chore: bump tsx from 4.21.0 to 4.23.13

[dependabot]

Bumps tsx from 4.21.0 to 4.23.13.

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 2m 3s —— View job

---

Dependency review: tsx 4.21.0 → 4.23.13

• Read PR context and package.json
• Confirm semver scope and lockfile-only change
• Review release notes for breaking/behaviour changes
• Check how tsx is used in this repo
• Check CI result (could not install/run locally — npm ci isn't in my allowed tools; relied on the PR's own CI)
• Post review summary

Verdict: safe to merge. Minor bump inside 4.x, no major crossing. One thing worth knowing before you click merge, in the "green CI doesn't cover this" sense rather than the "this is broken" sense.

---

What actually changed

package.json already declares "tsx": "^4.19.0" (line 46), which permits 4.23.13, so this is a lockfile-only pin refresh — consistent with how the earlier bumps in this repo landed (b8e1119 touched only package-lock.json too). No manifest change is needed or expected.

The substantive part of the 111/-135 diff isn't tsx itself — it's the transitive esbuild 0.27.7 → 0.28.2 (package-lock.json:1281), because tsx moved its dependency range to esbuild: ~0.28.0 (package-lock.json:2600). Two notes on that:

• esbuild is pre-1.0 and treats minor bumps as its breaking-change channel, so 0.27→0.28 is not a patch-grade move in spirit.
• The lockfile has a single, hoisted node_modules/esbuild, shared by tsx and by vite/vitest. So this bump swaps the transform engine under your test runner too, not just under the catalog script. Vite's peer range is ^0.27.0 || ^0.28.0 (package-lock.json:2693), so there's no peer conflict, and CI passing on Node 22 and 24 is real evidence for the vitest half.

Dependency-tree shrinkage: get-tsconfig and resolve-pkg-maps are the only removed entries — tsx now bundles them. No exposure here: tsconfig.json declares no paths, and tsx only transpiles (it never type-checks), so strict: true and the NodeNext + .js-extension convention are untouched.

tsx@4.23.13 declares engines.node: >=18, comfortably under this repo's >=22 floor — no pressure on the Node floor, so none of the coupled version sites in CLAUDE.md need to move.

Release notes vs. this codebase

The fixes across 4.21.0…4.23.13 are: CJS import.meta shimming when tokens are split by comments/newlines (#829), async ESM require fallback, nyc coverage discovery (#710), Node test-location and source-map stack mapping, and a bounded shared transform cache (#835).

None of these land on this repo's usage. tsx has exactly one consumer — npm run generate-catalog → scripts/generate-catalog.ts — and that file is pure ESM under "type": "module", using import.meta.url directly (scripts/generate-catalog.ts:8). The import.meta shim fixes are CJS-path-only, and the cache bound (#835) is a memory fix, not a behaviour change you'd notice on a single short script.

The one concrete risk

CI never exercises tsx. ci.yml runs build + test + the .mcpb smoke test; npm run generate-catalog appears only in update-catalog.yml:33. So the green check on this PR validates the esbuild swap for vitest and says nothing about the only script tsx actually runs. A regression here wouldn't surface until next Monday's 07:00 UTC catalog job, as a confusing failure on an unrelated PR.

Cheap way to close that gap before merging — on this branch:

npm ci && npm run generate-catalog && git diff --stat src/catalog.json

Expect it to complete and leave src/catalog.json unchanged (or changed only by genuine upstream spec drift, since the generator fetches the live https://app.kosli.com/api/v2/openapi.json). That live fetch is also why this can't just be added to ci.yml as a hermetic step. update-catalog.yml does have workflow_dispatch, so it can be dispatched against this branch — but that opens a catalog PR as a side effect, so the local run is the tidier check.

Minor supply-chain observation, no action implied: the release notes flag that tsx is now published by GitHub Actions, a new releaser for tsx. That's a publish-pipeline change on the upstream project (generally a hardening move, and it comes with npm provenance). tsx is a devDependency and files: ["dist"] means it never ships to consumers, so the blast radius is your dev machines and the weekly catalog job.

Suggested follow-up (optional, not this PR)

Consider a --dry-run mode on generate-catalog that reads a checked-in spec fixture instead of the network, so ci.yml can smoke-test the tsx path on every PR. Right now tsx upgrades are effectively unverified until the weekly job runs. Fix this →

---

I did not run the build, tests, or the catalog generator myself — npm ci requires approval in this environment and there's no node_modules in the checkout, so the CI-result reference above is the extent of the verification I could do.
· dependabot/npm_and_yarn/tsx-4.23.13