fix(checkpoint): specify allowed_objects in Reviver - #7743
Merged
Merged
Conversation
There was a problem hiding this comment.
Security Issues
- Deserialization of Untrusted Data — Unrestricted lc:1 Object Revival (Medium Confidence)
The change setsLC_REVIVER = Reviver(allowed_objects="all"), which removes object-level allowlist restrictions from the langchain_coreReviverused as a fallback inJsonPlusSerializer._reviver(). ThisReviverhandles lc:1-format JSON payloads (the older LangChain serialization format) and is reached for every JSON object that is not an lc:2 constructor. Withallowed_objects="all", any class registered in langchain_core's serializable namespace can be instantiated from legacy lc:1 checkpoint data without restriction. While lc:2 constructor revival is still gated by_revive_lc2/_check_allowed_json_modules, the lc:1 path throughLC_REVIVERis fully open. If an attacker can write or influence persisted checkpoint data containing lc:1-format payloads — for example via a database write, an API that accepts checkpoint blobs, or a compromised upstream service — they may be able to instantiate arbitrary registered LangChain objects on deserialization.
Recommendations
- Revert to
Reviver()(withoutallowed_objects="all") to restore object-level allowlist enforcement on lc:1 payloads. If the intent is to support a broader set of legacy types, enumerate them explicitly rather than using the blanket"all"value. Confirm which specific types triggered the change (e.g., a regression) and add them to theSAFE_MSGPACK_TYPES/allowed_json_modulespath instead.
ccurme (ccurme)
commented
May 8, 2026
| ) | ||
|
|
||
| LC_REVIVER = Reviver() | ||
| LC_REVIVER = Reviver(allowed_objects="core") |
Contributor
Author
There was a problem hiding this comment.
this has defaulted to "core" since late December: langchain-ai/langchain#34455
Eugene Yurtsev (eyurtsev)
approved these changes
May 8, 2026
Yijia Xiao (Yijia-Xiao)
added a commit
to TauricResearch/TradingAgents
that referenced
this pull request
May 10, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
SpaceRexxx
pushed a commit
to SpaceRexxx/TradingAgents-WebUI
that referenced
this pull request
May 11, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
helm168
pushed a commit
to helm168/TradingAgents
that referenced
this pull request
May 19, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
Vijay Rajagopal (virajago)
pushed a commit
to virajago/conviction
that referenced
this pull request
May 24, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
H (GearlessJoeL)
pushed a commit
to GearlessJoeL/TradingReportAgents
that referenced
this pull request
May 26, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
SpookyFox9
pushed a commit
to SpookyFox9/TradingAgents
that referenced
this pull request
May 30, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
shao1237
pushed a commit
to shao1237/TradingAgent
that referenced
this pull request
Jul 7, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
tclikang
pushed a commit
to tclikang/TradingAgents
that referenced
this pull request
Aug 30, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
Q1anye (lovits)
pushed a commit
to lovits/FINAgents
that referenced
this pull request
Sep 7, 2026
langgraph-checkpoint 4.0.3 calls Reviver() at module load without allowed_objects, printing a pending-deprecation warning at every CLI start. The upstream patch is merged (langchain-ai/langgraph#7743) but not released; no app-side seam fixes it. Install a surgical filter in package init (message regex + PendingDeprecationWarning category). Remove when we bump past langgraph-checkpoint 4.0.3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On langchain-core / master you will see warnings from importing things like
or
Here we address the warning.