fix(deps): Update security vulnerability in marshmallow to v3.26.2 [SECURITY]

[utic-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
marshmallow (changelog)	==3.26.1 → ==3.26.2

GitHub Vulnerability Alerts

CVE-2025-68480

Impact

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

Patches

4.1.2, 3.26.2

Workarounds

# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

---

Release Notes

marshmallow-code/marshmallow (marshmallow)

v3.26.2

Compare Source

Bug fixes:

• :cve:2025-68480: Merge error store messages without rebuilding collections.
  Thanks 카푸치노 for reporting and :user:deckar01 for the fix.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[utic-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Command failed: bash /tmp/renovate-security-bump.sh
/tmp/renovate-security-bump.sh: line 1: $'{\r': command not found
/tmp/renovate-security-bump.sh: line 2: message:: command not found
/tmp/renovate-security-bump.sh: line 3: documentation_url:: command not found
/tmp/renovate-security-bump.sh: line 4: status:: command not found
/tmp/renovate-security-bump.sh: line 5: syntax error near unexpected token `}'
/tmp/renovate-security-bump.sh: line 5: `}'

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​marshmallow@​3.26.1 ⏵ 3.26.2	+1	+2

View full report

[utic-renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (==3.26.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.