Release v1.0.0: Major Architecture Refactor & Dependency Cleanup
Overview
Major architectural improvements with LLM provider unification, dependency cleanup, and security enhancements.
Key Changes
LLM Provider Unification
- Replaced 2000+ lines of custom provider code with unified LiteLLM interface
- Removed direct dependencies: anthropic, openai, cohere, groq, ollama, huggingface-hub, google-generativeai, halo
- Added litellm as single dependency for all LLM providers
- Enhanced fallback support with model lists for automatic failover
Task Execution Architecture
- Split Task.create and Task.create_async for better sync/async separation
- Added max_iterations parameter for configurable tool loop limits (default: 50)
- Improved task execution stability and predictability
- Enhanced control over task lifecycle and resource management
Dependency Management
- Deprecated yahoo_finance_tools due to instability (removed yfinance, yahoofinance dependencies)
- Streamlined core dependencies and improved optional tool separation
- Added Python 3.13 support
- Fixed f-string backslash issues for Python 3.11 compatibility
Security Fixes
- requests >= 2.32.0 (credential leak)
- mcp >= 1.7.0 (SQL injection, validation errors)
- fastmcp >= 2.3.0 (server vulnerabilities)
- pillow >= 11.0.0 (buffer overflow)
- protobuf >= 5.29.0 (DoS vulnerability)
- urllib3 >= 2.2.3 (redirect control)
- aiohttp >= 3.11.20 (parsing vulnerability)
Architecture Improvements
- Enhanced MCP adapter integration
- Improved task execution and message handling
- Unified error handling across all providers
- Better resource cleanup and thread management
Breaking Changes
- Yahoo Finance tools no longer available
- Task.create now properly separated from Task.create_async
- Some internal LLM provider methods changed (public API stable)
- Updated minimum dependency versions
Migration
Users of Yahoo Finance tools should migrate to FRED tools or alternative financial APIs. Update any code using Task.create to specify sync vs async execution patterns explicitly. Code using Task.create in asynchronous environments need to explicitly define it as create_async.