[SECURITY] Update dependency marshmallow to v4.1.2

[specmatic-builder]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
marshmallow (changelog)	==4.1.1 → ==4.1.2

GitHub Vulnerability Alerts

CVE-2025-68480

Impact

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

Patches

4.1.2, 3.26.2

Workarounds

# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

---

Marshmallow has DoS in Schema.load(many)

CVE-2025-68480 / GHSA-428g-f7cq-pgp5

More information

Details

Impact

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

Patches

4.1.2, 3.26.2

Workarounds

##### Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5
• https://nvd.nist.gov/vuln/detail/CVE-2025-68480
• https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508
• https://github.com/marshmallow-code/marshmallow

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

marshmallow-code/marshmallow (marshmallow)

v4.1.2

Compare Source

Bug fixes:

• :cve:2025-68480: Merge error store messages without rebuilding collections.
  Thanks 카푸치노 for reporting and :user:deckar01 for the fix.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot. Specmatic specific configuration is managed here.