1.0.122

Security: fixes GHSA-j7p8-g5m6-3wv5 — the deep-research search/fetch tools cached Meta Ads records in a process-global dict with no caller scoping, so under --transport streamable-http one caller could read another caller's cached ad-account, campaign, ad, page and business records. Upgrade recommended for any multi-caller self-hosted deployment. See SECURITY.md for operator action items.

What's changed

• fix(security): remove the openai_deep_research module and its search / fetch tools (#162). Measured against production traffic the pair had no working use left — every fetch call returned "Record not found" or a schema-validation error — so the tools were removed rather than the cache re-keyed per caller. Regression tests assert neither tool is registered again.
• Clients that used these should use the typed tools instead: get_ad_accounts, get_campaigns, get_campaign_details, get_adsets, get_ads, get_ad_details.

Full changelog: 1.0.121...1.0.122