fix(deps): update dependency tsx (4.22.4 → 4.22.5)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
tsx (source)	4.22.4 → 4.22.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

privatenumber/tsx (tsx)

v4.22.5

Compare Source

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

---

Recommendation

Approve. This PR bumps tsx from 4.22.4 to 4.22.5, a single patch release containing only one internal bug fix (isolating hook state per async module.register() registration). No breaking API changes, no new dependencies, and the bump stays within the existing ^4.22.1 semver range in package.json. CI has already confirmed all checks pass.

---

Change-by-Change Findings

package-lock.json

• tsx 4.22.4 → 4.22.5 (devDependency): Patch release. The resolved tarball URL and integrity hash both update correctly, confirming a real upstream publish.
• Root entry gains "hasInstallScript": true: This is an artifact of npm install regenerating the lockfile in a project that has a postinstall script (prisma generate). It is not a dependency change and is harmless.

No source files, schema, or configuration were modified.

---

Sources

• tsx v4.22.5 release (GitHub release): single bug fix — "isolate hook state per async module.register() registration" ([commit a305f36](upstream privatenumber/tsx commit a305f365f0cbcc31a44549dcbb0e63dc2883e96d)). No API surface changes, no new options, no deprecations.
• GitHub compare (4.22.4 → 4.22.5): five commits total; four are test additions, one is the bug fix. No breaking changes.
• package.json: tsx is pinned as "^4.22.1" in devDependencies, so 4.22.5 is within the existing caret range — no constraint change needed.
• CI results (authoritative, from CI status API): Build ✓, Typecheck ✓, Lint ✓, Tests ✓, Docker Build ✓, review ✓.

---

Standards Compliance

• Semver discipline — Patch bump (4.22.4 → 4.22.5) within the existing ^4.22.1 range. No package.json version constraint change.
• Lockfile hygiene — Only package-lock.json touched; no source, schema, or config drift.
• No agent-specific names in generic docs — N/A; no docs changed.
• Tech stack alignment — tsx is a devDependency only (used via npm run mcp:stdio for the MCP stdio server). The bump does not touch Prisma, Next.js, or any production dependency.

---

Linked Issue Fit

No linked issue was provided. The change is a routine dependency patch update and does not require issue-level acceptance criteria.

---

Must-Check Items (from PR classification)

#	Must-check item	Verification
1	Check for breaking API changes in updated dependencies	Verified — passed. tsx 4.22.5 is a patch release. Upstream release notes list only one internal bug fix with no API surface changes, no new options, and no deprecations. The upstream compare confirms five commits: four are test additions and one is the bug fix.
2	Run full test suite after upgrade	Verified — passed. CI ran all checks against commit 5ffc4da88be1bad02a9fbdad5d92ddac25458215. Tests, Typecheck, Lint, Build, and Docker Build all completed with success status.

---

Evidence Provider Findings

None provided in corpus.

---

Tool Harness Findings

None provided in corpus.

---

Unknowns / Needs Verification

None. Both required checks are satisfied by the available evidence. The CI run already covered build, typecheck, lint, and tests — all green. The hasInstallScript: true flag on the root lockfile entry reflects the existing postinstall hook and is expected behavior, not a concern.

---

Verdict: Approve. Low-risk patch upgrade; no breaking changes; all required checks verified by CI.