deps: update mempalace requirement from >=3.1.0 to >=3.3.1

[dependabot]

Updates the requirements on mempalace to permit the latest version.

Release notes

Sourced from mempalace's releases.

MemPalace v3.3.1

Highlights

• Multi-language entity detection — 5 new locales (Portuguese, Russian, Italian, Hindi, Indonesian) with full entity-detection patterns
• Script-aware word boundaries — fixes name truncation for Devanagari, Arabic, Hebrew, Thai, Tamil, Khmer scripts
• Case-insensitive BCP 47 language codes — --lang PT-BR, zh-cn, Pt-Br all resolve correctly
• KG thread safety — lock on close(), query_relationship, timeline, stats
• entity_registry.research() defaults to local-only (no outbound Wikipedia calls without opt-in)
• Precompact hook no longer blocks compaction on failure/timeout
• MCP stdout redirect — library logging can't corrupt JSON-RPC channel
• File permission hardening on sensitive palace data

See CHANGELOG.md for full details.

Install / Upgrade

pip install --upgrade mempalace

Changelog

Sourced from mempalace's changelog.

[3.3.1] — 2026-04-16

New Features

Multi-language entity detection — lexical patterns (person verbs, pronouns, dialogue markers, project verbs, stopwords, candidate character classes) now live in the optional entity section of each locale JSON under mempalace/i18n/<lang>.json. Every public function in entity_detector accepts a languages= tuple and unions patterns across enabled locales. Default stays ("en",) so existing English-only callers are unchanged. (#911)

• Five new fully-supported locales with CLI strings, AAAK compression instructions, and entity-detection patterns:
  • Brazilian Portuguese pt-br (#156)
  • Russian ru (#760)
  • Italian it (#907)
  • Hindi hi (#773)
  • Indonesian id (#778)
• MempalaceConfig.entity_languages — persistent palace-level language selection; MEMPALACE_ENTITY_LANGUAGES env override; mempalace init --lang en,pt-br flag that saves to ~/.mempalace/config.json (#911)
• Per-language candidate_pattern — non-Latin scripts register their own character class, so names like João, Инна, राज are no longer silently dropped by the ASCII-only default (#911)
• VSCode devcontainer matching the CI environment (#881)
• MEMPAL_VERBOSE env toggle — developers see diaries surfaced in chat while the default remains silent (#871)
• created_at timestamps included in search results (#846)

Bug Fixes

i18n / Unicode

• Script-aware word boundaries for combining-mark scripts — Python's \b fails on Devanagari vowel signs (ा ी ु), Arabic, Hebrew, Thai, Tamil, Khmer etc., truncating names like अनीता → अनीत and making person-verb patterns never fire. Locales now declare an optional boundary_chars field and the i18n loader expands \b into a script-aware lookaround boundary (#932)
• Case-insensitive BCP 47 language code resolution — --lang PT-BR, zh-cn, Pt-Br previously fell through to English silently; now resolve to the canonical locale file via lowercase matching, with the entity-pattern cache keyed on the canonical form so casing variations share one cache entry (#928)
• Wire i18n candidate patterns into miner._extract_entities_for_metadata(), palace.build_closet_lines(), and entity_registry.extract_unknown_candidates() — three code paths that still hardcoded ASCII-only [A-Z][a-z]{2,} and silently missed Cyrillic, accented Latin, and non-Latin entity metadata tags (#931)
• Explicit encoding="utf-8" on Path.read_text() calls across entity_registry, instructions_cli, split_mega_files, and onboarding tests — prevents Windows GBK (and other non-UTF-8) locales from corrupting UTF-8 files (#946, #776)
• ko.json status_drawers used {drawers} instead of {count}, showing the raw template string instead of the number (#758)
• Move test_i18n.py from inside the installed package into tests/ so pytest actually collects it; remove the sys.path.insert hack (#758)
• Dialect.from_config() defaulted to current_lang() (module-global) when config had no lang key — replaced with explicit "en" fallback for determinism (#758)

Other

• Guard KnowledgeGraph.close() and query_relationship/timeline/stats methods with the instance lock to prevent concurrent-access corruption (#887, #884)
• Replace invalid {"decision": "allow"} with {} in hook responses — the string wasn't a valid decision value and triggered schema warnings (#885)
• entity_registry.research() defaults to local-only — previously made outbound Wikipedia HTTPS requests without explicit user opt-in; callers now must pass allow_network=True (#811)
• Precompact hook no longer blocks compaction when it fails or takes too long (#856, #858, #863)
• Redirect stdout to stderr during MCP server import so library logging can't corrupt the JSON-RPC channel (#225, #864)
• mempalace init auto-adds per-project files to .gitignore in git repositories so users don't accidentally commit mempalace.yaml / entities.json (#185, #866)
• Searcher guards against empty ChromaDB query results that previously raised on edge-case corpora (#195, #865)
• Return empty status instead of an error on a cold-start palace with no drawers yet (#830, #831)
• Restrict file permissions on sensitive palace data (#814)
• Slack transcript importer writes a provenance header and preserves speaker IDs (#815)
• Allow mempalace mine to run in directories without a local mempalace.yaml and surface the missing-yaml warning on stderr (#604)
• Security hook injection fix (#812)
• Save hook auto-mines transcripts even when MEMPAL_DIR is unset (#840)
• Pin the Pages custom domain via a shipped CNAME in the deploy artifact (#877)
• Version drift safeguard — sync pyproject + version.py + README badge in one place (#876)
• Deploy docs workflow now runs on develop only, preventing accidental main-branch deploys (#845)

Improvements

... (truncated)

Commits

• 6889c6f Merge pull request #957 from MemPalace/release/3.3.1
• b552bcf Merge pull request #958 from MemPalace/fix/release-3.3.1-plugin-manifests
• 05ad2dc release: bump plugin manifests to 3.3.1
• fd89303 docs(changelog): backfill post-v3.3.0 PRs missed by initial boundary
• 2087869 release: v3.3.1
• 55a004f Merge pull request #931 from mvalentsev/fix/i18n-entity-metadata
• c5e249b Merge pull request #946 from mvalentsev/fix/utf8-read-text
• 65f99ad Merge pull request #928 from arnoldwender/fix/i18n-lang-case-insensitive
• 29112fa Merge pull request #778 from dominosaurs/feat/id-lang
• 4215be3 Merge pull request #773 from tejasashinde/feat/add-i18n-hindi
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.