to auto-configure (ClassNotFoundException) at boot. All other members unchanged.
• 1.14.0: repins the Agent Client family to 0.24.0 — a compatibility fix so agent-claude builds against agent-journal 1.6.0. journal 1.5.0 had relocated TraceContentMode, which broke Claude trace-wiring for Spring Boot consumers on 1.12.0/1.13.0 (NoClassDefFoundError). All other members unchanged.
• 1.13.0: repins Agent Journal to 1.6.0 — first-class journal-capture primitives (slice 1), a cost-metering correction (the headline LLMCallEvent.tokenUsage is now the cost-bearing Σ-per-turn aggregate, fixing a ~2× long-run under-count), and a per-file schema-version header on the jsonl logs. Additive on the frozen capture contract; a 1.5.0 consumer keeps working.
• 1.12.0: repins Agent Journal to 1.5.0 and adds the new gemini-cli-capture managed member — agent runs from Claude and Gemini now capture into one portable trace + cost format.
• 1.9.0 was the security cut: converged on Spring AI 2.0.0 GA and cleared four CVEs — Spring Boot CVE-2026-40976 (CRITICAL) and CVE-2026-40973, Spring AI CVE-2026-41712, and Jackson CVE-2026-29062. Added tools.jackson:jackson-bom 3.1.4 and reactor-core 3.8.6 to converge transitive dependencies, all verified by the bom-verification gate.
• 1.10.0 / 1.11.0: repinned the source-fixed members to lock in the CVE remediation (claude-code-sdk 1.4.0, workflow 0.10.0, Spring AI BOM 2.0.0 backstop).
• 1.8.0: bumped the acp-java family to 0.14.0, clearing the deferred 0.13.0 cut.

​

Managed Artifacts

​

Agent Engineering (io.github.markpollack)

​

Agent Client Protocol (com.agentclientprotocol)

​

Source