Update all dependencies (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	major	v4 → v7
python-slugify (changelog)	dependencies	major	8.0.4 → 9.1.2

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v5.1.0

Compare Source

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

un33k/python-slugify (python-slugify)

v9.1.2

Compare Source

• Skip the transliteration backend for ASCII-only input under both algorithms, avoiding the ~3 MB text-unidecode table import for the common ASCII case. Output is unchanged, including the frozen legacy differential (Rafael Borja, #​201).

v9.1.1

Compare Source

• Modern mode only: avoid emitting a trailing separator when a hard cut truncates through repeated post-replacement delimiters, keeping the delimiter run with the next word that fits. Legacy output and public smart_truncate are unchanged (曾楚笑, #​200).

v9.1.0

Compare Source

• Modern mode only: decode uppercase &#X..; hexadecimal references as HTML allows, in addition to lowercase &#x..;. Legacy output is unchanged (Rupayon Haldar, #​195).
• Modern mode only: preserve post-replacement output when the whole slug already fits max_length, so intentional repeated/trailing delimiters are not collapsed at the length limit. Public smart_truncate is unchanged (emme1t, #​193).
• Fix add_uppercase_char to apply insertions atomically, leaving the input list unchanged if iteration fails. Built-in transliteration tables are unaffected (Cristian Ramirez, #​194).
• Modern mode only: validate argument types up front, raising TypeError for a bool/non-int max_length (bool is an int subclass) or a non-str separator. Legacy behavior is unchanged and still treats max_length=True as its historical single-character truncation (Jon Bailey, #​196).

v9.0.0

Compare Source

• Add keyword-only algorithm='legacy' (permanent default) and explicit algorithm='modern' opt-in, plus CLI --algorithm. Preserve historical default entity ordering, numeric handling, iterator consumption, separator truncation, and public smart_truncate behavior.

• Preserve legacy auto backend selection and two-pass replacement defaults; add explicit backend and replacement_stage keyword-only options and matching CLI flags.

• Add opt-in AnyASCII extra without removing or changing the base text-unidecode dependency.

• Forward CLI --regex-pattern (Jacobo de Vera, #​176; report by @​peter-bloomfield, #​175).

• Modern mode only: decode entities before transliteration; handle invalid numeric references per match, including surrogate references (#​178, #​181, #​187).

• Modern mode only: materialize replacement rules and stopword iterables consistently; preserve bytes/bytearray UTF-8 input with clear rejection of unsupported types (#​183, #​190).

• Modern mode only: budget internal tokens using emitted separator widths, support empty separators, and preserve literal word characters that match delimiters. Public smart_truncate remains unchanged (#​47, #​185, #​186).

• Add regression coverage for whitespace, ordinals, backend-specific output, replacement stages, CLI execution, and installed artifacts.

• Move package metadata to pyproject.toml, retain the typed marker and source tests, and remove the unsafe publish/upload/tag shortcut.

• Document output changes, backend license distinctions, compatibility limits, and migration precautions in docs/release-9/migration.md.

• Support Python 3.14.

• Drop support for Python 3.9 and lower.

• Use tox for local test runs and in CI.

• Test the project against both unidecode and text_unidecode.

• Fix type annotation issues identified by mypy.

• Run CI against pull requests.

• Fix package build warnings.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on the first day of january"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.