Upgrading marshmallow 1 to 2
Breaking1.2.6 → 2.21.0Breaking30Security1Platform3Deprecated13New45Changed22Fixed79Other14
SecurityFixes behavior when an empty list is passed as the only argument (CVE-2018-17175).GHSA-9q2p-fj49-vpxj · CVE-2018-17175 ↗
BreakingUpgrade verdict
29 breaking changes and 3 platform requirement changes and a security fix.
In plain terms
- Three attributes that were never used have been removed from the base schema class.
- The Query and QuerySelect field types no longer exist, so schemas using them must be updated.
- You can no longer give a string as the value of required or allow_none to customize the error message; use error_messages instead.
- Code that catches these two error classes will no longer work.
Must act Top 5 of 45 that need code or config changes
What you must change
Breaking29
Removes unused attributes root, parent, and name from SchemaABC.
SchemaABCrootparentnameRemoves the Query and QuerySelect fields.
QueryQuerySelectRemoves passing strings to required and allow_none; pass the error_messages argument instead.
requiredallow_noneerror_messagesRemoves the UnmarshallingError and MarshallingError exceptions.
UnmarshallingErrorMarshallingErrorRemoves make_object; use a post_load method instead.
make_objectpost_loadRemoves the error parameter and attribute of Field.
FielderrorRemoves Arbitrary, Fixed, and Price fields; use Decimal instead.
ArbitraryFixedPriceDecimalRemoves Select and Enum fields; use the OneOf validator instead.
SelectEnumOneOfRemoves marshmallow.compat.plain_function since it is no longer used.
marshmallow.compat.plain_functionRenames the raw parameter of the pre_*, post_*, and validates_schema decorators to pass_many.
pre_loadpre_dumppost_loadpost_dumpvalidates_schemarawpass_manyRemoves utils.get_callable_name.
utils.get_callable_nameRemoves legacy validator functions in favor of class-based validators in marshmallow.validate.
marshmallow.validateRemoves the skip_missing class Meta option; missing inputs are excluded from serialized output by default.
skip_missingRemoves the optional context parameter passed to methods for Method fields.
MethodcontextRemoves utils.get_func_name; use utils.get_callable_name instead.
utils.get_func_nameutils.get_callable_nameBy default, NaN, Infinity, and -Infinity are invalid values for fields.Decimal; pass allow_nan=True to allow them.
fields.Decimalallow_nanRemoves the allow_null parameter of fields.Nested.
fields.Nestedallow_nullFields now raise a ValidationError on None input by default; the allow_none parameter overrides this.
ValidationErrorallow_noneRemoves ForcedError.
ForcedErrorRemoves support for generator functions that yield validators; plain generators of validators are still supported.
Removes the null value.
nullReplaces error_handler and accessor options with the handle_error and get_attribute methods.
error_handleraccessorhandle_errorget_attributeNon-collection values are now invalid input for the List field.
Listfields.Field._deserialize now takes attr and data as arguments.
fields.Field._deserializeRemoves Schema.validator, Schema.preprocessor, and Schema.data_handler.
Schema.validatorSchema.preprocessorSchema.data_handlervalidates_schemapre_loadpost_dumpRemoves implicit passing of original raw data to Schema validators; use validates_schema(pass_original=True).
marshmallow.validates_schemapass_originalWhen many=True, dump and load error dictionaries are keyed on indices of invalid items; index_errors=False in Meta disables this.
manydumploadindex_errorsMetaField default is only used when explicitly set and the value is missing in Schema.dump input; otherwise the key is omitted.
FielddefaultSchema.dumpfields.Strfields.IntRemoves the legacy pre-1.0 Schema.data and Schema.errors properties.
Schema.dataSchema.errorsSecurity1
Fixes behavior when an empty list is passed as the only argument (CVE-2018-17175).
onlyPlatform3
Drops support for Python 3.4.
Drops official support for Python 2.6.
Drops support for Python 3.3.
Deprecations to plan for
Deprecated12
Raises a RemovedInMarshmallow3 warning when fields.FormattedString is used; use fields.Method or fields.Function instead.
RemovedInMarshmallow3fields.FormattedStringfields.Methodfields.FunctionAdds warnings for functions in marshmallow.utils that are removed in marshmallow 3.
marshmallow.utilsRenames the func argument of fields.Function to serialize.
fields.FunctionfuncserializeRenames the method_name argument of fields.Method to serialize.
fields.Methodmethod_nameserializeDeprecates the extra parameter of Schema; add extra data in a post_load method instead.
Schemaextrapost_loadPassing string arguments to required and allow_none is deprecated; pass the error_messages argument instead, removal planned for 2.2.
requiredallow_noneerror_messagesDeprecates the Schema.accessor and Schema.error_handler decorators in favor of Meta options.
Schema.accessorSchema.error_handlerDeprecates QuerySelect and QuerySelectList, to be removed in version 2.1.
QuerySelectQuerySelectListDeprecates Schema.validator in favor of marshmallow.validates_schema.
Schema.validatormarshmallow.validates_schemaMarshallingError and UnmarshallingError are deprecated in favor of a single ValidationError.
MarshallingErrorUnmarshallingErrorValidationErrorThe context argument passed to Method fields is deprecated; use self.context instead.
contextMethodself.contextDeprecates the Select/Enum field in favor of the validate.OneOf validator.
SelectEnumvalidate.OneOfAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
export MarshallingError - removed:
export Serializer - removed:
export UnmarshallingError - added:
export fields - added:
export missing - added:
export post_dump - added:
export post_load - added:
export pre_dump - added:
export pre_load - added:
export validates - added:
export validates_schema
- removed:
function total_seconds(td) - removed:
variable OrderedDict - added:
function get_func_args(func) - added:
variable zip_longest
- changed:
function post_dump(fn=…, raw=…) → function post_dump(fn=…, pass_many=…, pass_original=…) - changed:
function post_load(fn=…, raw=…) → function post_load(fn=…, pass_many=…, pass_original=…) - changed:
function pre_dump(fn=…, raw=…) → function pre_dump(fn=…, pass_many=…) - changed:
function pre_load(fn=…, raw=…) → function pre_load(fn=…, pass_many=…) - changed:
function tag_processor(tag_name, fn, raw) → function tag_processor(tag_name, fn, pass_many, **kwargs) - added:
function validates(field_name) - added:
function validates_schema(fn=…, pass_many=…, pass_original=…, skip_on_field_errors=…) - added:
variable VALIDATES - added:
variable VALIDATES_SCHEMA
- removed:
class ForcedError(_WrappingException) - removed:
class MarshallingError(_WrappingException) - removed:
class UnmarshallingError(_WrappingException) - changed:
class RegistryError(ForcedError, NameError) → class RegistryError(NameError) - changed:
constructor ValidationError(message, field=…) → constructor ValidationError(message, field_names=…, fields=…, data=…, **kwargs) - added:
method ValidationError.normalized_messages(no_field_name=…)
- removed:
class Arbitrary(Number) - removed:
class Fixed(Number) - removed:
class Marshaller(object) - removed:
class Price(Fixed) - removed:
class QuerySelect(Field) - removed:
class QuerySelectList(QuerySelect) - removed:
class Select(Field) - removed:
class Unmarshaller(object) - removed:
constructor Arbitrary(default=…, attribute=…, **kwargs) - removed:
constructor Fixed(decimals=…, default=…, attribute=…, error=…, *args, **kwargs) - removed:
constructor Integer(default=…, *args, **kwargs) - removed:
constructor Marshaller(prefix=…) - removed:
constructor Price(decimals=…, default=…, **kwargs) - removed:
constructor QuerySelect(query, keygetter, error=…, **kwargs) - removed:
constructor Select(choices, default=…, attribute=…, error=…, **kwargs) - removed:
constructor String(default=…, attribute=…, *args, **kwargs) - removed:
constructor Unmarshaller() - removed:
field Field.SKIPPABLE_VALUES - removed:
field FormattedString.SKIPPABLE_VALUES - removed:
field List.SKIPPABLE_VALUES - removed:
field String.SKIPPABLE_VALUES - removed:
method Marshaller.serialize(obj, fields_dict, many=…, strict=…, skip_missing=…, accessor=…, dict_class=…) - removed:
method Number.serialize(attr, obj, accessor=…) - removed:
method QuerySelect.keys() - removed:
method QuerySelect.labels(labelgetter=…) - removed:
method QuerySelect.pairs() - removed:
method QuerySelect.results() - removed:
method Unmarshaller.deserialize(data, fields_dict, many=…, validators=…, preprocess=…, postprocess=…, strict=…, dict_class=…) - removed:
variable Enum - removed:
variable missing - removed:
variable null - changed:
class Email(ValidatedField) → class Email(ValidatedField, String) - changed:
class Url(ValidatedField) → class Url(ValidatedField, String) - changed:
constructor DateTime(format=…, default=…, attribute=…, **kwargs) → constructor DateTime(format=…, **kwargs) - changed:
constructor Decimal(places=…, rounding=…, default=…, as_string=…, **kwargs) → constructor Decimal(places=…, rounding=…, allow_nan=…, as_string=…, **kwargs) - changed:
constructor Field(default=…, attribute=…, error=…, validate=…, required=…, **metadata) → constructor Field(default=…, attribute=…, load_from=…, dump_to=…, error=…, validate=…, required=…, allow_none=…, load_only=…, dump_only=…, missing=…, error_messages=…, **metadata) - changed:
constructor Function(func, deserialize=…, **kwargs) → constructor Function(serialize=…, deserialize=…, func=…, **kwargs) - changed:
constructor List(cls_or_instance, default=…, allow_none=…, **kwargs) → constructor List(cls_or_instance, **kwargs) - changed:
constructor Method(method_name, deserialize=…, **kwargs) → constructor Method(serialize=…, deserialize=…, method_name=…, **kwargs) - changed:
constructor Nested(nested, default=…, exclude=…, only=…, allow_null=…, many=…, **kwargs) → constructor Nested(nested, default=…, exclude=…, only=…, **kwargs) - changed:
constructor Number(default=…, attribute=…, as_string=…, error=…, **kwargs) → constructor Number(as_string=…, **kwargs) - changed:
constructor Url(default=…, attribute=…, relative=…, *args, **kwargs) → constructor Url(relative=…, schemes=…, **kwargs) - changed:
method Field.deserialize(value) → method Field.deserialize(value, attr=…, data=…) - changed:
method Field.get_value(attr, obj, accessor=…) → method Field.get_value(attr, obj, accessor=…, default=…) - added:
class Constant(Field) - added:
class Dict(Field) - added:
constructor Constant(constant, **kwargs) - added:
constructor TimeDelta(precision=…, error=…, **kwargs) - added:
field Boolean.default_error_messages - added:
field Date.default_error_messages - added:
field DateTime.DATEFORMAT_DESERIALIZATION_FUNCS - added:
field DateTime.DATEFORMAT_SERIALIZATION_FUNCS - added:
field DateTime.default_error_messages - added:
field Decimal.default_error_messages - added:
field Dict.default_error_messages - added:
field Email.default_error_messages - added:
field Field.default_error_messages - added:
field FormattedString.default_error_messages - added:
field Integer.default_error_messages - added:
field List.default_error_messages - added:
field Number.default_error_messages - added:
field String.default_error_messages - added:
field Time.default_error_messages - added:
field TimeDelta.DAYS - added:
field TimeDelta.MICROSECONDS - added:
field TimeDelta.SECONDS - added:
field TimeDelta.default_error_messages - added:
field UUID.default_error_messages - added:
field Url.default_error_messages - added:
method Field.fail(key, **kwargs) - added:
method List.get_value(attr, obj, accessor=…) - added:
property Field.root
- changed:
method Marshaller.serialize(obj, fields_dict, many=…, strict=…, skip_missing=…, accessor=…, dict_class=…, index_errors=…, index=…) → method Marshaller.serialize(obj, fields_dict, many=…, accessor=…, dict_class=…, index_errors=…, index=…) - changed:
method Unmarshaller.deserialize(data, fields_dict, many=…, validators=…, preprocess=…, postprocess=…, strict=…, dict_class=…, index_errors=…, index=…) → method Unmarshaller.deserialize(data, fields_dict, many=…, partial=…, dict_class=…, index_errors=…, index=…) - added:
field Unmarshaller.default_schema_validation_error - added:
method Unmarshaller.run_validator(validator_func, output, original_data, fields_dict, index=…, many=…, pass_original=…)
- changed:
class OrderedSet(collections.MutableSet) → class OrderedSet(MutableSet)
- removed:
field SchemaMeta.FUNC_LISTS - removed:
method BaseSchema.make_object(data) - removed:
property BaseSchema.data - removed:
property BaseSchema.errors - removed:
static method BaseSchema.data_handler(func) - removed:
static method BaseSchema.preprocessor(func) - removed:
static method BaseSchema.validator(func) - removed:
variable Serializer - changed:
constructor BaseSchema(obj=…, extra=…, only=…, exclude=…, prefix=…, strict=…, many=…, skip_missing=…, context=…) → constructor BaseSchema(extra=…, only=…, exclude=…, prefix=…, strict=…, many=…, context=…, load_only=…, dump_only=…, partial=…) - changed:
method BaseSchema.load(data, many=…) → method BaseSchema.load(data, many=…, partial=…) - changed:
method BaseSchema.validate(data, many=…) → method BaseSchema.validate(data, many=…, partial=…) - added:
constructor SchemaMeta(name, bases, attrs) - added:
method BaseSchema.get_attribute(attr, obj, default) - added:
method BaseSchema.handle_error(error, data) - added:
method BaseSchema.on_bind_field(field_name, field_obj) - added:
static method SchemaMeta.get_declared_fields(klass, cls_fields, inherited_fields, dict_cls)
- removed:
class BaseSerializer(base.SchemaABC) - removed:
class BaseSerializer.Meta(object) - removed:
class Serializer(with_metaclass(SerializerMeta, BaseSerializer)) - removed:
class SerializerMeta(type) - removed:
class SerializerOpts(object) - removed:
constructor BaseSerializer(obj=…, extra=…, only=…, exclude=…, prefix=…, strict=…, many=…, context=…) - removed:
constructor SerializerOpts(meta) - removed:
field BaseSerializer.OPTIONS_CLASS - removed:
field BaseSerializer.TYPE_MAPPING - removed:
method BaseSerializer.is_valid(field_names=…) - removed:
method BaseSerializer.to_json(*args, **kwargs) - removed:
property BaseSerializer.data - removed:
property BaseSerializer.errors - removed:
property BaseSerializer.json - removed:
static method BaseSerializer.data_handler(func) - removed:
static method BaseSerializer.error_handler(func) - removed:
static method BaseSerializer.factory(*args, **kwargs) - removed:
static method SerializerMeta.get_declared_fields(bases, attrs, field_class)
- removed:
function get_callable_name(func) - removed:
function get_func_args(func) - removed:
function get_func_name(func) - added:
function if_none(value, default) - added:
function set_value(dct, key, value) - added:
variable get_func_args - added:
variable missing
- removed:
field URL.RELATIVE_URL_REGEX - removed:
field URL.URL_REGEX - removed:
function email(value, error=…) - removed:
function equal(value, comparable, error=…) - removed:
function length(value, min=…, max=…, error=…) - removed:
function predicate(value, method, error=…, **kwargs) - removed:
function ranging(value, min=…, max=…, error=…) - removed:
function regexp(value, regex, flags=…, error=…) - removed:
function url(value, relative=…, error=…) - changed:
class Email(object) → class Email(Validator) - changed:
class Equal(object) → class Equal(Validator) - changed:
class NoneOf(object) → class NoneOf(Validator) - changed:
class Predicate(object) → class Predicate(Validator) - changed:
class Range(object) → class Range(Validator) - changed:
class Regexp(object) → class Regexp(Validator) - changed:
class URL(object) → class URL(Validator) - changed:
constructor URL(relative=…, error=…) → constructor URL(relative=…, error=…, schemes=…, require_tld=…) - added:
class ContainsOnly(OneOf) - added:
class OneOf(Validator) - added:
class URL.RegexMemoizer(object) - added:
class Validator(object) - added:
constructor Length(min=…, max=…, error=…, equal=…) - added:
constructor OneOf(choices, labels=…, error=…) - added:
constructor URL.RegexMemoizer() - added:
field ContainsOnly.default_message - added:
field Email.default_message - added:
field Equal.default_message - added:
field Length.message_equal - added:
field NoneOf.default_message - added:
field OneOf.default_message - added:
field Predicate.default_message - added:
field Regexp.default_message - added:
field URL.default_message - added:
field URL.default_schemes - added:
method OneOf.options(valuegetter=…)
- added:
class ChangedInMarshmallow3Warning(FutureWarning) - added:
class RemovedInMarshmallow3Warning(DeprecationWarning) - added:
function unused_and_removed_in_ma3(f)