chore(deps): update dependency marshmallow to v3.26.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
marshmallow (changelog)	==3.13.0 → ==3.26.2

GitHub Vulnerability Alerts

CVE-2025-68480

Impact

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

Patches

4.1.2, 3.26.2

Workarounds

# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

---

Release Notes

marshmallow-code/marshmallow (marshmallow)

v3.26.2

Compare Source

Bug fixes:

• :cve:2025-68480: Merge error store messages without rebuilding collections.
  Thanks 카푸치노 for reporting and :user:deckar01 for the fix.

v3.26.1

Compare Source

v3.26.0

Compare Source

v3.25.1

Compare Source

v3.25.0

Compare Source

v3.24.2

Compare Source

v3.24.1

Compare Source

v3.24.0

Compare Source

v3.23.3

Compare Source

v3.23.2

Compare Source

v3.23.1

Compare Source

v3.23.0

Compare Source

v3.22.0

Compare Source

v3.21.3

Compare Source

v3.21.2

Compare Source

v3.21.1

Compare Source

v3.21.0

Compare Source

v3.20.2

Compare Source

v3.20.1

Compare Source

v3.20.0

Compare Source

v3.19.0

Compare Source

v3.18.0

Compare Source

Features:

• Add Enum field (:pr:2017) and (:pr:2044).

Bug fixes:

• Fix typing in Field._serialize signature (:pr:2046).

v3.17.1

Compare Source

Bug fixes:

• Add return type to fields.Email.__init__ (:pr:2018).
  Thanks :user:kkirsche for the PR.
• Add missing type hint to IPInterface init (:pr:2036).

v3.17.0

Compare Source

Features:

• Support serialization as float in TimeDelta field (:pr:1998).
  Thanks :user:marcosatti for the PR.
• Add messages_dict property to ValidationError to facilitate type checking
  (:pr:1976).
  Thanks :user:sirosen for the PR.

v3.16.0

Compare Source

Features:

• Raise ValueError if an invalid value is passed to the unknown
  argument (:issue:1721, :issue:1732).
  Thanks :user:sirosen for the PR.

Other changes:

• Set lower bound for packaging requirement (:issue:1957).
  Thanks :user:MatthewNicolTR for reporting and thanks :user:sirosen for the PR.
• Improve warning messages by passing stacklevel (:pr:1986).
  Thanks :user:tirkarthi for the PR.

v3.15.0

Compare Source

Features:

• Allow passing a dict to fields.Nested (:pr:1935).
  Thanks :user:sirosen for the PR.

Other changes:

• Address distutils deprecation warning in Python 3.10 (:pr:1903).
  Thanks :user:kkirsche for the PR.
• Add py310 to black target-version (:pr:1921).
• Drop support for Python 3.6 (:pr:1923).
• Use postponed evaluation of annotations (:pr:1932).
  Thanks :user:Isira-Seneviratne for the PR.

v3.14.1

Compare Source

Bug fixes:

• Fix publishing type hints per PEP-561 <https://www.python.org/dev/peps/pep-0561/>_
  (:pr:1905). Thanks :user:bwindsor for the catch and patch.

v3.14.0

Compare Source

Bug fixes:

• Fix fields.TimeDelta serialization precision (:issue:1865).
  Thanks :user:yarsanich for reporting.

Other changes:

• Fix type-hints for data arg in Schema.validate to accept
  list of dictionaries (:issue:1790, :pr:1868).
  Thanks :user:yourun-proger for PR.
• Improve warning when passing metadata as keyword arguments (:pr:1882).
  Thanks :user:traherom for the PR.
• Don't build universal wheels. We don't support Python 2 anymore.
  (:issue:1860) Thanks :user:YKdvd for reporting.
• Make the build reproducible (:pr:1862).
• Drop support for Python 3.5 (:pr:1863).
• Test against Python 3.10 (:pr:1888).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.