chore: bump tsx from 4.21.0 to 4.23.12

[dependabot]

Bumps tsx from 4.21.0 to 4.23.12.

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

[claude]

Claude finished @dependabot[bot]'s task in 2m 14s —— View job

---

Dependency review: tsx 4.21.0 → 4.23.12

• Identify version change / semver scope
• Check where tsx is used in the repo
• Review release notes for behaviour changes
• Verify lockfile-only diff & CI status

Verdict: safe to merge. Minor bump within 4.x, satisfies the existing "tsx": "^4.19.0" range, and the diff is package-lock.json only — no package.json, source, or workflow changes.

What actually changed

The visible surface is bigger than the tsx bump suggests: tsx's esbuild dependency moved from ~0.27.0 to ~0.28.0, so the lockfile also swaps esbuild 0.27.7 → 0.28.2 plus all 20-odd @esbuild/* platform binaries (package-lock.json:2574-2580, 1264-1266). That's where the 111/135 line churn comes from.

esbuild is pre-1.0, so a 0.27 → 0.28 step is a breaking release by its own convention. Blast radius is narrow, though:

• tsx is used in exactly one place: "generate-catalog": "tsx scripts/generate-catalog.ts" (package.json:20).
• vite@8.2.1 builds on rolldown, not esbuild (package-lock.json:2653-2658) — esbuild is only an optional peer there (^0.27.0 || ^0.28.0, satisfied by 0.28.2). So the vitest transform pipeline is untouched; there's a single hoisted esbuild in the tree and it exists solely for tsx.
• npm run build is plain tsc. Nothing in the shipped dist/ touches tsx or esbuild — both are dev: true.

Release notes across the range are all bug fixes (import.meta shimming in CommonJS, nyc coverage discovery, tsImport data URLs, Node test location mapping). None apply here: scripts/generate-catalog.ts runs as ESM ("type": "module") even though it does use import.meta.url at line 8, so the CJS shim fixes are adjacent but not on this path. tsx engines.node stays >=18 and esbuild 0.28's is >=18, both under the repo's >=22 floor.

The one real gap

CI never runs tsx. ci.yml does npm ci → build → test → .mcpb smoke test; nothing invokes generate-catalog. The only consumer of the thing this PR upgrades is update-catalog.yml, which runs weekly against the live OpenAPI spec. So the green check on this PR proves the lockfile installs and resolves — not that the catalog generator still works under esbuild 0.28.

Suggested pre-merge check, since the workflow already has workflow_dispatch (update-catalog.yml:6):

gh workflow run update-catalog.yml --ref dependabot/npm_and_yarn/tsx-4.23.12

If it produces a no-op or a clean catalog diff, esbuild 0.28 is fine end-to-end. Otherwise the failure surfaces next Monday on a bot PR instead, which is a worse place to find it.

Minor notes

• Dependabot flags a releaser change: tsx is now published by GitHub Actions rather than the previous human releaser. That's the normal direction of travel (CI publishing with provenance) and not suspicious on its own, but given this repo's posture (SHA-pinned actions, harden-runner, npm provenance on release) it's worth a glance at the npm provenance attestation for tsx@4.23.12 before merging.
• Pre-existing, not from this PR: engines.node is ">=22" while dev-dep vite@8 requires ^20.19.0 || >=22.12.0 (package-lock.json:2664). Dev-only, and setup-node's '22' resolves to a recent 22.x so CI passes — but the declared floor is looser than the dev toolchain actually supports. Came in with the vitest 3→4 bump.

No changes made — review only.
· dependabot/npm_and_yarn/tsx-4.23.12