[dependabot]

Bumps the backend group in /Folderly/Backend with 3 updates: apispec, marshmallow and sqlalchemy.

Updates apispec from 6.10.0 to 6.10.1

Changelog

Sourced from apispec's changelog.

6.10.1 (2026-11-03)

---

Bug fixes:

• Recognize trace operations defined in view docstrings, instead of silently dropping them (:pr:1059). Thanks :user:binggao1230 for the PR.
• Fix intersect OneOf and Equal choices in field2choices (:issue:198). Thanks :user:alexchen-sys for the PR.

Other changes:

• Drop support for marshmallow 3, which is EOL.
• Drop support for Python 3.10.
• Test against Python 3.15.

Commits

• 0560380 Bump version and update changelog
• bfebdae Support Python 3.11-3.15 (#1094)
• 8a22dae Update all dependencies (#1091)
• 99b63a5 Lock file maintenance (#1092)
• 0b66a26 [pre-commit.ci] pre-commit autoupdate (#1079)
• 9b70048 Update AUTHORS.rst
• 771fc7d Merge pull request #1059 from binggao1230/add-trace-to-path-keys
• 1cd742f Merge branch 'dev' into add-trace-to-path-keys
• 96e93e8 Update CHANGELOG
• 92e9dea Update AUTHORS.rst
• Additional commits viewable in compare view

Updates marshmallow from 4.3.1 to 4.4.0

Changelog

Sourced from marshmallow's changelog.

4.4.0 (2026-11-03)

Features:

• Simplify get_value to match actual usage (:pr:3024).

Bug fixes:

• Raise ValidationError <marshmallow.exceptions.ValidationError> (not ValueError) for NaN in TimeDelta <marshmallow.fields.TimeDelta> (:pr:3004). Thanks :user:vidigoat for the PR.
• Fix Pluck handling of empty data_key (:pr:3082).

Other changes:

• Drop support for Python 3.10.
• Test against Python 3.15.

Commits

• a38b7f6 Bump version and update changelog
• 88efe3e Support Python 3.11-3.15 (#3102)
• f988218 pre-commit autoupdate
• 70868ff Update all dependencies (#3097)
• d90ab58 Lock file maintenance (#3098)
• b762ea2 Update CHANGELOG
• 5761bea Fix Pluck handling of empty data_key
• d08471b [pre-commit.ci] pre-commit autoupdate
• 1c63bda Update astral-sh/setup-uv action to v10.2.0 (#3061)
• 1ed2773 Lock file maintenance (#3062)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.1.6 to 2.1.8

Release notes

Sourced from sqlalchemy's releases.

2.1.8

Released: November 3, 2026

general

• [general] [change] All files published to PyPI for a release, including the source distribution as well as all wheels, are now uploaded using PyPI's trusted publishing mechanism from SQLAlchemy's GitHub Actions workflow, and include a PEP 740 attestation, so that every file in a release carries provenance information. Previously, the source distribution and some wheels were uploaded without an attestation, which caused PyPI to display provenance warnings for recent releases.

  This change is also backported to: 2.0.57

  References: #13759

2.1.7

Released: November 3, 2026

orm

• [orm] [feature] Added _orm.SessionTransaction.connections and _orm.SessionTransaction.bound_connection(), which return the connections a _orm.SessionTransaction has already acquired, without acquiring a new one. This allows, for example, checking whether any connection in the transaction has been invalidated before emitting further SQL. A SAVEPOINT transaction returned by _orm.Session.begin_nested() reports only the connections used within that SAVEPOINT; the root transaction returned by _orm.Session.get_transaction() reports all connections. The same accessors are available on _asyncio.AsyncSessionTransaction, returning _asyncio.AsyncConnection objects. Pull request courtesy Artur Shiriev.

  References: #13685

• [orm] [bug] An informative InvalidRequestError is now raised when more than one PropComparator.of_type() loader option is applied along the same relationship using targets of differing classes, such as two _orm.aliased() constructs against different subclasses, which previously failed with a bare AssertionError during compilation. These options can't be combined since each target brings its own aliased copy of the base table; to load multiple subclasses along a single relationship, a single _orm.with_polymorphic() object that includes all of the target classes should be used.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions