fix: validate non-string keys in nested dicts during component serialization

[Vedant-Agarwal]

Related Issues

• N/A — a self-contained serialization-validation bug found by code review (independent of the recently-merged default_from_dict fix, though it happens to live in the same module).

Proposed Changes:

_validate_component_to_dict_output walks a component's serialized data and rejects non-string keys (which don't round-trip through JSON). Its inner check_dict(d) is recursive, but the non-string-key check iterated the outer closure variable data (the top-level dict) instead of its own parameter d:

def check_dict(d: dict[str, Any]) -> None:
    if any(not isinstance(k, str) for k in data):   # <-- checks the top-level dict every time
        raise SerializationError(...)
    ...
    elif isinstance(v, dict):
        check_dict(v)                                 # recurses, but the guard ignores v's keys

So only the top-level keys were ever checked. A non-string key inside a nested init_parameters value (e.g. {"mapping": {1: "a"}}) passed validation and could later fail opaquely at YAML/JSON marshal time — exactly what this validator exists to catch early. Fix: check the recursed dict's own keys (for k in d).

How did you test it?

• Added test_component_to_dict_nested_non_string_key, which serializes a component whose init_parameters contains a nested {1: "a"} and asserts component_to_dict raises SerializationError. It fails on main (DID NOT RAISE) and passes with the fix.
• python -m pytest test/core/test_serialization.py → all green (27 tests).
• ruff check / ruff format --check clean on both files.

Notes for the reviewer

One-word fix (data → d) restoring the intended recursive validation; the value-type check on the same recursion already used v correctly, so only the key check was affected.

This PR was written with the help of an AI assistant. I have reviewed the changes and run the relevant tests locally.

Checklist

• I have read the contributors guidelines and the code of conduct.
• Conventional commit type in the PR title (fix:).
• I have added a unit test and documented the change.
• I have added a release note file.

[vercel]

@Vedant-Agarwal is attempting to deploy a commit to the deepset Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack/core
serialization.py
haystack/core/pipeline
pipeline.py
Project Total

This report was generated by python-coverage-comment-action

[anakin87]

Good catch.

I explored this repo and core integrations and could not find any cases where applying this fix would be problematic.