ebecdddb1b
Adds serialization mappings for `ChatBedrockConverse` and `BedrockLLM` to unblock standard tests on `langchain-core>=1.2.5` (context: [langchain-aws#821](https://github.com/langchain-ai/langchain-aws/pull/821)). Also introduces a class-specific validator system in `langchain_core.load` that blocks deserialization of AWS Bedrock models when `endpoint_url` or `base_url` parameters are present, preventing SSRF attacks via crafted serialized payloads. Closes #34645 ## Changes - Add `ChatBedrockConverse` and `BedrockLLM` entries to `SERIALIZABLE_MAPPING` in `mapping.py`, mapping legacy paths to their `langchain_aws` import locations - Add `validators.py` with `_bedrock_validator` — rejects deserialization kwargs containing `endpoint_url` or `base_url` for all Bedrock-related classes (`ChatBedrock`, `BedrockChat`, `ChatBedrockConverse`, `ChatAnthropicBedrock`, `BedrockLLM`, `Bedrock`) - `CLASS_INIT_VALIDATORS` registry covers both serialized (legacy) keys and resolved import paths from `ALL_SERIALIZABLE_MAPPINGS`, preventing bypass via direct-path payloads - Move kwargs extraction and all validator checks (`CLASS_INIT_VALIDATORS` + `init_validator`) in `Reviver.__call__` to run **before** `importlib.import_module()` — fail fast on security violations before executing third-party code - Class-specific validators are independent of `init_validator` and cannot be disabled by passing `init_validator=None` ## Testing - `test_validator_registry_keys_in_serializable_mapping` — structural invariant test ensuring every `CLASS_INIT_VALIDATORS` key exists in `ALL_SERIALIZABLE_MAPPINGS` - 10 end-to-end `load()` tests covering all Bedrock class paths (legacy aliases, resolved import paths, `ChatAnthropicBedrock`, `init_validator=None` bypass attempt) - Unit tests for `_bedrock_validator` covering `endpoint_url`, `base_url`, both params, and safe kwargs --------- Co-authored-by: Mason Daugherty <mason@langchain.dev> Co-authored-by: Mason Daugherty <github@mdrxy.com>
🦜🍎️ LangChain Core
Looking for the JS/TS version? Check out LangChain.js.
To help you ship LangChain apps to production faster, check out LangSmith. LangSmith is a unified developer platform for building, testing, and monitoring LLM applications.
Quick Install
pip install langchain-core
🤔 What is this?
LangChain Core contains the base abstractions that power the LangChain ecosystem.
These abstractions are designed to be as modular and simple as possible.
The benefit of having these abstractions is that any provider can implement the required interface and then easily be used in the rest of the LangChain ecosystem.
⛰️ Why build on top of LangChain Core?
The LangChain ecosystem is built on top of langchain-core. Some of the benefits:
- Modularity: We've designed Core around abstractions that are independent of each other, and not tied to any specific model provider.
- Stability: We are committed to a stable versioning scheme, and will communicate any breaking changes with advance notice and version bumps.
- Battle-tested: Core components have the largest install base in the LLM ecosystem, and are used in production by many companies.
📖 Documentation
For full documentation, see the API reference. For conceptual guides, tutorials, and examples on using LangChain, see the LangChain Docs. You can also chat with the docs using Chat LangChain.
📕 Releases & Versioning
See our Releases and Versioning policies.
💁 Contributing
As an open-source project in a rapidly developing field, we are extremely open to contributions, whether it be in the form of a new feature, improved infrastructure, or better documentation.
For detailed information on how to contribute, see the Contributing Guide.