Bump marshmallow from 3.26.2 to 4.0.1

[dependabot]

Bumps marshmallow from 3.26.2 to 4.0.1.

Changelog

Sourced from marshmallow's changelog.

4.0.1 (2025-08-28)

Bug fixes:

• Fix wildcard import of from marshmallow import * (:pr:2823). Thanks :user:Florian-Laport for the PR.

4.0.0 (2025-04-16)

See :ref:upgrading_4_0 for a guide on updating your code.

Features:

• Typing: Add types to all Field <marshmallow.fields.Field> constructor kwargs (:issue:2285). Thanks :user:navignaw for the suggestion.
• DateTime <marshmallow.fields.DateTime>, Date <marshmallow.fields.Date>, Time <marshmallow.fields.Time>, TimeDelta <marshmallow.fields.TimeDelta>, and Enum <marshmallow.fields.Enum> accept their internal value types as valid input (:issue:1415). Thanks :user:bitdancer for the suggestion.
• @validates <marshmallow.validates> accepts multiple field names (:issue:1960). Backwards-incompatible: Decorated methods now receive data_key as a keyword argument. Thanks :user:dpriskorn for the suggestion and :user:dharani7998 for the PR.

Other changes:

• Typing: Field <marshmallow.fields.Field> is now a generic type with a type argument for the internal value type.

• marshmallow.fields.UUID no longer subclasses marshmallow.fields.String.

• marshmallow.Schema.load no longer silently fails to call schema validators when a generator is passed (:issue:1898). The typing of data is also updated to be more accurate. Thanks :user:ziplokk1 for reporting.

• Backwards-incompatible: Use datetime.date.fromisoformat, datetime.time.fromisoformat, and datetime.datetime.fromisoformat from the standard library to deserialize dates, times and datetimes (:pr:2078). As a consequence of this change:

  • Time with time offsets are now supported.
  • YYYY-MM-DD is now accepted as a datetime and deserialized as naive 00:00 AM.
  • from_iso_date, from_iso_time and from_iso_datetime are removed from marshmallow.utils.

• Remove isoformat, to_iso_time and to_iso_datetime from marshmallow.utils (:pr:2766).

• Remove from_rfc, and rfcformat from marshmallow.utils (:pr:2767).

• Remove is_keyed_tuple from marshmallow.utils (:pr:2768).

• Remove get_fixed_timezone from marshmallow.utils (:pr:2773).

• Backwards-incompatible: marshmallow.fields.Boolean no longer serializes non-boolean values (:pr:2725).

• Backwards-incompatible: Rename schema parameter to parent in marshmallow.fields.Field._bind_to_schema (:issue:1360).

• Backwards-incompatible: Rename pass_many parameter to pass_collection in pre/post processing methods (:issue:1369).

• Backwards-incompatible: marshmallow.fields.TimeDelta no longer truncates float values when deserializing (:pr:2654). This allows microseconds to be preserved, e.g.

... (truncated)

Commits

• 757714b Bump version and update changelog
• 407c2c5 Remove incorrect documentaion of field_name param (#2846)
• 8c83dd6 Bump sphinxext-opengraph from 0.11.0 to 0.12.0 (#2844)
• 24225a3 Bump sphinxext-opengraph from 0.10.0 to 0.11.0 (#2843)
• 172f40f [pre-commit.ci] pre-commit autoupdate
• b84d50b Add edit button to docs (#2841)
• 7008262 Bump furo from 2024.8.6 to 2025.7.19 (#2837)
• 2feeda7 docs: fix tuple spelling mistake (#2838)
• 0c1dd99 Update pre-commit deps (#2840)
• 7266de0 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[cycode-security]

❗Cycode: Security vulnerability found in newly introduced dependency.

Risk Score	30 (MEDIUM)
Severity	Medium
Issue	Marshmallow has DoS in Schema.load(many): CVE-2025-68480
Ecosystem	PyPI
Dependency	marshmallow
Dependency Paths	marshmallow 4.0.1
Direct Dependency	Yes
Development Dependency	No
Upgrade	4.1.2

Impact

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

Patches

4.1.2, 3.26.2

Workarounds

# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_ignore_package_everywhere <reason>	Applies to this manifest for this package for all requests in your repository
#cycode_ignore_package_here <reason>	Applies to this manifest for this package in this request only
#cycode_ignore_manifest_here <reason>	Applies to this manifest in this request only
#cycode_vulnerable_package_fix_this_violation	Fix this violation via a commit to this branch

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

[omer-roth]

@dependabot recreate

[dependabot]

Looks like marshmallow is no longer updatable, so this is no longer needed.