Marshmallow 4.0.0 breaks safety check

[brabster]

Checklist

• I agree to the terms within the Safety Code of Conduct.

Safety version

Latest 3.3.1

Python version

3.11, 3.12, 3.13

Operating System

Linux variants

Describe the problem you'd like to have solved

safety check is currently broken, confirmed on multiple builds and multiple python versions.

+===========================================================================================================================================================================================+

DEPRECATED: this command (check) has been DEPRECATED, and will be unsupported beyond 01 June 2024.

We highly encourage switching to the new scan command which is easier to use, more powerful, and can be set up to mimic the deprecated command if required.

+===========================================================================================================================================================================================+

Unhandled exception happened: post_dump() got an unexpected keyword argument 'pass_many'

Describe the ideal solution

Issue appears related to marshmallow dependency, 4.0.0 release appears to contain breaking changes for safety. Pinning the dependency back fixes the problem for me locally.

Alternatives and current workarounds

marshmallow has a to be removed flag, removing it should solve the issue too but probably a bigger task.

Additional context

Will submit PR

What I Did

See above.

[github-actions]

Hi @brabster, thank you for opening this issue!

We appreciate your effort in reporting this. Our team will review it and get back to you soon.
If you have any additional details or updates, feel free to add them to this issue.

Note: If this is a serious security issue that could impact the security of Safety CLI users, please email security@safetycli.com immediately.

Thank you for contributing to Safety CLI!

[yeisonvargasf]

Hi thanks for reporting this issue, this is a duplicate of #711, which was already addressed in the codebase and will be released in the next stable Safety version (hopefully this week), a workaround is also suggested in #711 (comment)

[brabster]

Ah, thanks for explaining! FYI I looked in open issues (as it's very much an open issue from where I'm standing) and so didn't find it. I can see why you'd consider it closed from your perspective, but it would have helped me to leave the issue open until released.

Without any criticism intended - a quicker patch release for this breaking issue would also have seemed justified, given the fix is already in the codebase and as far as I can tell, anyone who installs or updates safety since Apr 17 is going to be broken? I've seen this kind of pattern before where this kind of breaking change becomes known and the maintainers choose to wait for a larger bundle release instead of fixing the problem. I'd like to understand better, could you explain why safetycli decided not to push this fix out as soon as it was ready?

[yeisonvargasf]

Ah, thanks for explaining! FYI I looked in open issues (as it's very much an open issue from where I'm standing) and so didn't find it. I can see why you'd consider it closed from your perspective, but it would have helped me to leave the issue open until released.

Yes, GitHub auto-closed the issue once we merged the PR. We're sorry about that. We'll improve this type of thing in the medium term.

Without any criticism intended - a quicker patch release for this breaking issue would also have seemed justified, given the fix is already in the codebase and as far as I can tell, anyone who installs or updates safety since Apr 17 is going to be broken? I've seen this kind of pattern before where this kind of breaking change becomes known and the maintainers choose to wait for a larger bundle release instead of fixing the problem. I'd like to understand better, could you explain why safetycli decided not to push this fix out as soon as it was ready?

We want to push this as soon as possible. We have a single-trunk/main branch for simplicity in development, and we always move forward to fix issues (we don't backport fixes). So this time, we are making major refactors. We want to be careful not to ship breaking changes into legacy features like the check command and others, so we want to review the latest beta state a bit more.

The latest beta contains the fix for this issue: https://pypi.org/project/safety/3.4.0b8/

Another reason is that users should install Safety outside of their projects to easily constrain the Marshmallow version in that configuration.

It's a trade-off, also, we expect this won't happen in the medium term as we'll test our dependencies against dev branches to detect this type of breaking behavior early on.

[yeisonvargasf]

@brabster Safety 3.4.0 is out and contains the fix for this. I'll close this issue. Feel free to open a new one if the fix is incomplete or another problem appears.

Thanks for the PR effort and contribution! 🤝