chore(deps): update all dependencies to latest and restore modern nightly compatibility

[dependabot]

Closes #13.

Started as Dependabot's serde_with 3.17.0 -> 3.22.0 bump; extended per the request in the issue: "We need to update all dependencies to latest versions and fix all errors."

What was broken

The two CI failures on this branch were not caused by the serde_with bump. They were Rust nightly drift, and main had worked around them by pinning the toolchain to nightly-2026-04-14 (see the fragment added in #15). This PR fixes both at the source and moves the pin forward.

1. error[E0512] in ethnum 1.5.2

error[E0512]: cannot transmute between types of different sizes, or dependently-sized types
   --> ethnum-1.5.2/src/error.rs
    = note: source type: `()` (0 bits)
    = note: target type: `TryFromIntError` (8 bits)

ethnum 1.5.2 built core::num::TryFromIntError with unsafe { mem::transmute(()) }. TryFromIntError is no longer zero-sized, so the transmute is rejected. Upstream 1.5.3 constructs it via u8::try_from(-1i8).unwrap_err() instead — the fix is a lockfile bump in rust/Cargo.lock and rust/spacetime-module/Cargo.lock.

2. error[E0277] in the vendored platform-data

error[E0277]: the trait bound `Flow: Residual<()>` is not satisfied

Nightly's Try::Residual gained a Residual<Self::Output> bound (library/core/src/ops/try_trait.rs). The vendored Flow declares type Residual = Flow but never said which Try type it reconstructs. Flow is its own residual and its Output is (), so:

impl Residual<()> for Flow {
    type TryType = Flow;
}

plus the try_trait_v2_residual feature gate, since Residual is exported under a gate separate from try_trait_v2. Documented in rust/doublets-patched/PATCHES.md alongside the existing patches.

Dependency updates

All three lockfiles refreshed. This clears all five open Dependabot alerts:

Change	Why
serde_with 3.17.0 → 3.22.0	the original Dependabot bump
anymap 0.12.1 → anymap3 1.1.0	critical advisory (unmaintained, unsound)
protobuf 2.28.0 → 3.7.2	advisory
rand 0.9.2 → 0.9.5, 0.8.6 → 0.8.8	advisory on >=0.9.0,<0.9.3
atty removed	last consumer was criterion 0.3.6
spacetimedb-sdk / spacetimedb 2.0.3 → 2.10.1	latest
criterion =0.3.6 → 0.8	latest; ethnum/atty transitives
tokio 1.48.0 → 1.53.1, syn 2.0.111 → 3.0.5	latest (root crate)

Two follow-on changes were required by those upgrades:

• criterion 0.8 needs features = ["cargo_bench_support"] spelled out — criterion stopped implying it under default-features = false in 0.5.
• spacetimedb-sdk 2.10.1 bounds RemoteModule on Debug, which produced 30 × E0277 against the checked-in bindings. rust/src/module_bindings/ was regenerated with spacetime generate 2.10.1: the table module is now links_table (LinksTableAccess/LinksTableHandle) rather than link_table, and the types carry Debug derives. rust/src/spacetimedb_impl.rs follows the new import path. Regenerating from the WASM built by 2.10.1 and by 2.0.3 produces byte-identical output, so the change is purely the SDK's codegen, not a module schema change.

Toolchain pin moved to nightly-2026-09-16

nightly-2026-04-14 existed only to dodge the two errors above. With both fixed, rust/rust-toolchain.toml and .github/workflows/rust-benchmark.yml (kept in sync) move to nightly-2026-09-16 = 1.100.0-nightly (215a8af4b 2026-09-15). It is still a dated nightly, not a rolling one, so the drift of #14 cannot recur — and moving it is what makes CI actually exercise the two fixes, instead of never reaching the code paths that used to break.

Verification

Reproduction of the original failure: cargo build in rust/ on any nightly newer than roughly 2026-05 fails with the E0512 above; once ethnum is bumped, the E0277 surfaces behind it.

The full test job was reproduced locally end-to-end against the merged tree on the new pin:

cargo fmt --all -- --check                                  ok
cargo clippy --all-targets                                  ok
cargo build --release --target wasm32-unknown-unknown       ok   (spacetime-module)
spacetime publish ... benchmark-links                       ok   (CLI 2.10.1)
cargo test -- --test-threads=1                              13 passed; 0 failed
python3 -m unittest discover -s rust -p 'test_*.py'         26 tests ok
cargo test           (root crate)                           9 + 10 + 3 passed

The reporting pipeline was also run end-to-end, because the out.py bencher regex on main is tuned to criterion 0.3.6's output and criterion 0.8 is a large jump. It parses cleanly — all 35 measurements, all 5 backends:

cargo bench --bench bench -- --output-format bencher --sample-size 10 ... | tee out.txt
python3 out.py                                              7 operations x 5 variants, charts + results.md

Operation	Doublets United Volatile	Doublets Split Volatile	SpacetimeDB
Create	940	1033	133,241,906
Update	2404	674	151,428,926
Delete	1532	2100	84,386,998
Query by Id	58	79	4,829

(quick-mode numbers, BENCHMARK_LINK_COUNT=10 — for pipeline validation, not for publication.)

Note on rust/out.py

This branch originally carried its own fix for the bencher parser and a rust/test_out_py.py. main fixed the same bug more thoroughly in #15 (rust/out.py rewrite, rust/test_out.py, a dedicated results-pipeline job), so the merge drops this branch's versions in favour of main's. No parser changes remain here.

[konard]

We need to update all dependencies to latest versions and fix all errors.

[konard]

🤖 AI Work Session Started

Starting automated work session at 2026-09-16T07:57:44.167Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

Runtime: solve v2.29.0 · tool claude · model opus · task image konard/hive-mind-dind:2.29.0@sha256:11a236d03854cbaea86fdd7ca06265c912cf0b67d1fcc9b3eb60bd84c43ff749

[konard]

Working session summary

Done. PR #13 is out of draft, mergeable, and all 16 checks pass: #13

What landed

Root cause of the two failing checks was Rust nightly drift, not the serde_with bump:

1. error[E0512] — ethnum 1.5.2 built core::num::TryFromIntError via mem::transmute(()), which no longer type-checks now that the error type isn't zero-sized. Fixed by the upstream 1.5.3 bump in both lockfiles.
2. error[E0277]: the trait bound Flow: Residual<()> is not satisfied — nightly's Try::Residual gained a Residual<Self::Output> bound. Fixed in the vendored platform-data with impl Residual<()> for Flow { type TryType = Flow; } plus the try_trait_v2_residual gate, documented in PATCHES.md.

All three lockfiles were then refreshed, clearing all five Dependabot alerts (anymap→anymap3, protobuf 3.7.2, rand 0.9.5, atty dropped, serde_with 3.22.0). Two upgrades required follow-on work: criterion 0.8 needs cargo_bench_support spelled out, and spacetimedb-sdk 2.10.1 bounds RemoteModule on Debug, so module_bindings/ was regenerated with spacetime generate 2.10.1 (link_table → links_table

Rest of the working session summary (1 KB)

) and `spacetimedb_impl.rs` follows the new path.

Since both errors the `nightly-2026-04-14` pin worked around are now fixed at the source, I moved the pin to `nightly-2026-09-16` — still a dated nightly, so the drift of #14 can't recur, but CI now actually exercises the fixes.

**On the merge with `main`:** `main` had already fixed the `out.py` bencher parser more thoroughly (#15: rewrite, `rust/test_out.py`, a `results-pipeline` job), so I dropped this branch's equivalent parser fix, test file, and workflow step in favour of `main`'s. Two of my earlier commits (`19d9fbc`, `a85283b`) remain in history but their `out.py`/test content is superseded; the net diff carries no parser changes.

**Verification** — full `test` job reproduced locally on the merged tree with the new pin (fmt, clippy, WASM build, `spacetime publish`, `13/13` tests, 26 `out.py` tests, root crate `9+10+3`), plus an end-to-end quick benchmark to confirm `main`'s regex — tuned to criterion 0.3.6 — still parses criterion 0.8's output. It does: all 35 measurements across 5 backends, charts generated. CI then confirmed it independently — "Benchmark (PR validation)" passed in 5m16s.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $8.539735

📊 Context and tokens usage:

Claude Opus 5: (2 sub-sessions)

1. 116.0K / 1M (12%) input tokens, 39.5K / 128K (31%) output tokens
2. 88.9K / 1M (9%) input tokens, 22.6K / 128K (18%) output tokens

Total: (3.2K new + 181.1K cache writes + 9.7M cache reads) input tokens, 74.2K output tokens, $8.539736 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: opus (claude-opus-5)
• Thinking level: high (~23999 tokens)
• Model: Claude Opus 5 (claude-opus-5)

📎 Log file uploaded as Gist (4304KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag