Accepting request 1241185 from devel:languages:python

- Update to 3.0.1 (bsc#1109179, CVE-2018-17175):

OBS-URL: https://build.opensuse.org/request/show/1241185
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-marshmallow?expand=0&rev=27

CVE-2025-68480.patch

@@ -1,106 +0,0 @@
-From 0356a3f1c307830f8ded56d823abca5611c594c9 Mon Sep 17 00:00:00 2001
-From: Jared Deckard <jared@shademaps.com>
-Date: Thu, 18 Dec 2025 23:57:28 -0600
-Subject: [PATCH 1/4] Merge error store messages without rebuilding collections
-
----
- src/marshmallow/error_store.py | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-Index: marshmallow-3.20.2/src/marshmallow/error_store.py
-===================================================================
---- marshmallow-3.20.2.orig/src/marshmallow/error_store.py
-+++ marshmallow-3.20.2/src/marshmallow/error_store.py
-@@ -18,12 +18,19 @@ class ErrorStore:
-         # field error  -> store/merge error messages under field name key
-         # schema error -> if string or list, store/merge under _schema key
-         #              -> if dict, store/merge with other top-level keys
-+        messages = copy_containers(messages)
-         if field_name != SCHEMA or not isinstance(messages, dict):
-             messages = {field_name: messages}
-         if index is not None:
-             messages = {index: messages}
-         self.errors = merge_errors(self.errors, messages)
- 
-+def copy_containers(errors):
-+    if isinstance(errors, list):
-+        return [copy_containers(val) for val in errors]
-+    if isinstance(errors, dict):
-+        return {key: copy_containers(val) for key, val in errors.items()}
-+    return errors
- 
- def merge_errors(errors1, errors2):
-     """Deeply merge two error messages.
-@@ -37,24 +44,26 @@ def merge_errors(errors1, errors2):
-         return errors1
-     if isinstance(errors1, list):
-         if isinstance(errors2, list):
--            return errors1 + errors2
-+            errors1.extend(errors2)
-+            return errors1
-         if isinstance(errors2, dict):
--            return dict(errors2, **{SCHEMA: merge_errors(errors1, errors2.get(SCHEMA))})
--        return errors1 + [errors2]
-+            errors2[SCHEMA] = merge_errors(errors1, errors2.get(SCHEMA))
-+            return errors2
-+        errors1.append(errors2)
-+        return errors1
-     if isinstance(errors1, dict):
--        if isinstance(errors2, list):
--            return dict(errors1, **{SCHEMA: merge_errors(errors1.get(SCHEMA), errors2)})
-         if isinstance(errors2, dict):
--            errors = dict(errors1)
-             for key, val in errors2.items():
--                if key in errors:
--                    errors[key] = merge_errors(errors[key], val)
-+                if key in errors1:
-+                    errors1[key] = merge_errors(errors1[key], val)
-                 else:
--                    errors[key] = val
--            return errors
--        return dict(errors1, **{SCHEMA: merge_errors(errors1.get(SCHEMA), errors2)})
-+                    errors1[key] = val
-+            return errors1
-+        errors1[SCHEMA] = merge_errors(errors1.get(SCHEMA), errors2)
-+        return errors1
-     if isinstance(errors2, list):
--        return [errors1] + errors2
-+        return [errors1, *errors2]
-     if isinstance(errors2, dict):
--        return dict(errors2, **{SCHEMA: merge_errors(errors1, errors2.get(SCHEMA))})
-+        errors2[SCHEMA] = merge_errors(errors1, errors2.get(SCHEMA))
-+        return errors2
-     return [errors1, errors2]
-Index: marshmallow-3.20.2/tests/test_error_store.py
-===================================================================
---- marshmallow-3.20.2.orig/tests/test_error_store.py
-+++ marshmallow-3.20.2/tests/test_error_store.py
-@@ -1,7 +1,7 @@
- from collections import namedtuple
- 
- from marshmallow import missing
--from marshmallow.error_store import merge_errors
-+from marshmallow.error_store import merge_errors, ErrorStore
- 
- 
- def test_missing_is_falsy():
-@@ -141,3 +141,19 @@ class TestMergeErrors:
-         assert {"field1": {"field2": ["error1", "error2"]}} == merge_errors(
-             {"field1": {"field2": "error1"}}, {"field1": {"field2": "error2"}}
-         )
-+
-+    def test_list_not_changed(self):
-+        store = ErrorStore()
-+        message = ["foo"]
-+        store.store_error(message)
-+        store.store_error(message)
-+        assert message == ["foo"]
-+        assert store.errors == {"_schema": ["foo", "foo"]}
-+
-+    def test_dict_not_changed(self):
-+        store = ErrorStore()
-+        message = {"foo": ["bar"]}
-+        store.store_error(message)
-+        store.store_error(message)
-+        assert message == {"foo": ["bar"]}
-+        assert store.errors == {"foo": ["bar", "bar"]}

python-marshmallow.changes

@@ -1,8 +1,3 @@
--------------------------------------------------------------------
-Fri Jan  9 15:08:39 UTC 2026 - Nico Krapp <nico.krapp@suse.com>
-
-- Add CVE-2025-68480.patch to fix CVE-2025-68480 (bsc#1255473)
-
 -------------------------------------------------------------------
 Sun Oct 27 22:54:09 UTC 2024 - Stefan Brüns <stefan.bruens@rwth-aachen.de>
 
@@ -251,7 +246,7 @@ Wed Sep 11 12:45:35 UTC 2019 - Tomáš Chvátal <tchvatal@suse.com>
 -------------------------------------------------------------------
 Mon Aug 26 14:10:28 UTC 2019 - Marketa Calabkova <mcalabkova@suse.com>
 
-- Update to 3.0.1
+- Update to 3.0.1 (bsc#1109179, CVE-2018-17175):
   * Many changes, some of them breaking. For example:
   * Remove support for Python 2 (#1120). Only Python>=3.5 is supported.
   * Allow input value to be included in error messages for a number of fields.

python-marshmallow.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-marshmallow
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -27,8 +27,6 @@ URL:            https://marshmallow.readthedocs.io/
 Source:         https://files.pythonhosted.org/packages/source/m/marshmallow/marshmallow-%{version}.tar.gz
 # https://github.com/humitos/sphinx-version-warning/issues/22
 Patch0:         python-marshmallow-no-version-warning.patch
-# PATCH-FIX-UPSTREAM CVE-2025-68480.patch bsc#1255473
-Patch1:         CVE-2025-68480.patch
 BuildRequires:  %{python_module autodocsumm}
 BuildRequires:  %{python_module base >= 3.8}
 BuildRequires:  %{python_module pip}