[dependabot]

Bumps the all-dependencies group with 4 updates in the / directory: cached, tokio, serde_json and schemars.

Updates cached from 4.0.2 to 4.0.3

Changelog

Sourced from cached's changelog.

[4.0.3] - 2026-10-18

Changed

• Raise the minimum redis version to 1.2.3, the first release on lru 0.18. Earlier 1.x releases depend on lru 0.16, which is affected by RUSTSEC-2026-0253 (use-after-free in LruCache::pop() when a key's Drop panics), fixed in lru 0.18.2.

Added

• CI runs cargo audit against the RustSec advisory database on every push and pull request, and weekly so new advisories surface without a code change.

Commits

• c97b333 raise redis floor to 1.2.3, add cargo audit ci job, release 4.0.3 (#333)
• See full diff in compare view

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates schemars from 1.2.2 to 1.2.3

Release notes

Sourced from schemars's releases.

v1.2.3

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Changelog

Sourced from schemars's changelog.

[1.2.3] - 2026-10-12

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Commits

• 4791bb7 v1.2.3
• c6a89b7 Put the tag of an internally tagged enum first in properties
• c5cd8b5 fix: schema creation panics with arbitrary precision JSON numbers
• 766d70b Resolve unused_qualifications lint in crate and generated code - #541 (#541)
• d07655e Resolve clippy error
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
Tokio 1.54 touches the async runtime broadly (including MSRV and timer behavior in 1.54.1), and schemars 1.2.3 can change emitted JSON Schema ordering for internally-tagged enums; otherwise this is dependency-only with low direct code risk.

Overview
This PR only updates Cargo.lock—no Cargo.toml or application code changes. Dependabot resolves newer patch releases within existing workspace version ranges for four crates used across the ledger stack (cala-ledger, cala-cel-interpreter, es-entity, etc.).

tokio 1.53.3 → 1.54.1 is the largest jump: it includes the 1.54.0 line (MSRV raised to Rust 1.85, runtime/sync/io/net changes) plus 1.54.1, which reverts the “remove runtime handle from timers” change. serde_json 1.0.151 → 1.0.154 brings UTF-8 error reporting, -0 / large-number parsing fixes, and related patch fixes. schemars 1.2.2 → 1.2.3 fixes schema-generation panics with arbitrary-precision JSON numbers and reorders internally-tagged enum tag fields first in generated properties. cached 4.0.2 → 4.0.3 tightens transitive dependency floors (e.g. redis / lru) for a known RustSec advisory.

The lockfile also records a transitive winapi-util change (windows-sys 0.61.2 → 0.48.0) as part of resolution—not a direct manifest edit in this diff.

^{Reviewed by Cursor Bugbot for commit 4709bd3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

📊 Performance Report

Commit: 4709bd3
Updated: 2026-10-29 08:26:17 UTC

Cala Performance Benchmark Results (non-representative)

Criterion Benchmark Results (single-threaded)

Benchmark	Time per Run	Throughput	% vs Baseline
post_simple_transaction	2.059ms	485 tx/s	0 (baseline)
post_backdated_transaction_with_effective_balances_365_days	54.801ms	18 tx/s	-2560.0%
post_multi_layer_transaction	1.800ms	555 tx/s	+12.0%
post_simple_transaction_with_effective_balances	1.682ms	594 tx/s	+18.0%
post_simple_transaction_with_skipped_velocity	2.671ms	374 tx/s	-29.0%
post_simple_transaction_with_velocity	1.935ms	516 tx/s	+6.0%
post_simple_transaction_with_hit_velocity	1.022ms	978 tx/s	+50.0%
post_simple_transaction_with_one_account_set	2.236ms	447 tx/s	-8.0%
post_simple_transaction_with_five_account_sets	2.308ms	433 tx/s	-12.0%
post_simple_transaction_with_ec_account_set	2.157ms	463 tx/s	-4.0%

Load Testing Results (parallel-execution)

Scenario	tx/s
1 parallel	353.36
2 parallel	603.27
5 parallel	842.23
10 parallel	524.70
20 parallel	843.35
2 contention	417.07
5 contention	287.45
2 acct_sets	318.75
5 acct_sets	259.13

---

Note: Performance results may vary based on system resources and database state.

Last updated by commit 4709bd3