fix: relax marshmallow-sqlalchemy version constraint to fix compatibility with marshmallow>=3.24

[sloria]

Description

Relax the upper marshmallow-sqlalchemy version constraint. This is necessary for compatibility with newer versions of marshmallow (>=3.24.0).

This would resolve this issue in Airflow: apache/airflow#45442 (comment)

This also upgrades a few dependencies needed for a working development environment (used pip-compile --upgrade-package ...).

ADDITIONAL INFORMATION

• Has associated issue: Add support for marshmallow-sqlalchemy 1.0.0 #2194
• Is CRUD MVC related.
• Is Auth, RBAC security related.
• Changes the security db schema.
• Introduces new feature
• Removes existing feature

[sloria]

given that marshmallow 4.0 will be released soon, i also think the version constraint for marshmallow should also be relaxed to marshmallow>=3.18.0, <5. upon quick review, i didn't see any usages within the code that would be broken by the changes in 4.0.

but this can happen as a follow-up

[potiuk]

Nice one - would be great to get it in :)

[sloria]

IMO we should remove the upper bound altogether

Suggested change

	"marshmallow-sqlalchemy>=0.22.0, <2.0.0",
	"marshmallow-sqlalchemy>=0.22.0",

to avoid issues like the one that Airflow ran into. since FAB is a library, its shouldn't impose such strict upper constraints on its dependencies and allow users to pin their own dependencies

[sloria]

i've relaxed the versions for both marshmallow and marshmallow-sqlachemy even further because there are major releases planned within the next month for both but neither should affect FAB