{"record":{"id":"0b1ef58d094c4246","repo":"langchain-ai/langchain","slug":"deserialization-of-mapping-key-r-is-not-allowed","errorCode":null,"errorMessage":"Deserialization of {mapping_key!r} is not allowed. The default (allowed_objects='core') only permits core langchain-core classes. To allow trusted partner integrations, use allowed_objects='all'. Alternatively, pass an explicit list of allowed classes via allowed_objects=[...]. See langchain_core.load.mapping for the full allowlist.","messagePattern":"Deserialization of (.+?) is not allowed\\. The default \\(allowed_objects='core'\\) only permits core langchain-core classes\\. To allow trusted partner integrations, use allowed_objects='all'\\. Alternatively, pass an explicit list of allowed classes via allowed_objects=\\[\\.\\.\\.\\]\\. See langchain_core\\.load\\.mapping for the full allowlist\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"libs/core/langchain_core/load/load.py","lineNumber":518,"sourceCode":"            and value.get(\"type\") == \"constructor\"\n            and value.get(\"id\") is not None\n        ):\n            [*namespace, name] = value[\"id\"]\n            mapping_key = tuple(value[\"id\"])\n\n            if (\n                self.allowed_class_paths is not None\n                and mapping_key not in self.allowed_class_paths\n            ):\n                msg = (\n                    f\"Deserialization of {mapping_key!r} is not allowed. \"\n                    \"The default (allowed_objects='core') only permits core \"\n                    \"langchain-core classes. To allow trusted partner integrations, \"\n                    \"use allowed_objects='all'. Alternatively, pass an explicit list \"\n                    \"of allowed classes via allowed_objects=[...]. \"\n                    \"See langchain_core.load.mapping for the full allowlist.\"\n                )\n                raise ValueError(msg)\n\n            if (\n                namespace[0] not in self.valid_namespaces\n                # The root namespace [\"langchain\"] is not a valid identifier.\n                or namespace == [\"langchain\"]\n            ):\n                msg = f\"Invalid namespace: {value}\"\n                raise ValueError(msg)\n            # Determine explicit import path\n            if mapping_key in self.import_mappings:\n                import_path = self.import_mappings[mapping_key]\n                # Split into module and name\n                import_dir, name = import_path[:-1], import_path[-1]\n            elif namespace[0] in DISALLOW_LOAD_FROM_PATH:\n                msg = (\n                    \"Trying to deserialize something that cannot \"\n                    \"be deserialized in current version of langchain-core: \"\n                    f\"{mapping_key}.\"","sourceCodeStart":500,"sourceCodeEnd":536,"githubUrl":"https://github.com/langchain-ai/langchain/blob/e32fa9a52eab3b61ad7a45399bfde59b3e580fc4/libs/core/langchain_core/load/load.py#L500-L536","documentation":"Allowlist enforcement error from the Reviver: the serialized object's class path (mapping_key) is not in the set of permitted class paths. Default loads() behavior (allowed_objects='core') only permits langchain-core classes; partner classes like langchain_openai must be opted in. This exists because deserialization imports and instantiates arbitrary code paths, so it is a security boundary.","triggerScenarios":"loads(dumps(chat_openai_chain)) using default settings — the payload contains ['langchain_openai', ...] which is outside core; also fires when an explicit allowed_objects=[...] list omits a nested class used inside the payload.","commonSituations":"Serializing a chain in one service and loading it in another with default flags; upgrading to a LangChain version where the restricted allowlist became the default; explicit allowlists that forget a nested component (e.g. allows the prompt but not the message class).","solutions":["If the payload is trusted, load with allowed_objects='all'","Or extend the explicit allowlist: allowed_objects=[ChatOpenAI, PromptTemplate, ...] covering every class in the payload","Check langchain_core.load.mapping (e.g. SERIALIZABLE_MAPPING / import_mappings) for the exact class paths in your payload and add each one"],"exampleFix":"# before\nchain = loads(serialized)  # default allowed_objects='core'\n# after\nchain = loads(serialized, allowed_objects='all')  # trusted payloads only","handlingStrategy":"validation","validationCode":"from langchain_core.load.mapping import SERIALIZABLE_MAPPING\nimport json\npayload = json.loads(text)\nused_paths = {tuple(n['id']) for n in iter_constructor_nodes(payload)}\nmissing = used_paths - SERIALIZABLE_MAPPING.keys()\nif missing:\n    # widen allowlist accordingly\n    ...","typeGuard":null,"tryCatchPattern":"try:\n    obj = loads(text)\nexcept ValueError as e:\n    if 'not allowed' in str(e) and source_is_trusted:\n        obj = loads(text, allowed_objects='all')\n    else:\n        raise","preventionTips":["Treat serialized chains like code: only load from trusted sources","Standardize on allowed_objects='all' (trusted) or an explicit complete class list in your loader","After adding a new component to a chain, re-run the loads smoke test — nested classes need allowlisting too"],"tags":["security","deserialization","allowlist","load"],"backgroundTag":null,"analyzedSha":"e32fa9a52eab3b61ad7a45399bfde59b3e580fc4","analyzedAt":"2026-08-14T18:42:09.092Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}