[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
marshmallow (changelog)	==3.20.1 → ==3.26.2

---

Marshmallow has DoS in Schema.load(many)

CVE-2025-68480 / GHSA-428g-f7cq-pgp5

More information

Details

Impact

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

Patches

4.1.2, 3.26.2

Workarounds

##### Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5
• https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508
• https://nvd.nist.gov/vuln/detail/CVE-2025-68480
• https://github.com/advisories/GHSA-428g-f7cq-pgp5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

marshmallow-code/marshmallow (marshmallow)

v3.26.2

Compare Source

Bug fixes:

• :cve:2025-68480: Merge error store messages without rebuilding collections.
  Thanks 카푸치노 for reporting and :user:deckar01 for the fix.

v3.26.1

Compare Source

Bug fixes:

• Typing: Fix type annotations for class Meta <marshmallow.Schema.Meta> options (:issue:2804).
  Thanks :user:lawrence-law for reporting.

Other changes:

• Remove default value for the data param of Nested._deserialize <marshmallow.fields.Nested._deserialize> (:issue:2802).
  Thanks :user:gbenson for reporting.

v3.26.0

Compare Source

See :ref:upgrading_4_0 for a guide on updating your code.

Features:

• Typing: Add types to all Field <marshmallow.fields.Field> constructor kwargs (:issue:2285).
  Thanks :user:navignaw for the suggestion.
• DateTime <marshmallow.fields.DateTime>, Date <marshmallow.fields.Date>, Time <marshmallow.fields.Time>,
  TimeDelta <marshmallow.fields.TimeDelta>, and Enum <marshmallow.fields.Enum>
  accept their internal value types as valid input (:issue:1415).
  Thanks :user:bitdancer for the suggestion.
• @validates <marshmallow.validates> accepts multiple field names (:issue:1960).
  Backwards-incompatible: Decorated methods now receive data_key as a keyword argument.
  Thanks :user:dpriskorn for the suggestion and :user:dharani7998 for the PR.

Other changes:

• Typing: Field <marshmallow.fields.Field> is now a generic type with a type argument for the internal value type.

• marshmallow.fields.UUID no longer subclasses marshmallow.fields.String.

• marshmallow.Schema.load no longer silently fails to call schema validators when a generator is passed (:issue:1898).
  The typing of data is also updated to be more accurate.
  Thanks :user:ziplokk1 for reporting.

• Backwards-incompatible: Use datetime.date.fromisoformat, datetime.time.fromisoformat, and datetime.datetime.fromisoformat from the standard library to deserialize dates, times and datetimes (:pr:2078).
  As a consequence of this change:

  • Time with time offsets are now supported.
  • YYYY-MM-DD is now accepted as a datetime and deserialized as naive 00:00 AM.
  • from_iso_date, from_iso_time and from_iso_datetime are removed from marshmallow.utils.

• Remove isoformat, to_iso_time and to_iso_datetime from marshmallow.utils (:pr:2766).

• Remove from_rfc, and rfcformat from marshmallow.utils (:pr:2767).

• Remove is_keyed_tuple from marshmallow.utils (:pr:2768).

• Remove get_fixed_timezone from marshmallow.utils (:pr:2773).

• Backwards-incompatible: marshmallow.fields.Boolean no longer serializes non-boolean values (:pr:2725).

• Backwards-incompatible: Rename schema parameter to parent in marshmallow.fields.Field._bind_to_schema (:issue:1360).

• Backwards-incompatible: Rename pass_many parameter to pass_collection in pre/post processing methods (:issue:1369).

• Backwards-incompatible: marshmallow.fields.TimeDelta no longer truncates float values when
  deserializing (:pr:2654). This allows microseconds to be preserved, e.g.

.. code-block:: python

from marshmallow import fields

field = fields.TimeDelta()

Before

field.deserialize(12.9)
datetime.timedelta(seconds=12)

datetime.timedelta(seconds=12)

After

field.deserialize(12.9)

datetime.timedelta(seconds=12, microseconds=900000)

• Improve performance and minimize float precision loss of marshmallow.fields.TimeDelta serialization (:pr:2654).
• Backwards-incompatible: Remove serialization_type parameter from
  marshmallow.fields.TimeDelta (:pr:2654).

Thanks :user:ddelange for the PR.

• Backwards-incompatible: Remove Schema <marshmallow.schema.Schema>'s context attribute (deprecated since 3.24.0). Passing a context
  should be done using contextvars.ContextVar (:issue:1826).
  marshmallow 4 provides an experimental Context <marshmallow.experimental.context.Context>
  manager class that can be used to both set and retrieve context.

.. code-block:: python

import typing

from marshmallow import Schema, fields
from marshmallow.experimental.context import Context

class UserContext(typing.TypedDict):
    suffix: str

class UserSchema(Schema):
    name_suffixed = fields.Function(
        lambda obj: obj["name"] + Context[UserContext].get()["suffix"]
    )

with Context[UserContext]({"suffix": "bar"}):
    UserSchema().dump({"name": "foo"})

{'name_suffixed': 'foobar'}

• Methods decorated with marshmallow.pre_load, marshmallow.post_load, marshmallow.validates_schema,
  receive unknown as a keyword argument (:pr:1632).
  Thanks :user:jforand for the PR.
• Backwards-incompatible: Arguments to decorators <marshmallow.decorators> are keyword-only arguments.
• Backwards-incompatible: Rename json_data parameter of marshmallow.Schema.loads to s
  for compatibility with most render module implementations (json, simplejson, etc.) (:pr:2764).
  Also make it a positional-only argument.
• Incorrectly declaring a field using a field class rather than instance
  errors at class declaration time (previously happended when the schema was instantiated) (:pr:2772).
• Passing invalid values for unknown will cause an error in type checkers (:pr:2771).

Deprecations/Removals:

• Backwards-incompatible: Remove implicit field creation, i.e. using the fields or additional class Meta options with undeclared fields (:issue:1356).
• The ordered class Meta option is removed (:issue:2146). Field order is already preserved by default.
  Set Schema.dict_class to OrderedDict to maintain the previous behavior.
• The marshmallow.base module is removed (:pr:2722).

Previously-deprecated APIs have been removed, including:

• The ordered class Meta <marshmallow.Schema.Meta> option is removed (:issue:2146) (deprecated in 3.26.0).
• Backwards-incompatible: marshmallow.fields.Number is no longer usable as a field in a schema (deprecated in 3.24.0).
  Use marshmallow.fields.Integer, marshmallow.fields.Float, or marshmallow.fields.Decimal instead.
• Backwards-incompatible: marshmallow.fields.Mapping is no longer usable as a field in a schema (deprecated in 3.24.0).
• Backwards-incompatible: Custom validators must raise a ValidationError <marshmallow.exceptions.ValidationError> for invalid values (deprecated in 3.24.0).
  Returning False is no longer supported (:issue:1775).
  Use marshmallow.fields.Dict instead.
• Remove __version__, __parsed_version__, and __version_info__ attributes (deprecated in 3.21.0).
• default and missing parameters, which were replaced by dump_default and load_default in 3.13.0 (:pr:1742, :pr:2700).
• Passing field metadata via keyword arguments (deprecated in 3.10.0). Use the explicit metadata=...
  argument instead (:issue:1350).
• marshmallow.utils.pprint (deprecated in 3.7.0). Use pprint.pprint instead.
• Passing "self" to fields.Nested (deprecated in 3.3.0). Use a callable instead.
• Field.fail, which was replaced by Field.make_error in 3.0.0.
• json_module class Meta option (deprecated in 3.0.0b3). Use render_module instead.

v3.25.1

Compare Source

Bug fixes:

• Typing: Fix type annotations for Tuple <marshmallow.fields.Tuple>,
  Boolean <marshmallow.fields.Boolean>, and Pluck <marshmallow.fields.Pluck>
  constructors (:pr:2756).
• Typing: Fix overload for marshmallow.class_registry.get_class (:pr:2756).

Documentation:

• Various documentation improvements (:pr:2746, :pr:2747, :pr:2748, :pr:2749, :pr:2750, :pr:2751).

v3.25.0

Compare Source

Features:

• Typing: Improve type annotations for SchemaMeta.get_declared_fields (:pr:2742).

Bug fixes:

• Typing: Relax type annotation for Schema.opts to allow subclasses to define their own
  options classes (:pr:2744).

Other changes:

• Restore marshmallow.base.SchemaABC for backwards-compatibility (:issue:2743).
  Note that this class is deprecated and will be removed in marshmallow 4.
  Use marshmallow.schema.Schema as a base class for type-checking instead.

v3.24.2

Compare Source

Changes:

• Don't override __new__ to avoid breaking usages of inspect.signature with
  Field <marshmallow.fields.Field> classes.
  This allows marshmallow-sqlalchemy users to upgrade marshmallow without
  upgrading to marshmallow-sqlalchemy>=1.1.1.

Documentation:

• Add top-level API back to docs (:issue:2739).
  Thanks :user:llucax for reporting.

v3.24.1

Compare Source

Bug fixes:

• Typing: Fix typing for class_registry.get_class <marshmallow.class_registry.get_class> (:pr:2735).

v3.24.0

Compare Source

See :ref:upgrading_4_0 for a guide on updating your code.

Features:

• Typing: Add types to all Field <marshmallow.fields.Field> constructor kwargs (:issue:2285).
  Thanks :user:navignaw for the suggestion.
• DateTime <marshmallow.fields.DateTime>, Date <marshmallow.fields.Date>, Time <marshmallow.fields.Time>,
  TimeDelta <marshmallow.fields.TimeDelta>, and Enum <marshmallow.fields.Enum>
  accept their internal value types as valid input (:issue:1415).
  Thanks :user:bitdancer for the suggestion.
• @validates <marshmallow.validates> accepts multiple field names (:issue:1960).
  Backwards-incompatible: Decorated methods now receive data_key as a keyword argument.
  Thanks :user:dpriskorn for the suggestion and :user:dharani7998 for the PR.

Other changes:

• Typing: Field <marshmallow.fields.Field> is now a generic type with a type argument for the internal value type.

• marshmallow.fields.UUID no longer subclasses marshmallow.fields.String.

• marshmallow.Schema.load no longer silently fails to call schema validators when a generator is passed (:issue:1898).
  The typing of data is also updated to be more accurate.
  Thanks :user:ziplokk1 for reporting.

• Backwards-incompatible: Use datetime.date.fromisoformat, datetime.time.fromisoformat, and datetime.datetime.fromisoformat from the standard library to deserialize dates, times and datetimes (:pr:2078).
  As a consequence of this change:

  • Time with time offsets are now supported.
  • YYYY-MM-DD is now accepted as a datetime and deserialized as naive 00:00 AM.
  • from_iso_date, from_iso_time and from_iso_datetime are removed from marshmallow.utils.

• Remove isoformat, to_iso_time and to_iso_datetime from marshmallow.utils (:pr:2766).

• Remove from_rfc, and rfcformat from marshmallow.utils (:pr:2767).

• Remove is_keyed_tuple from marshmallow.utils (:pr:2768).

• Remove get_fixed_timezone from marshmallow.utils (:pr:2773).

• Backwards-incompatible: marshmallow.fields.Boolean no longer serializes non-boolean values (:pr:2725).

• Backwards-incompatible: Rename schema parameter to parent in marshmallow.fields.Field._bind_to_schema (:issue:1360).

• Backwards-incompatible: Rename pass_many parameter to pass_collection in pre/post processing methods (:issue:1369).

• Backwards-incompatible: marshmallow.fields.TimeDelta no longer truncates float values when
  deserializing (:pr:2654). This allows microseconds to be preserved, e.g.

.. code-block:: python

from marshmallow import fields

field = fields.TimeDelta()

Before

field.deserialize(12.9)
datetime.timedelta(seconds=12)

datetime.timedelta(seconds=12)

After

field.deserialize(12.9)

datetime.timedelta(seconds=12, microseconds=900000)

• Improve performance and minimize float precision loss of marshmallow.fields.TimeDelta serialization (:pr:2654).
• Backwards-incompatible: Remove serialization_type parameter from
  marshmallow.fields.TimeDelta (:pr:2654).

Thanks :user:ddelange for the PR.

• Backwards-incompatible: Remove Schema <marshmallow.schema.Schema>'s context attribute (deprecated since 3.24.0). Passing a context
  should be done using contextvars.ContextVar (:issue:1826).
  marshmallow 4 provides an experimental Context <marshmallow.experimental.context.Context>
  manager class that can be used to both set and retrieve context.

.. code-block:: python

import typing

from marshmallow import Schema, fields
from marshmallow.experimental.context import Context

class UserContext(typing.TypedDict):
    suffix: str

class UserSchema(Schema):
    name_suffixed = fields.Function(
        lambda obj: obj["name"] + Context[UserContext].get()["suffix"]
    )

with Context[UserContext]({"suffix": "bar"}):
    UserSchema().dump({"name": "foo"})

{'name_suffixed': 'foobar'}

• Methods decorated with marshmallow.pre_load, marshmallow.post_load, marshmallow.validates_schema,
  receive unknown as a keyword argument (:pr:1632).
  Thanks :user:jforand for the PR.
• Backwards-incompatible: Arguments to decorators <marshmallow.decorators> are keyword-only arguments.
• Backwards-incompatible: Rename json_data parameter of marshmallow.Schema.loads to s
  for compatibility with most render module implementations (json, simplejson, etc.) (:pr:2764).
  Also make it a positional-only argument.
• Incorrectly declaring a field using a field class rather than instance
  errors at class declaration time (previously happended when the schema was instantiated) (:pr:2772).
• Passing invalid values for unknown will cause an error in type checkers (:pr:2771).

Deprecations/Removals:

• Backwards-incompatible: Remove implicit field creation, i.e. using the fields or additional class Meta options with undeclared fields (:issue:1356).
• The ordered class Meta option is removed (:issue:2146). Field order is already preserved by default.
  Set Schema.dict_class to OrderedDict to maintain the previous behavior.
• The marshmallow.base module is removed (:pr:2722).

Previously-deprecated APIs have been removed, including:

• The ordered class Meta <marshmallow.Schema.Meta> option is removed (:issue:2146) (deprecated in 3.26.0).
• Backwards-incompatible: marshmallow.fields.Number is no longer usable as a field in a schema (deprecated in 3.24.0).
  Use marshmallow.fields.Integer, marshmallow.fields.Float, or marshmallow.fields.Decimal instead.
• Backwards-incompatible: marshmallow.fields.Mapping is no longer usable as a field in a schema (deprecated in 3.24.0).
• Backwards-incompatible: Custom validators must raise a ValidationError <marshmallow.exceptions.ValidationError> for invalid values (deprecated in 3.24.0).
  Returning False is no longer supported (:issue:1775).
  Use marshmallow.fields.Dict instead.
• Remove __version__, __parsed_version__, and __version_info__ attributes (deprecated in 3.21.0).
• default and missing parameters, which were replaced by dump_default and load_default in 3.13.0 (:pr:1742, :pr:2700).
• Passing field metadata via keyword arguments (deprecated in 3.10.0). Use the explicit metadata=...
  argument instead (:issue:1350).
• marshmallow.utils.pprint (deprecated in 3.7.0). Use pprint.pprint instead.
• Passing "self" to fields.Nested (deprecated in 3.3.0). Use a callable instead.
• Field.fail, which was replaced by Field.make_error in 3.0.0.
• json_module class Meta option (deprecated in 3.0.0b3). Use render_module instead.

v3.23.3

Compare Source

Bug fixes:

• Typing: Fix typing for Schema.from_dict <marshmallow.schema.Schema.from_dict> (:issue:1653).
  Thanks :user:SteadBytes for reporting.

Support:

• Documentation: Various documentation cleanups, including more concise docs in the marshmallow.fields API reference (:issue:2307).
  Thanks :user:AbdealiLoKo for reporting.

v3.23.2

Compare Source

Bug fixes:

• Improve type hint formatting for Field, Nested, and Function fields
  to resolve PyCharm warnings (:issue:2268).
  Thanks :user:Fares-Abubaker for reporting and fixing.

v3.23.1

Compare Source

Support:

• Document absolute parameter of URL field (:pr:2327).
• Documentation: Remove (outdated) minimum Python 3 minor version in
  documentation and README (:pr:2323).

v3.23.0

Compare Source

Features:

• Typing: replace "type" with specific metaclass for Schema and Field.

Other changes:

• Officially support Python 3.13 (:pr:2319).
• Drop support for Python 3.8 (:pr:2318).

v3.22.0

Compare Source

Features:

• Add many Meta option to Schema so it expects a collection by default (:issue:2270).
  Thanks :user:himalczyk for reporting and :user:deckar01 for the PR.
• Refactor hooks (:pr:2279).
  Thanks :user:deckar01 for the PR.

v3.21.3

Compare Source

Bug fixes:

• Fix memory leak that prevented schema instances from getting GC'd (:pr:2277).
  Thanks :user:mrcljx for the PR.

v3.21.2

Compare Source

Bug fixes:

• Allow timestamp 0 in fields.DateTime (:issue:2133).
  Thanks :user:flydzen for reporting.

v3.21.1

Compare Source

Bug fixes:

• Fix error message when field is declared as a class and not an instance (:issue:2245).
  Thanks :user:travnick for reporting.

v3.21.0

Compare Source

Bug fixes:

• Fix validation of URL fields to allow missing user field,
  per NWG RFC 3986 (:issue:2232). Thanks :user:ddennerline3 for reporting
  and :user:deckar01 for the PR.

Other changes:

• Backwards-incompatible: __version__, __parsed_version__, and __version_info__
  attributes are deprecated (:issue:2227). Use feature detection or
  importlib.metadata.version("marshmallow") instead.

v3.20.2

Compare Source

Bug fixes:

• Fix Nested field type hint for lambda Schema types (:pr:2164).
  Thanks :user:somethingnew2-0 for the PR.

Other changes:

• Officially support Python 3.12 (:pr:2188).
  Thanks :user:hugovk for the PR.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.