Fix URL validator rejecting a fragment after an empty path (#3016)

* Fix URL validator rejecting a fragment after an empty path

`validate.URL` rejected absolute URLs whose fragment follows an empty
path with no query, such as `https://example.com#frag`. RFC 3986 permits
a fragment after an empty path, and anchor links to a domain root are
common in practice.

Allow `#` to introduce the URL tail so the fragment is accepted. This
also makes a bare `#frag` valid in relative mode, matching the existing
handling of a bare `?query`.

* Add changelog entry for URL fragment fix (:pr:`3016`)

* Remove explanatory comment per review

* credit

---------

Co-authored-by: Steven Loria <git@stevenloria.com>

Author: hdimer

AUTHORS.rst

@@ -188,3 +188,4 @@ Contributors (chronological)
 - `@rstar327 <https://github.com/rstar327>`_
 - Kadir Can Ozden  `@bysiber  <https://github.com/bysiber>`_
 - Dhruvil Darji  `@dhruvildarji  <https://github.com/dhruvildarji>`_
+- Haïm Dimer `@hdimer  <https://github.com/hdimer>`_

CHANGELOG.rst

@@ -9,6 +9,11 @@ Features:
 - If `by_value` is enabled on an enum with a `None` value `allow_none` now defaults to `True`.
   Thanks :user:`GeraldineGalindo` for the suggestion (:issue:`2985`).
 
+Bug fixes:
+
+- `marshmallow.validate.URL` accepts a fragment that follows an empty path,
+  e.g. ``https://example.com#frag`` (:pr:`3016`). Thanks :user:`hdimer` for the PR.
+
 4.3.0 (2026-04-03)
 ------------------
 

src/marshmallow/validate.py

@@ -157,7 +157,7 @@ def _regex_generator(
                     r"(?::\d+)?",
                 )
             )
-            relative_part = r"(?:/?|[/?]\S+)\Z"
+            relative_part = r"(?:/?|[/?#]\S+)\Z"
 
             if relative:
                 if absolute:

tests/test_validate.py

@@ -32,6 +32,8 @@
         "http://:pass@example.com",
         "http://@example.com",
         "http://AZaz09-._~%2A!$&'()*+,;=:@example.com",
+        "http://example.org#fragment",
+        "http://user@example.com#fragment",
     ],
 )
 def test_url_absolute_valid(valid_url):
@@ -88,6 +90,7 @@ def test_url_absolute_invalid(invalid_url):
         "/foo/bar",
         "/foo?bar",
         "/foo?bar#baz",
+        "#frag",
     ],
 )
 def test_url_relative_valid(valid_url):
@@ -124,6 +127,7 @@ def test_url_relative_invalid(invalid_url):
         "/foo?bar",
         "?bar",
         "/foo?bar#baz",
+        "#frag",
     ],
 )
 def test_url_relative_only_valid(valid_url):