Refactor for Sentence Transformer >5.4 and zarr >3

.github/dependabot.yml

@@ -0,0 +1,52 @@
+# Dependabot configuration for mmcontext
+# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Security updates (PRs that fix Dependabot *alerts*) are enabled separately in
+# Settings -> Code security and obey target-branch below. This file additionally
+# enables proactive *version* updates on a schedule, grouped to reduce PR noise.
+version: 2
+updates:
+  # Python dependencies declared in pyproject.toml
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    # PRs target the integration branch, never main, per the project branch strategy.
+    target-branch: "dev-claude"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "deps"
+    # One grouped PR for routine minor/patch bumps instead of one PR per package.
+    groups:
+      python-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    # Heavy, tightly version-pinned core libs: keep these as individual PRs so a
+    # major bump (e.g. torch, transformers) is reviewed in isolation.
+    ignore:
+      - dependency-name: "torch"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "sentence-transformers"
+        update-types: ["version-update:semver-major"]
+
+  # GitHub Actions used in .github/workflows/*
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    target-branch: "dev-claude"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions-all:
+        patterns:
+          - "*"

.github/workflows/build.yaml

@@ -14,9 +14,9 @@ jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install build dependencies

.github/workflows/claude-implement.yaml

@@ -0,0 +1,61 @@
+name: Claude Code Implement
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+  actions: read
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}-${{ github.actor }}
+  cancel-in-progress: true
+
+jobs:
+  implement:
+    # Trigger on @claude mentions in issue comments — only by repo owner, ignore bots
+    if: >
+      github.actor == 'mengerj' &&
+      github.event.sender.type != 'Bot' &&
+      !github.event.issue.pull_request &&
+      contains(github.event.comment.body, '@claude')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: dev-claude
+          fetch-depth: 0
+      - uses: anthropics/claude-code-action@v1
+        id: claude
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          show_full_output: true
+          base_branch: dev-claude
+          additional_permissions: |
+            actions: read
+          claude_args: |
+            --allowedTools "Bash,Read,Write,Edit,Glob,Grep,Task,WebSearch,WebFetch"
+            --max-turns 30
+            --output-format stream-json
+          # The CLAUDE.md in the repo root provides the plan-first protocol,
+          # branch naming conventions, and PR linking instructions.
+          # Claude reads it automatically on checkout.
+
+      - name: Archive Claude session log
+        if: always()
+        run: |
+          mkdir -p claude-logs
+          echo '${{ steps.claude.outputs.result }}' > claude-logs/session.json
+        shell: bash
+
+      - name: Upload session log
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: claude-implement-issue${{ github.event.issue.number }}-${{ github.run_number }}
+          path: claude-logs/
+          retention-days: 30

.github/workflows/claude-review.yaml

@@ -0,0 +1,56 @@
+name: Claude Code Review
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+  actions: read
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}-${{ github.actor }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    # Respond to @claude in PR comments (owner only, ignore bots)
+    if: >
+      github.event.sender.type != 'Bot' &&
+      github.actor == 'mengerj' &&
+      github.event.issue.pull_request &&
+      contains(github.event.comment.body, '@claude')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: anthropics/claude-code-action@v1
+        id: claude
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          show_full_output: true
+          additional_permissions: |
+            actions: read
+          claude_args: |
+            --allowedTools "Bash,Read,Write,Edit,Glob,Grep,Task"
+            --max-turns 30
+            --output-format stream-json
+
+      - name: Archive Claude session log
+        if: always()
+        run: |
+          mkdir -p claude-logs
+          echo '${{ steps.claude.outputs.result }}' > claude-logs/session.json
+        shell: bash
+
+      - name: Upload session log
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: claude-review-pr${{ github.event.pull_request.number || github.event.issue.number }}-${{ github.run_number }}
+          path: claude-logs/
+          retention-days: 30

.github/workflows/codeql.yaml

@@ -0,0 +1,43 @@
+name: CodeQL
+
+# Semantic code scanning for Python. Findings appear under the repo's
+# Security -> Code scanning tab and as PR annotations.
+# Docs: https://docs.github.com/code-security/code-scanning
+
+on:
+  push:
+    branches: [main, dev-claude]
+  pull_request:
+    branches: [main, dev-claude]
+  schedule:
+    # Weekly full scan (Mondays 06:00 UTC) to catch newly-disclosed query updates.
+    - cron: "0 6 * * 1"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          # security-and-quality adds maintainability/quality queries on top of
+          # the default security set. Drop to "security-extended" if too noisy.
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:python"

.github/workflows/dependabot-auto-merge.yaml

@@ -0,0 +1,36 @@
+name: Dependabot auto-merge
+
+# Auto-approves and enables auto-merge for low-risk Dependabot PRs (patch/minor,
+# including security updates). GitHub still waits for all required status checks
+# (tests, CodeQL) to pass before the merge actually happens.
+#
+# Prerequisites (one-time, in repo Settings):
+#   - "Allow auto-merge" enabled (Settings -> General -> Pull Requests)
+#   - Branch protection on dev-claude requiring the Test + CodeQL checks
+# Docs: https://docs.github.com/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
+
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@v3
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Enable auto-merge for patch/minor updates
+        if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yaml

@@ -15,11 +15,11 @@ jobs:
     permissions:
       id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           filter: blob:none
           fetch-depth: 0
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
           cache: "pip"

.github/workflows/test.yaml

@@ -2,9 +2,9 @@ name: Test
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev-claude]
   pull_request:
-    branches: [main]
+    branches: [main, dev-claude]
   schedule:
     - cron: "0 5 1,15 * *"
 
@@ -41,7 +41,7 @@ jobs:
       PYTHON: ${{ matrix.python }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Free up disk space
         run: |
@@ -52,7 +52,7 @@ jobs:
           sudo rm -rf /usr/local/lib/android
 
       - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
 
@@ -77,4 +77,4 @@ jobs:
         run: |
           coverage report
       - name: Upload coverage
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v7

.gitignore

@@ -112,3 +112,4 @@ modules/.calmate/cache/
 cache/
 
 mmcontext_out/
+tutorials/outputs/

.pre-commit-config.yaml

@@ -11,19 +11,19 @@ repos:
     hooks:
       - id: prettier
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.5.0"
+    rev: "v2.24.1"
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.3
+    rev: v0.15.17
     hooks:
       - id: ruff
         types_or: [python, pyi, jupyter]
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
         types_or: [python, pyi, jupyter]
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: detect-private-key
       - id: check-ast