fix: stop ConditionalRouter and BranchJoiner from_dict from mutating the caller's data

[simpleqt]

Problem

ConditionalRouter.from_dict and BranchJoiner.from_dict write deserialization results back into the caller's dict:

routes = init_params.get("routes")
for route in routes:
    route["output_type"] = deserialize_type(route["output_type"])   # mutates caller's route dicts
...
init_params["custom_filters"][name] = deserialize_callable(filter_func)   # mutates caller's dict

data["init_parameters"]["type_"] = deserialize_type(data["init_parameters"]["type_"])   # BranchJoiner

The core framework already established this is harmful — haystack/core/serialization.py deliberately copies init_parameters first, with a comment: "Copy so that replacing serialized sub-objects ... does not mutate the caller's data dict in place. Without this, a second deserialization of the same dict would receive already-parsed objects." These two components bypass that protection.

Consequence — loading the same serialized dict twice (a common "load pipeline definition once, rebuild components per request" pattern) crashes:

d = router.to_dict()
ConditionalRouter.from_dict(d)
ConditionalRouter.from_dict(d)
# TypeError: 'type' object is not iterable        (ConditionalRouter)
BranchJoiner.from_dict(bd); BranchJoiner.from_dict(bd)
# TypeError: can only concatenate str (not "types.GenericAlias") to str   (BranchJoiner)

and after the first from_dict the serialized data is corrupted (d["init_parameters"]["routes"][0]["output_type"] is a type object, not the serialized string).

Fix

Apply the same copy discipline the core serializer uses, in both components: shallow-copy init_parameters (and the route dicts / custom filters map) before replacing serialized values with parsed ones, and pass the copy to default_from_dict. The caller's dict is left untouched and repeated deserialization works.

Test plan

• TestBranchJoinerDeserialization::test_from_dict_does_not_mutate_caller_data
• TestConditionalRouterDeserialization::test_from_dict_does_not_mutate_caller_data

Both assert the serialized dict is unchanged after from_dict and that a second from_dict succeeds. Both fail on main and pass with this change (red/green verified). All 50 pre-existing tests in the two files still pass; ruff check + format (0.16.0) clean.

[vercel]

@simpleqt is attempting to deploy a commit to the deepset Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[davidsbatista]

@simpleqt thanks for the contribution, can you please make the CI green, afterwards we can start a review

[simpleqt]

CI is green-able now (pushed): the for route in routes: loop is only reached when routes exist (fixes the mypy union-attr), the new test's routes are typed as list[Route] (fixes the mypy arg-type), and the missing release-notes file is added. Local: 46 router + 6 joiner tests pass, mypy clean on both touched files.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack/components/joiners
branch.py
haystack/components/routers
conditional_router.py
Project Total

This report was generated by python-coverage-comment-action

[julian-risch]

Thanks @simpleqt ! Looks good to me! I made some smaller changes and the PR is ready to be merged now.
if you're curious, reno release note had no hash suffix, when the data has no custom_filters, it passed custom_filters={} to init instead of leaving the key out, and I shortened the comments in the code.