fix(core): add init validator and serialization mappings for Bedrock models

[Michael Chin (michaelnchin)]

Adds serialization mappings for ChatBedrockConverse and BedrockLLM to unblock standard tests on langchain-core>=1.2.5 (context: langchain-aws#821). Also introduces a class-specific validator system in langchain_core.load that blocks deserialization of AWS Bedrock models when endpoint_url or base_url parameters are present, preventing SSRF attacks via crafted serialized payloads.

Closes #34645

Changes

• Add ChatBedrockConverse and BedrockLLM entries to SERIALIZABLE_MAPPING in mapping.py, mapping legacy paths to their langchain_aws import locations
• Add validators.py with _bedrock_validator — rejects deserialization kwargs containing endpoint_url or base_url for all Bedrock-related classes (ChatBedrock, BedrockChat, ChatBedrockConverse, ChatAnthropicBedrock, BedrockLLM, Bedrock)
• CLASS_INIT_VALIDATORS registry covers both serialized (legacy) keys and resolved import paths from ALL_SERIALIZABLE_MAPPINGS, preventing bypass via direct-path payloads
• Move kwargs extraction and all validator checks (CLASS_INIT_VALIDATORS + init_validator) in Reviver.__call__ to run before importlib.import_module() — fail fast on security violations before executing third-party code
• Class-specific validators are independent of init_validator and cannot be disabled by passing init_validator=None

Testing

• test_validator_registry_keys_in_serializable_mapping — structural invariant test ensuring every CLASS_INIT_VALIDATORS key exists in ALL_SERIALIZABLE_MAPPINGS
• 10 end-to-end load() tests covering all Bedrock class paths (legacy aliases, resolved import paths, ChatAnthropicBedrock, init_validator=None bypass attempt)
• Unit tests for _bedrock_validator covering endpoint_url, base_url, both params, and safe kwargs

[codspeed-hq]

Merging this PR will improve performance by 30.14%

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 12 untouched benchmarks
⏩ 27 skipped benchmarks¹

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	WallTime	test_async_callbacks_in_sync	19.5 ms	15 ms	+30.14%

---

_{Comparing michaelnchin:chatbedrockconverse-ser-mapping (60c1998) with master (e94cd41)}

Footnotes

1. 27 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[Mason Daugherty (mdrxy)]

ChatBedrockConverse makes network calls during __init__ (via get_inference_profile() in model validators), and the destination is attacker-controllable through the endpoint_url/base_url kwarg. Adding this class to trusted serialization mappings enables SSRF attacks when deserializing untrusted data—an attacker can craft a payload that forces the server to make HTTP requests to arbitrary endpoints, potentially exfiltrating AWS credentials on EC2/Lambda instances with IAM roles. We should probably add an init_validator. See default_init_validator in load.py for more info.

[Michael Chin (michaelnchin)]

Thank you for the feedback Mason Daugherty (@mdrxy) !

I've added a custom _bedrock_validator in a new validators.py file, which also builds out a more general CLASS_INIT_VALIDATORS object containing additional class<->validator mappings, to be used by load alongside default_init_validator. Also, I've applied to the validator to the existing BedrockLLM and ChatBedrock mappings, as they appear to have the same endpoint_url/base_url vector.