chore(deps-dev): bump the npm-deps group across 1 directory with 2 updates

[dependabot]

Bumps the npm-deps group with 2 updates in the / directory: @types/node and tsx.

Updates @types/node from 26.1.1 to 26.6.5

Commits

• See full diff in compare view

Updates tsx from 4.23.1 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​26.1.1 ⏵ 26.6.5	+1		+1
	npm/​tsx@​4.23.1 ⏵ 4.23.15

View full report

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[claude]

🟡 (optional) After this bump, CI tests the MCP bridge with tsx 4.23.15, but the bridge and agent images still install tsx 4.23.1. A green test run no longer covers the runtime that ships. test:mcp-bridge runs tsx --test shared/tempo/mcp-bridge/server.test.ts with the locked tsx. Both Dockerfiles still run npm install --global tsx@ 4.23.1. Fix: use one tsx version everywhere, e.g. change tsx@ 4.23.1 to tsx@ 4.23.15 in shared/tempo/mcp-bridge/Dockerfile:3 and shared/global/docker/agent/Dockerfile:16 in this PR, or have the images install from the root lockfile.

Why this was flagged

package.json:61 raises tsx to ^4.23.15, and package-lock.json now resolves 4.23.15. The test:mcp-bridge script in package.json and the check script that chains it run server.ts and server.test.ts under that version. The shipped bridge image runs CMD ["tsx", "server.ts"] after npm install --global tsx@ 4.23.1 (shared/tempo/mcp-bridge/Dockerfile:3-5). The agent image also pins tsx@ 4.23.1 (shared/global/docker/agent/Dockerfile:16). On the base branch the local lockfile and both images used tsx 4.23.1. After merge they differ by 14 patch releases, which include changes to import.meta shimming, the shared transform cache and CJS/ESM interop. Nothing ties the pins together: a repo-wide grep for tsx@ finds only these two Dockerfiles, and no check compares them with package.json. So code that relies on a 4.23.2+ fix passes npm run check and then fails inside the containers. server.ts does not use import.meta or tsImport today, so the impact is a future regression that CI cannot catch, not a current break.

Verification: On the base commit, package.json:61 had "tsx": "^4.23.1" and the lockfile resolved tsx-4.23.1.tgz. After the change, package.json:61 is "^4.23.15" and the lockfile resolves tsx-4.23.15.tgz. The diff does not touch either Dockerfile, so both still pin 4.23.1. A green npm run check therefore no longer exercises the tsx version that ships in either image.