fix: stop default_from_dict from mutating the caller's data dict

[Vedant-Agarwal]

Related Issues

• Follow-up to the same input-mutation class as fix: give each FileContent its own extra dict in FileToFileContent #11872 (merged, FileToFileContent) and fix: prevent Answer.from_dict methods from mutating their input dict #11908 (Answer.from_dict), this time at the core serialization utility every component flows through.

Proposed Changes:

default_from_dict() took a reference to data["init_parameters"] and then, while auto-deserializing nested objects, replaced the serialized sub-dicts with their live instances in place:

init_params = data.get("init_parameters", {})   # reference into the caller's dict
...
init_params[key] = Secret.from_dict(value)       # mutates data["init_parameters"] in place

So after Component.from_dict(data) (which routes through default_from_dict), the caller's data is silently corrupted — its serialized Secret / ComponentDevice / nested-component dicts are swapped for live objects. A second deserialization of the same data, or any later re-serialization / comparison, then misbehaves.

PipelineBase.from_dict already deep-copies data before deserializing precisely to avoid this; the public default_from_dict / component_from_dict utilities did not. The fix copies init_parameters before mutating it (shallow is enough — only its top-level keys are reassigned).

How did you test it?

• Added test_component_from_dict_does_not_mutate_input, which deserializes a dict containing a serialized Secret and asserts (a) the returned component is correct and (b) the input dict is unchanged (data == deepcopy(data) taken before the call). It fails on main (the input's api_key sub-dict becomes an EnvVarSecret) and passes with the fix.
• python -m pytest test/core/test_serialization.py → all green (23 tests).
• ruff check / ruff format --check clean on both files.

Notes for the reviewer

Minimal one-line change at the single choke point (component_from_dict delegates here), so it covers every path. This complements #11908's dataclass-level fix by closing the same leak in the core utility.

This PR was written with the help of an AI assistant. I have reviewed the changes and run the relevant tests locally.

Checklist

• I have read the contributors guidelines and the code of conduct.
• Conventional commit type in the PR title (fix:).
• I have added a unit test and documented the change.
• I have added a release note file.

[vercel]

@Vedant-Agarwal is attempting to deploy a commit to the deepset Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack/core
serialization.py
Project Total

This report was generated by python-coverage-comment-action

[zeweihan]

@/tmp/gh_comment_85.md

[anakin87]

Thank you!