chore(deps): bump scalus from 0.17.0 to 1.3.0 in the cardano-ecosystem group across 1 directory

[dependabot]

Bumps the cardano-ecosystem group with 1 update in the / directory: scalus.

Updates scalus from 0.17.0 to 1.3.0

Release notes

Sourced from scalus's releases.

v1.2.0

Release Notes

Scalus 1.2 makes generated validators smaller, ordered collections faster, and contract APIs safer. It also brings a self-contained Emulator and streaming blockchain APIs to JVM and JavaScript.

Added

• Safe on-chain APIs for unique lookups, validity bounds, whole-value checks, NFT checks, tagged payments, explicit rounding, and credential extraction.
• A complete Emulator provider with stable error codes, per-redeemer budgets, filtered UTxO queries, and rollback-aware subscriptions.
• List.insertionSort for very small bounded lists, plus isSorted, isStrictlyAscending, and comparator-based sorting.
• SortedMap.fromLargeList for lists that may be long or attacker-controlled.
• Blockchain streaming adapters for the standard library and fs2.
• All eight UPLC-CAPE benchmarks, with reproducible script-size and execution-budget measurements.
• Scala 3.9.0 support alongside 3.3.7, 3.3.8, and 3.8.4.

Changed

• List.sort is now a stable natural merge sort. At 64 ordered items, worst-case execution fees fall 84%, from 894,051 to 141,105 lovelace.
• SortedMap.fromList is 28x cheaper at 64 ascending keys. This reduces measured Value construction costs by 11–13%.
• Common subexpression elimination and common context extraction now reuse repeated code in the smallest safe scope. Fee-aware decisions save another 514 bytes across the 23-contract release benchmark. See measurements.
• The Scalus compiler tag now has zero execution cost, saving 300 memory units and 48,000 CPU units per run. All release script hashes change.
• The npm package now runs in browsers without Node crypto polyfills and requires Node 20 or newer. Ledger values use typed handles with toObject() instead of raw CBOR.
• Breaking: design-pattern callbacks now return Unit; TxInfo.redeemers is now an AssocMap; invalid GovAction and ProposalProcedure orderings were removed.
• Breaking: the JavaScript Emulator uses hex identifiers and undefined for missing values. Direct Scala.js users must migrate SlotConfig to the shared Long-based API.

Deprecated

• Misnamed TxInfo.findOwn* methods, getValidityStartTime, and ADA-only input/output sums. Use the renamed TxInfo.find*, validFromOrFail, valuePaidTo, and valueSpentFrom APIs.
• List.single, PairList.single, and legacy JavaScript Emulator constructors and query methods.

Fixed

• PlutusV1/V2 scripts now declare the correct UPLC version and avoid unsupported syntax on older protocol versions.
• Script-context ordering, redeemer lookup, voter/proposal indexing, and pointer-address staking credentials now match the Cardano ledger.
• Example validators now prevent token stripping and reject missing validity bounds.
• CommonJS require("scalus") works again, evaluation failures extend Error, and TypeScript declarations are generated from compiler metadata.
• Equality for DCert and PlutusV1 ScriptPurpose, pattern fallbacks, CEK value discharge, ledger decoding, and Plutus-compatible names were corrected.
• Preprod protocol parameters were updated to epoch 310.

Documentation

• Documentation: https://scalus.org/docs
• Getting started: https://scalus.org/docs/get-started

v1.1.0

The first feature release of the 1.x line.

Highlights:

• Faster scripts: self-application recursion replaces the Z combinator and a static-argument transformation stops re-passing loop-invariant arguments – typical validators save 4-12% CPU, the Knights benchmark 20% memory, the CAPE fibonacci fee drops 23%

... (truncated)

Changelog

Sourced from scalus's changelog.

1.3.0 (2026-09-28)

Scalus 1.3 balances transactions from JavaScript, evaluates scripts two to three times faster from CBOR, and corrects Plutus cost-model and 64-bit tag handling.

Added

• balancer.balanceTx settles a transaction's execution units, fee, and change together in JavaScript. Coin selection and change placement stay with the caller. Experimental.
• A CBOR-first JavaScript API: uplc.applyParamsToScript, evaluator.evaluateScript, and evaluator.evaluateTx, with EvaluationOptions records and a per-transaction budget.
• Protocol version 12 (Dijkstra) support, including case on Data.Constr when targeting it.
• scriptHash, dataHash, ExUnits.toJSON(), CIP-30 [input, output] UTxO decoders, and Utxo.withScriptRef for Lucid's Script shape.
• PlutusScriptEvaluationError carries the redeemer, script hash, logs, and the failing script's arguments. FlatDecodingError is public and is the only error flat decoding raises.

Changed

• Evaluating scripts decoded from CBOR is 2.5–3.1x faster on the JVM and 30–50% faster in scalus.js. De Bruijn conversion is 3.5–3.8x faster on larger programs.
• Building a Value from 1,295 assets in JavaScript drops from 337 ms to 3.6 ms.
• scalus.js is 21% smaller minified: the IANA timezone database is no longer linked in.
• Breaking: PlutusScriptEvaluator in EvaluateAndComputeCost mode enforces the transaction's maxTxExecutionUnits, so an over-budget transaction fails at build time, not on submission.
• Breaking: a cost parameter the supplied model does not reach is Long.MaxValue, as in Plutus, so an incomplete model cannot run. Supply the full model for your protocol version.
• Breaking: Utxo.toCbor() writes CIP-30 [input, output] instead of a one-entry map; fromCbor still reads both.
• Breaking: Language.PlutusV4 is a Dijkstra (PV12) language, as in Plutus ledgerLanguageIntroducedIn.
• Script failures name the redeemer and script hash. Every other JavaScript evaluation failure is a native Error, and unreadable input is a TypeError.
• Traces no longer carry a budget suffix; per-trace budgets are in ProfilingData.traces.

Deprecated

• The Scalus namespace object, applyDataArgToScript, evaluateScript, evaluateScriptProfile, and evalPlutusScripts. Use uplc and evaluator; evalPlutusScripts becomes evaluator.evaluateTx.
• CaseDataBranchError and TallyingBudgetSpenderLogger.getLogsWithBudget.

Removed

• VanRossemNewBuiltinCosts. Its fallback was the defect: an incomplete cost model ran on reference costs instead of refusing to run.

Fixed

• Matching on Data at protocol version 11 compiled to a case on a Data scrutinee, which a van

... (truncated)

Commits

• 31531c1 chore(release): date 1.3.0
• 09ea2d6 chore(release): prepare the 1.3.0 changelog and npm version
• 58072d3 chore(build): re-baseline MiMa on 1.2.0 and drop the obsolete filters
• fa3305f feat(js): balance a transaction from JavaScript
• 0312320 feat(eval): enforce the transaction budget when computing costs
• e2f8cb1 feat(js): Utxo as CIP-30 pairs and handles; scriptHash, dataHash
• 1f4b38f feat(js): add the CBOR-first uplc and evaluator API, and evaluateTx
• d2b315a fix(js): keep Scalus methods callable when detached
• ebf3612 perf(js): build a Value's assets in one pass, not one merge per asset
• 07cc419 fix(js): read bigint inputs exactly, and reject what does not fit
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[solidsnakedev]

Skipped. Risky group (cardano-ecosystem) and CI failing: Test, Build.

[solidsnakedev]

Skipped: risky group (cardano-ecosystem), and CI failing: Test, Build.