fastworkflow 2.18.1__tar.gz → 2.18.2__tar.gz

{fastworkflow-2.18.1 → fastworkflow-2.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fastworkflow
-Version: 2.18.1
+Version: 2.18.2
 Summary: A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX
 License: Apache-2.0
 Keywords: fastworkflow,ai,workflow,llm,openai
@@ -12,19 +12,19 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Provides-Extra: fastapi
+Provides-Extra: server
 Provides-Extra: training
 Requires-Dist: aiohttp (>=3.13.4)
 Requires-Dist: colorama (>=0.4.6,<0.5.0)
 Requires-Dist: cryptography (>=46.0.7)
 Requires-Dist: datasets (>=4.0.0,<5.0.0) ; extra == "training"
 Requires-Dist: dspy (>=3.0.1,<4.0.0)
-Requires-Dist: fastapi (>=0.120.1) ; extra == "fastapi"
-Requires-Dist: fastapi-mcp (>=0.4.0,<0.5.0) ; extra == "fastapi"
+Requires-Dist: fastapi (>=0.120.1) ; extra == "server" or extra == "fastapi"
+Requires-Dist: fastapi-mcp (>=0.4.0,<0.5.0) ; extra == "server" or extra == "fastapi"
 Requires-Dist: filelock (>=3.20.1)
 Requires-Dist: idna (>=3.15)
 Requires-Dist: libcst (>=1.8.2,<2.0.0)
-Requires-Dist: litellm[proxy] (>=1.83.7,<2.0.0)
-Requires-Dist: mako (>=1.3.12)
+Requires-Dist: litellm (>=1.83.7,<2.0.0)
 Requires-Dist: mmh3 (>=5.1.0,<6.0.0)
 Requires-Dist: openai (>=2.8.0)
 Requires-Dist: orjson (>=3.11.6)
@@ -33,20 +33,19 @@ Requires-Dist: pyarrow (>=23.0.1)
 Requires-Dist: pyasn1 (>=0.6.3)
 Requires-Dist: pydantic (>=2.9.2,<3.0.0)
 Requires-Dist: pygments (>=2.20.0)
-Requires-Dist: pyjwt[crypto] (>=2.13.0) ; extra == "fastapi"
-Requires-Dist: pynacl (>=1.6.2)
+Requires-Dist: pyjwt[crypto] (>=2.13.0) ; extra == "server" or extra == "fastapi"
 Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
 Requires-Dist: python-levenshtein (>=0.27.1,<0.28.0)
-Requires-Dist: python-multipart (>=0.0.27)
+Requires-Dist: python-multipart (>=0.0.27) ; extra == "server" or extra == "fastapi"
 Requires-Dist: requests (>=2.33.0)
 Requires-Dist: scikit-learn (>=1.6.1,<2.0.0)
 Requires-Dist: sentencepiece (>=0.2.0,<0.3.0)
 Requires-Dist: speedict (>=0.3.12,<0.4.0)
-Requires-Dist: starlette (>=0.49.1)
+Requires-Dist: starlette (>=0.49.1) ; extra == "server" or extra == "fastapi"
 Requires-Dist: torch (>=2.7.1,<3.0.0)
 Requires-Dist: transformers (>=4.48.2,<6.0.0)
 Requires-Dist: urllib3 (>=2.7.0)
-Requires-Dist: uvicorn (>=0.33.0,<0.34.0) ; extra == "fastapi"
+Requires-Dist: uvicorn (>=0.33.0) ; extra == "server" or extra == "fastapi"
 Project-URL: homepage, https://github.com/radiantlogicinc/fastworkflow
 Project-URL: repository, https://github.com/radiantlogicinc/fastworkflow
 Description-Content-Type: text/markdown
@@ -202,6 +201,17 @@ uv pip install fastworkflow
 - `fastWorkflow` requires Python 3.11+ or higher.
 - Training (`fastworkflow train`) also expects the optional Hugging Face `datasets` package. Install it by including the dev group when using Poetry.
 
+### Optional extras
+
+The core install depends on **plain** `litellm` (used only as a client via `dspy.LM`) and pulls **no** proxy-server packages, so it stays lean and co-installs cleanly with downstream apps that pin a plain `litellm` (e.g. `litellm>=1.83.11,<1.84.0`). Server- and training-only dependencies are gated behind extras:
+
+| Extra | Install | Provides |
+| --- | --- | --- |
+| `server` | `pip install "fastworkflow[server]"` | The FastAPI-MCP HTTP service (`fastworkflow run_fastapi_mcp`): `fastapi`, `uvicorn`, `fastapi-mcp`, `pyjwt[crypto]`, `python-multipart`, `starlette` (with security-patched floors). |
+| `training` | `pip install "fastworkflow[training]"` | The Hugging Face `datasets` package required by `fastworkflow train` for synthetic-utterance / parameter-example generation. |
+
+The `server` extra is only needed to *host* the FastAPI-MCP service.
+
 ### Dependency compatibility
 
 `fastWorkflow` is designed to co-install with modern ML/LLM stacks. The key supported ranges are:
@@ -211,7 +221,7 @@ uv pip install fastworkflow
 | `transformers` | `>=4.48.2,<6.0.0` | Works on transformers 5.x. The intent-detection base models are BERT/DistilBERT checkpoints that load natively on 5.x (no slow→fast tokenizer conversion required). |
 | `dspy` | `>=3.0.1,<4.0.0` | Migrated off the dspy 2.x API. |
 | `openai` | `>=2.8.0` | Compatible with openai 2.x. |
-| `litellm` | `>=1.81.4,<2.0.0` | Compatible with litellm 1.83+. |
+| `litellm` | `>=1.83.7,<2.0.0` | Core depends on **plain** `litellm` (client only, no `[proxy]` extra), so downstreams can pin e.g. `litellm>=1.83.11,<1.84.0` without pulling the proxy server stack. The FastAPI-MCP server deps live in the optional `fastworkflow[server]` extra. |
 | `sentence-transformers` | not a dependency | `fastWorkflow` does not depend on `sentence-transformers`, so it imposes no constraint (use any 5.x version downstream). |
 
 `sentencepiece` is bundled as a dependency because transformers 5.x can require it to instantiate certain tokenizers.
@@ -620,6 +630,9 @@ For workflows with complex initialization requirements, creating a dedicated sta
 
 For production deployments and integrations, fastWorkflow provides a FastAPI-based HTTP service via the `run_fastapi_mcp` module. This exposes your workflow as REST endpoints with JWT authentication, SSE streaming, and MCP (Model Context Protocol) support.
 
+> [!note]
+> The FastAPI-MCP service requires the optional `server` extra: `pip install "fastworkflow[server]"` (or `poetry install --extras server`). Running `fastworkflow run_fastapi_mcp` without it fails fast with a clear install hint.
+
 ```sh
 # Run the FastAPI service
 python -m fastworkflow.run_fastapi_mcp \

{fastworkflow-2.18.1 → fastworkflow-2.18.2}/README.md

@@ -149,6 +149,17 @@ uv pip install fastworkflow
 - `fastWorkflow` requires Python 3.11+ or higher.
 - Training (`fastworkflow train`) also expects the optional Hugging Face `datasets` package. Install it by including the dev group when using Poetry.
 
+### Optional extras
+
+The core install depends on **plain** `litellm` (used only as a client via `dspy.LM`) and pulls **no** proxy-server packages, so it stays lean and co-installs cleanly with downstream apps that pin a plain `litellm` (e.g. `litellm>=1.83.11,<1.84.0`). Server- and training-only dependencies are gated behind extras:
+
+| Extra | Install | Provides |
+| --- | --- | --- |
+| `server` | `pip install "fastworkflow[server]"` | The FastAPI-MCP HTTP service (`fastworkflow run_fastapi_mcp`): `fastapi`, `uvicorn`, `fastapi-mcp`, `pyjwt[crypto]`, `python-multipart`, `starlette` (with security-patched floors). |
+| `training` | `pip install "fastworkflow[training]"` | The Hugging Face `datasets` package required by `fastworkflow train` for synthetic-utterance / parameter-example generation. |
+
+The `server` extra is only needed to *host* the FastAPI-MCP service.
+
 ### Dependency compatibility
 
 `fastWorkflow` is designed to co-install with modern ML/LLM stacks. The key supported ranges are:
@@ -158,7 +169,7 @@ uv pip install fastworkflow
 | `transformers` | `>=4.48.2,<6.0.0` | Works on transformers 5.x. The intent-detection base models are BERT/DistilBERT checkpoints that load natively on 5.x (no slow→fast tokenizer conversion required). |
 | `dspy` | `>=3.0.1,<4.0.0` | Migrated off the dspy 2.x API. |
 | `openai` | `>=2.8.0` | Compatible with openai 2.x. |
-| `litellm` | `>=1.81.4,<2.0.0` | Compatible with litellm 1.83+. |
+| `litellm` | `>=1.83.7,<2.0.0` | Core depends on **plain** `litellm` (client only, no `[proxy]` extra), so downstreams can pin e.g. `litellm>=1.83.11,<1.84.0` without pulling the proxy server stack. The FastAPI-MCP server deps live in the optional `fastworkflow[server]` extra. |
 | `sentence-transformers` | not a dependency | `fastWorkflow` does not depend on `sentence-transformers`, so it imposes no constraint (use any 5.x version downstream). |
 
 `sentencepiece` is bundled as a dependency because transformers 5.x can require it to instantiate certain tokenizers.
@@ -567,6 +578,9 @@ For workflows with complex initialization requirements, creating a dedicated sta
 
 For production deployments and integrations, fastWorkflow provides a FastAPI-based HTTP service via the `run_fastapi_mcp` module. This exposes your workflow as REST endpoints with JWT authentication, SSE streaming, and MCP (Model Context Protocol) support.
 
+> [!note]
+> The FastAPI-MCP service requires the optional `server` extra: `pip install "fastworkflow[server]"` (or `poetry install --extras server`). Running `fastworkflow run_fastapi_mcp` without it fails fast with a clear install hint.
+
 ```sh
 # Run the FastAPI service
 python -m fastworkflow.run_fastapi_mcp \

{fastworkflow-2.18.1 → fastworkflow-2.18.2}/fastworkflow/cli.py

@@ -381,8 +381,41 @@ def run_with_defaults(args):  # sourcery skip: extract-duplicate-method
     from .run.__main__ import run_main as _run_main
     return _run_main(args)
 
+def _require_server_extra():
+    """Ensure the optional `server` extra is installed before launching the FastAPI-MCP service.
+
+    The FastAPI-MCP server (`fastworkflow run_fastapi_mcp`) is the only feature that
+    needs the server-only dependencies (fastapi, uvicorn, fastapi-mcp, pyjwt). These
+    live behind the optional `fastworkflow[server]` extra so that the core/client
+    install (and `fastworkflow train`) stays lean. Fail early with a clear, actionable
+    message instead of letting the subprocess die with a bare ImportError.
+    """
+    import importlib.util
+
+    if missing := [
+        pkg
+        for pkg, mod in (
+            ("fastapi", "fastapi"),
+            ("uvicorn", "uvicorn"),
+            ("fastapi-mcp", "fastapi_mcp"),
+            ("pyjwt", "jwt"),
+        )
+        if importlib.util.find_spec(mod) is None
+    ]:
+        rprint(
+            "[bold red]Error:[/bold red] the FastAPI-MCP server requires the optional "
+            "'server' extra, which is not installed.\n"
+            f"Missing packages: {', '.join(missing)}\n\n"
+            "Install it with one of:\n"
+            "  pip install \"fastworkflow[server]\"\n"
+            "  poetry install --extras server"
+        )
+        sys.exit(1)
+
+
 def run_fastapi_mcp_with_defaults(args):  # sourcery skip: extract-duplicate-method
     """Wrapper for fastapi mcp server that sets default env file paths based on context."""
+    _require_server_extra()
     if args.env_file_path is None or args.passwords_file_path is None:
         default_env, default_passwords = find_default_env_files(args.workflow_path)
     if args.env_file_path is None:

{fastworkflow-2.18.1 → fastworkflow-2.18.2}/pyproject.toml

@@ -9,7 +9,7 @@ repository = "https://github.com/radiantlogicinc/fastworkflow"
 
 [tool.poetry]
 name = "fastworkflow"
-version = "2.18.1"
+version = "2.18.2"
 description = "A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX"
 authors = ["Dhar Rawal <drawal@radiantlogic.com>"]
 license = "Apache-2.0"
@@ -52,31 +52,43 @@ torch = "^2.7.1"
 prompt_toolkit = "^3.0.43"
 libcst = "^1.8.2"
 openai = ">=2.8.0"
-litellm = {extras = ["proxy"], version = ">=1.83.7,<2.0.0"}  # CVE-2026-35029/35030/42203/42271 + GHSA-69x8-hrgq-fjj8. Lock resolves to 1.88.0rc1 (prerelease), which also unpins pyjwt->2.13.0 and fastapi-sso->0.21.0 (closes their advisories)
-uvicorn = {version = ">=0.33.0,<0.34.0", optional = true}  # stable litellm[proxy] >=1.83.7 requires uvicorn 0.33.0
+# CORE depends on PLAIN litellm (no proxy extra). fastworkflow uses litellm only
+# as a client (via dspy.LM and litellm.completion); it never runs a litellm proxy
+# SERVER. The old `litellm[proxy]` extra dragged in the full proxy stack
+# (fastapi-sso, gunicorn, apscheduler, litellm-enterprise, mcp, ...) AND pinned
+# python-multipart, which combined with our python-multipart>=0.0.27 floor forced
+# a prerelease (1.88.0rc1). Plain litellm lets the resolver pick a STABLE release
+# and lets downstreams pin e.g. litellm>=1.83.11,<1.84.0 without the proxy extra.
+# CVE coverage (CVE-2026-35029/35030/42203/42271 + GHSA-69x8-hrgq-fjj8) is satisfied
+# by stable litellm >=1.83.7. Proxy-server deps now live in the optional `server` extra.
+litellm = ">=1.83.7,<2.0.0"
+# ---- Optional `server` extra (FastAPI-MCP service: `fastworkflow run_fastapi_mcp`) ----
+uvicorn = {version = ">=0.33.0", optional = true}
 fastapi = {version = ">=0.120.1", optional = true}
 fastapi-mcp = {version = "^0.4.0", optional = true}
-pyjwt = {extras = ["crypto"], version = ">=2.13.0", optional = true}  # Replaces python-jose (CVE-2024-23342); >=2.13.0 fixes alg allow-list bypass (PYSEC-2026-176) + DoS (PYSEC-2026-175/177/178/179). Needs litellm >=1.88 (the 1.88.0rc1 prerelease in the lock) which relaxes litellm's pyjwt==2.12.0 pin
+pyjwt = {extras = ["crypto"], version = ">=2.13.0", optional = true}  # Replaces python-jose (CVE-2024-23342); >=2.13.0 fixes alg allow-list bypass (PYSEC-2026-176) + DoS (PYSEC-2026-175/177/178/179)
+python-multipart = {version = ">=0.0.27", optional = true}  # CVE-2026-40347, CVE-2026-42561 (multipart parsing DoS). Only pulled by the `server` extra (FastAPI form parsing); not needed by the client/core install.
+starlette = {version = ">=0.49.1", optional = true}  # CVE-2025-62727, CVE-2025-54121 (Range header DoS). Pulled transitively by fastapi in the `server` extra.
 datasets = {version = "^4.0.0", optional = true}
 
-# Security floor constraints for transitive dependencies
-# These ensure users get patched versions even though these are not direct deps
+# Security floor constraints for transitive dependencies of the CORE (client) install.
+# These ensure users get patched versions even though these are not direct deps.
+# NOTE: floors that only applied to the litellm proxy SERVER (python-multipart,
+# pyjwt, uvicorn, starlette) are scoped to the `server` extra above. Floors that
+# only existed because `litellm[proxy]` pulled the package (mako -> alembic,
+# pynacl, fastapi-sso) have been dropped: with the proxy extra gone those packages
+# are no longer in the dependency graph for any fastworkflow install (core OR
+# server), so there is nothing to patch and no CVE regression.
 orjson = ">=3.11.6"      # CVE-2024-27454 (loads recursion) + CVE-2025-67221 (dumps recursion DoS, fixed in 3.11.6)
 urllib3 = ">=2.7.0"      # CVE-2025-66418, CVE-2025-66471 (decompression chain) + PYSEC-2026-141/142
 aiohttp = ">=3.13.4"     # CVE-2025-69223 + 7 others (zip bomb, DoS) + CVE-2026-22815/34513-34525 (3.13.4)
-starlette = ">=0.49.1"   # CVE-2025-62727, CVE-2025-54121 (Range header DoS)
 pyasn1 = ">=0.6.3"       # CVE-2026-23490 + CVE-2026-30922 (decoder DoS)
 filelock = ">=3.20.1"    # CVE-2025-68146 (TOCTOU symlink)
-pynacl = ">=1.6.2"       # CVE-2025-69277 (libsodium validation)
 cryptography = ">=46.0.7"  # CVE-2026-26007 + PYSEC-2026-35/36
 requests = ">=2.33.0"    # CVE-2026-25645 (extract_zipped_paths temp reuse)
 idna = ">=3.15"          # CVE-2026-45409
-mako = ">=1.3.12"        # CVE-2026-44307
-python-multipart = ">=0.0.27"  # CVE-2026-40347, CVE-2026-42561 (multipart parsing DoS)
 pygments = ">=2.20.0"    # CVE-2026-4539 (ReDoS in AdlLexer)
 pyarrow = ">=23.0.1"     # PYSEC-2026-113 (use-after-free; only via datasets/training extra)
-# NOTE: fastapi-sso CSRF vuln (CVE-2025-14546, needs >=0.19.0) now resolved - litellm 1.88.x relaxes its
-# fastapi-sso pin so the lock pulls fastapi-sso 0.21.0 (previously blocked by litellm <0.17.0)
 
 [tool.poetry.group.dev.dependencies]
 isort = "^5.13.2"
@@ -97,4 +109,9 @@ boto3 = {version = ">=1.36.0", optional = true}
 
 [tool.poetry.extras]
 training = ["datasets"]
-fastapi = ["uvicorn", "fastapi", "fastapi-mcp", "pyjwt"]
+# Full FastAPI-MCP server feature set (`fastworkflow run_fastapi_mcp`) with the
+# security-patched server deps. `litellm_proxy/` client routing does NOT require
+# this extra (plain litellm handles it via api_base).
+server = ["uvicorn", "fastapi", "fastapi-mcp", "pyjwt", "python-multipart", "starlette"]
+# Backward-compatible alias for the pre-2.18.2 extra name.
+fastapi = ["uvicorn", "fastapi", "fastapi-mcp", "pyjwt", "python-multipart", "starlette"]