Skip to content

chore(deps): bump marshmallow from 3.26.2 to 4.3.0#39751

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/marshmallow-4.3.0
Open

chore(deps): bump marshmallow from 3.26.2 to 4.3.0#39751
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/marshmallow-4.3.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 29, 2026 •
edited
Loading

Bumps marshmallow from 3.26.2 to 4.3.0.

Changelog

Sourced from marshmallow's changelog.

4.3.0 (2026-04-03)

Features:

  • Add pre_load and post_load parameters to marshmallow.fields.Field for field-level pre- and post-processing (:issue:2787).
  • Typing: improvements to marshmallow.validate (:pr:2940).

4.2.4 (2026-04-02)

Bug fixes:

  • marshmallow.validate.URL and marshmallow.validate.Email accept Internationalized Domain Names (IDNs) (:issue:2821, :issue:2936). marshmallow.validate.Email also correctly rejects IDN domains with leading/trailing hyphens. Thanks :user:touhidurrr for the report.
  • Typing: Fix typing of nested in marshmallow.fields.Nested (:pr:2935).

4.2.3 (2026-03-25)

Bug fixes:

  • Make marshmallow.fields.Number and marshmallow.fields.Mapping abstract base classes to prevent using them within Schemas (:issue:2924). Thanks :user:MartingaleCoda for reporting.
  • Allow required to be set on marshmallow.fields.Contant (:issue:2900). Thanks :user:nosnickid for the report and :user:worksbyfriday for the PR.
  • Fix marshmallow.validate.OneOf emitting extra pairs when labels outnumber choices (:issue:2869). Thanks: user:T90REAL for the report and :user:rstar327 for the PR.
  • Fix behavior when passing a dot-delimited attribute name to partial for a key with data_key set (:pr:2903). Thanks :user:bysiber for the PR.
  • Fix Enum field by-name lookup to only return actual members (:pr:2902). Thanks :user:bysiber for the PR.
  • marshmallow.fields.DateTime with format="timestamp_ms" properly rejects bool values (:pr:2904). Thanks :user:bysiber for the PR.
  • Fix typing of error_messages argument to marshmallow.fields.Field (:pr:1636). Thanks :user:repole for reporting and :user:dhruvildarji for the PR.

Other changes:

  • Add ipaddress.* to marshmallow.Schema.TYPE_MAPPING (:issue:1695). Thanks :user:liberforce for the suggestion and :user:dhruvildarji for the PR.

4.2.2 (2026-02-04)

Bug fixes:

  • Fix behavior of fields.Contant(None) (:issue:2868).

... (truncated)

Commits

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 29, 2026

Labels

The following labels could not be found: pip. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@bito-code-review
Copy link
Copy Markdown
Contributor

bito-code-review Bot commented Apr 29, 2026 •
edited
Loading

Code Review Agent Run #01009f

Actionable Suggestions - 0
Review Details
  • Files reviewed - 1 · Commit Range: ff090bd..ff090bd
    • pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@dependabot dependabot Bot force-pushed the dependabot/pip/marshmallow-4.3.0 branch from ff090bd to 9fdc81d Compare April 30, 2026 13:14
Copilot AI reviewed Apr 30, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Superset’s Python dependency constraints to permit installing Marshmallow 4.x (including 4.3.0), aligning with the Dependabot upgrade intent.

Changes:

  • Relax marshmallow upper bound in pyproject.toml from <4 to <5.

Comment thread pyproject.toml
@@ -68,7 +68,7 @@ dependencies = [
"Mako>=1.2.2",
"markdown>=3.0",
# marshmallow>=4 has issues: https://github.com/apache/superset/issues/33162
Copy link

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says marshmallow>=4 has known issues (linking to #33162), but the dependency range is now relaxed to allow marshmallow 4.x (<5). Either update/remove this comment with a rationale/updated link (e.g., if the issue is resolved), or keep the upper bound at <4 if the issue still applies—right now the comment contradicts the constraint.

Suggested change
# marshmallow>=4 has issues: https://github.com/apache/superset/issues/33162

Copilot uses AI. Check for mistakes.
Comment thread pyproject.toml
"markdown>=3.0",
# marshmallow>=4 has issues: https://github.com/apache/superset/issues/33162
"marshmallow>=3.0, <4",
"marshmallow>=3.0, <5",
Copy link

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR claims to bump marshmallow to 4.3.0, but the repo’s pinned requirements (used by CI/CD and Docker) are generated into requirements/*.txt and currently still pin marshmallow==3.26.2. To make the bump effective, regenerate and commit the pinned requirements (e.g., run ./scripts/uv-pip-compile.sh) so CI/Docker actually test and ship marshmallow 4.3.0.

Copilot uses AI. Check for mistakes.
@bito-code-review
Copy link
Copy Markdown
Contributor

bito-code-review Bot commented May 1, 2026 •
edited
Loading

Code Review Agent Run #c13c24

Actionable Suggestions - 0
Review Details
  • Files reviewed - 1 · Commit Range: 9fdc81d..9fdc81d
    • pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@dependabot
chore(deps): bump marshmallow from 3.26.2 to 4.3.0
cd8c41d 
Bumps [marshmallow](https://github.com/marshmallow-code/marshmallow) from 3.26.2 to 4.3.0.
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@3.26.2...4.3.0)

---
updated-dependencies:
- dependency-name: marshmallow
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/pip/marshmallow-4.3.0 branch from 9fdc81d to cd8c41d Compare May 11, 2026 17:23
@bito-code-review
Copy link
Copy Markdown
Contributor

bito-code-review Bot commented May 11, 2026 •
edited
Loading

Code Review Agent Run #e50290

Actionable Suggestions - 0
Review Details
  • Files reviewed - 1 · Commit Range: cd8c41d..cd8c41d
    • pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@rusackas rusackas requested a review from sadpandajoe May 20, 2026 17:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@betodealmeida betodealmeida Awaiting requested review from betodealmeida

@michael-s-molina michael-s-molina Awaiting requested review from michael-s-molina

@villebro villebro Awaiting requested review from villebro

@sadpandajoe sadpandajoe Awaiting requested review from sadpandajoe

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependabot size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant