chore(deps): bump the ci-scanners group in /.github/requirements with 3 updates

[dependabot]

Bumps the ci-scanners group in /.github/requirements with 3 updates: chardet, atheris and pyee.

Updates chardet from 5.2.0 to 7.6.0

Release notes

Sourced from chardet's releases.

7.6.0

Big release: a Cython scoring kernel joins mypyc in compiled wheels, every model retrained on a deduplicated corpus, UTF-7 fixed in both directions, and a guarantee that detect() never returns an encoding that can't decode your complete input.

Performance

• Compiled wheels now score bigram profiles through a small Cython kernel alongside mypyc, and the pair is 4.7x faster than the pure wheel on CPython 3.14. _kernel.py stays plain Python (PyPy and pure wheels run it interpreted, unchanged), and detection output is bit-identical. The kernel declares itself safe without the GIL, so free-threaded CPython scales instead of silently re-enabling the GIL on import: 3.14t runs the whole suite in ~340ms across 8 threads, the fastest configuration measured. Compiled builds now need both hooks: HATCH_BUILD_HOOK_ENABLE_MYPYC=true HATCH_BUILD_HOOK_ENABLE_CUSTOM=true.
• Added support for CPython 3.15, including the free-threaded build. No code changes were needed.

Bug Fixes

• detect() no longer returns an encoding that cannot decode the input it was given (#380, thanks @​yarikoptic). When the whole input has been examined and the winner's only multi-byte evidence is an incomplete trailing sequence, the best candidate that decodes the input completely wins instead. Genuinely truncated data keeps its answer.
• Fixed delimited ASCII data like |NAME,+LAY| misdetecting as UTF-7 (#371 follow-up, thanks @​agreenburg). The whole buffer must now actually decode as UTF-7, and a lone shifted character must land in a plausible script range.
• Signed UTF-7 no longer reads as ASCII: the BOM stage recognizes the four UTF-7 signature prefixes when the rest of the buffer decodes as UTF-7.
• Fixed short apostrophe-heavy English being labeled Scottish Gaelic or Breton: a rare-language label on an input under 128 bytes now needs a 0.03 lead over the best mainstream language (ADR-0005).
• Fixed Hungarian text losing to a Czech reading in confusion rescoring; tied pairs are compared only under language models both encodings have.
• Fixed space-padded text matching a degenerate Serbian model at high confidence; statistical scoring now skips repeated-whitespace bigrams. This also fixes windows-1251 logs misdetecting as windows-1250 (#379).
• Fixed EBCDIC text being invisible to the early pipeline stages, and the last two EBCDIC sibling misdetections.
• Fixed training normalization gaps that starved ISO-8859-16 and the 26 pre-euro encodings at exactly their distinguishing bytes.

Improvements

• Retrained every bigram model on a refreshed, deduplicated corpus with training provenance now recorded per model.
• New ANSI-art model for cp437, trained on 16,621 text-mode art files from 16colo.rs.
• Rare-language arbitration (ADR-0005): low-confidence statistical winners from languages with no documented legacy-encoding population yield to near-tied mainstream candidates.
• Confusion-group resolution is context-aware: per-occurrence votes, word-shape demotions, art-model exemption.
• Statistical dead heats no longer resolve by candidate enumeration order.
• Training pipeline hardening after a cache-loss post-mortem.

Full Changelog: chardet/chardet@7.5.1...7.6.0

7.5.1

Patch release: three detection fixes found while benchmarking against charset-normalizer's char-dataset.

Bug Fixes

• Fixed markup-declared encodings being reported under a name that can't decode the input. A page declaring Shift_JIS but using CP932 extension characters (like ①) came back as SHIFT_JIS, which fails .decode() on those same bytes. Superset promotion (CP932, CP949) now always fires when the reported name can't decode the data but the superset can.
• Fixed a lying charset declaration beating genuine UTF-8 content. A UTF-8 page declaring <meta charset="iso-8859-1"> came back as ISO-8859-1, which decodes to mojibake. Valid multi-byte UTF-8 now wins over a conflicting declaration.
• Fixed BOM-less UTF-16 byte-order detection for pure-CJK text: short Chinese UTF-16 samples came back with reversed endianness at full confidence. Byte order is now chosen by decoding both ways and comparing text quality.

Full Changelog: chardet/chardet@7.5.0...7.5.1

7.5.0

Accuracy and speed release: truncation-proof byte validity, statistical pruning worth ~2.9x, and half the peak memory.

Bug Fixes

• Fixed multi-byte encodings being eliminated when the input ends in an incomplete character. Byte-validity filtering used a one-shot strict decode, which cannot tell a truncated tail from corrupt data, so a single dangling lead byte dropped every CJK candidate and the result came down to input-length parity. Also reachable on complete files through chardet's own max_bytes and _SCAN_LIMIT slicing. Validity checks now decode incrementally with final=False. (#376, thanks @​aadsm)
• Fixed compat_names (the default) leaking internal Python codec names for seven encodings (ISO-8859-2, ISO-8859-6, ISO-8859-13, Windows-1250, Windows-1256, Windows-1257, CP874). (#374, thanks @​aadsm)
• Fixed compat_names leaking the internal cp932 codec name; detect() now returns CP932. (#375, thanks @​uttam12331)

... (truncated)

Changelog

Sourced from chardet's changelog.

7.6.0 (2026-08-14)

Performance:

• Compiled wheels now score bigram profiles through a small Cython kernel alongside mypyc, and the pair is 4.7x faster than the pure wheel on CPython 3.14. _kernel.py stays plain Python (PyPy and pure wheels run it interpreted, unchanged), _kernel.pxd adds C types at build time and ships nothing, and detection output is bit-identical. The kernel declares itself safe without the GIL, so free-threaded CPython scales instead of silently re-enabling the GIL on import: 3.14t runs the whole suite in ~340ms across 8 threads, the fastest configuration measured. Compiled builds now need both hooks::

  HATCH_BUILD_HOOK_ENABLE_MYPYC=true HATCH_BUILD_HOOK_ENABLE_CUSTOM=true uv build
  

  (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)

• Added support for CPython 3.15, including the free-threaded build. No code changes were needed. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)

Bug Fixes:

• Fixed delimited ASCII data like |NAME,+LAY| misdetecting as UTF-7, a follow-up to [#371](https://github.com/chardet/chardet/issues/371) <https://github.com/chardet/chardet/issues/371>. Two new checks: the whole buffer must actually decode as UTF-7 (+| is an illegal shift, so tabular data fails immediately), and a block encoding a single code unit must land in a script range where a lone shifted character plausibly occurs. +LAY decodes to U+2C06, Glagolitic; no genuine lone block in the corpus lands anywhere like it, while em dashes, ellipses, kanji, and accented letters all pass. (Dan Blanchard <https://github.com/dan-blanchard> via Claude)
• Signed UTF-7 no longer reads as ASCII. The BOM stage recognizes the four UTF-7 signature prefixes (+/v8- and friends) when the rest of the buffer decodes as UTF-7 --- the prefix alone is ordinary ASCII (a diff of V8 source paths starts with +/v8). This is a deliberate divergence from WHATWG's browser-security exclusion of UTF-7: chardet already detects the unsigned form, so refusing only the signed one made no sense. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)
• detect() no longer returns an encoding that cannot decode the input it was given ([#380](https://github.com/chardet/chardet/issues/380) <https://github.com/chardet/chardet/issues/380>_). When the whole input has been examined and the winner's only multi-byte evidence is an incomplete trailing sequence, the best candidate that decodes the input completely wins instead. Genuinely truncated data keeps its answer: CJK cut mid-character, or input sliced at

... (truncated)

Commits

• dcf07fb Scope the 7.6.0 changelog to the 7.5.1..7.6.0 delta
• 1177ee0 Release 7.6.0
• e3a7d78 docs: final pre-release benchmark refresh on the 3,125-file corpus
• 6bbb2af Stop UTF-7 misdetections both ways: decode-gate the class, sniff the signature
• e20d6c1 docs: publish the first x86 benchmark run
• c7f62c5 Credit patrikha's PEP 263 request; make the x86 benchmark debuggable
• 9d63eca Credit deedy5's chunked-processing proposal; add an x86 benchmark workflow
• 060c6b8 docs: address the accurate parts of charset-normalizer's rebuttal
• 7e25984 Fix two docstring lint violations the pre-push check missed
• 75b751f docs: rewrite the 7.6.0 changelog as a point-in-time view of main vs 7.5.1
• Additional commits viewable in compare view

Updates atheris from 3.0.0 to 3.1.0

Commits

• See full diff in compare view

Updates pyee from 13.0.1 to 14.0.0

Release notes

Sourced from pyee's releases.

Release v14.0.0

2026/08/12 Version 14.0.0

• Use uv instead of pip-tools
• Move dev extras to dev dependency group
• Drop support for Python 3.8, 3.9, 3.10 and 3.11
• BUGFIX: Remove all listeners only for specified event

Changelog

Sourced from pyee's changelog.

2026/08/12 Version 14.0.0

• Use uv instead of pip-tools
• Move dev extras to dev dependency group
• Drop support for Python 3.8, 3.9, 3.10 and 3.11
• BUGFIX: Remove all listeners only for specified event

Commits

• 733143c Update docs config
• 433f1b0 Release 14.0.0
• 426cd82 Remove redundant remove_all_listeners single-event regression test
• 41f2cb8 Fix remove_all_listeners leaving stale empty event key
• 5980b92 Bump tornado from 6.5.5 to 6.5.7
• aebd21f Bump idna from 3.11 to 3.15
• 221ec5d Bump pymdown-extensions from 10.21 to 10.21.3
• c2266f9 Bump urllib3 from 2.6.3 to 2.7.0
• 033853a Bump pytest from 9.0.2 to 9.0.3
• 06536f0 Bump pygments from 2.19.2 to 2.20.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vivekchand]

"Fuzz untrusted parsers" is failing because atheris==3.1.0 does not exist on PyPI.

Log evidence from the failing job:

ERROR: Could not find a version that satisfies the requirement atheris==3.1.0
(from versions: 1.0.0, 1.0.1, ..., 3.0.0)
ERROR: No matching distribution found for atheris==3.1.0

The highest published version of atheris is 3.0.0. Dependabot bumped .github/requirements/fuzz.txt to pin atheris==3.1.0, but no wheel or sdist for that version was ever published to PyPI. This is not a transient failure -- the package simply does not exist.

This cannot be fixed by a code change on this branch; the root cause is that Dependabot resolved a version that was never released. To unblock:

·@·d·ependabot r·ecreate

That will regenerate the PR targeting the actual latest published version. If atheris has not released 3.1.0 by then, the fuzz requirements file should stay at 3.0.0 and only the other packages in this group (chardet, pyee) would be bumped.

Not merging this PR in its current state.

---

Generated by Claude Code

[vivekchand]

·@·d·ependabot r·ebase

---

Generated by Claude Code