build(deps): update chardet requirement from <6.0.0,>=5.0.0 to >=5.0.0,<8.0.0

[dependabot]

Updates the requirements on chardet to permit the latest version.

Changelog

Sourced from chardet's changelog.

7.5.1 (2026-08-06)

Bug Fixes:

• Fixed markup-declared encodings being reported under a name that can't decode the input. A page declaring Shift_JIS but using CP932 extension characters (like ①) came back as SHIFT_JIS, which fails .decode() on those same bytes. Superset promotion (CP932, CP949) now always fires when the reported name can't decode the data but the superset can. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)
• Fixed a lying charset declaration beating genuine UTF-8 content. A UTF-8 page declaring <meta charset="iso-8859-1"> came back as ISO-8859-1, which decodes to mojibake. Valid multi-byte UTF-8 now wins over a conflicting declaration; pure ASCII and real single-byte content still honor it. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)
• Fixed BOM-less UTF-16 byte-order detection for pure-CJK text. With no ASCII in the sample, the only null bytes come from the low byte of characters like U+4E00 (一), which sit in the wrong parity position, so short Chinese UTF-16 samples came back with reversed endianness at full confidence. Byte order is now chosen by decoding both ways and comparing text quality, with the null signal breaking near-ties. Found by scoring chardet against charset-normalizer's char-dataset. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude)

7.5.0 (2026-08-05)

Bug Fixes:

• Fixed multi-byte encodings being eliminated when the input ends in an incomplete character. Byte-validity filtering decoded with a one-shot strict decode, which cannot tell a truncated tail from corrupt data, so a single dangling lead byte dropped every CJK candidate and the result came down to input-length parity — a 184-byte GBK sample detected as GB18030, the same sample minus one byte as Windows-1256. This was also reachable on complete, well-formed files, because chardet slices its own input at max_bytes and at _SCAN_LIMIT in _validate_bytes(): a valid 14 kB GBK page with an honest <meta charset="gbk"> lost its declaration, and with it text/html and 0.95 confidence, whenever byte 4096 happened to split a character. Validity checks now decode incrementally with final=False, deferring a partial trailing character while still rejecting corruption anywhere before it. (António Afonso <https://github.com/aadsm>_ via Claude, [#376](https://github.com/chardet/chardet/issues/376) <https://github.com/chardet/chardet/pull/376>_)

• Fixed compat_names (the default) leaking internal Python codec names

... (truncated)

Commits

• 40f85b0 docs: stamp 7.5.1 release date
• cd5c8b3 docs: tighten recent changelog entries
• 142b945 docs: align recent changelog entries with house style
• 9955af2 Fix two markup-stage bugs that returned undecodable or wrong encodings
• 0689e76 style: apply ruff format to utf1632 changes
• dfce346 Fix BOM-less UTF-16 byte order for pure-CJK text with no ASCII
• 531dfb7 docs: add 7.5.0 performance entries to changelog
• 1f9b91b ci: exclude models/init.py from mypyc on Windows separate builds
• 5cff59e ci: fix release wheel builds for mypy 2.x and PEP 668 runners
• 60d1723 docs: stamp 7.5.0 release date
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependency. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.