#3838 chore(deps): bump tsx to 4.23.15

tsx 4.21.0 depends on esbuild ~0.27.0, which keeps esbuild 0.27.5 in the lockfile (GHSA for the dev server's file read on Windows, fixed in 0.28.1). tsx 4.23.x moves to esbuild ~0.28.0.

Changes

• pnpm-workspace.yaml catalog: tsx 4.21.0 → 4.23.15 (2026-09-20).
• pnpm-lock.yaml: re-locked. esbuild 0.27.5 and its platform binaries drop out, leaving only 0.28.2. tsx 4.23 bundles get-tsconfig and resolve-pkg-maps, so those drop out too.

tsx runs our scripts (@react-email/ui build and dev, the editor's build:css, scripts/check-dependency-versions.ts); it isn't shipped. No changeset.

Testing

Suite	Result
render	90/90
react-email	319/319
ui	113/113
editor (unit + browser)	540/540
apps/web	36 passed, 68 skipped (same as canary)
render e2e	6 passed, 2 skipped (already it.skip)
react-email e2e	2/2

• pnpm install --frozen-lockfile, pnpm build, pnpm typecheck and scripts/check-dependency-versions.ts (run through tsx) pass. The lockfile is stable under another pnpm install --lockfile-only.
• Build output, canary vs this branch:
  • @react-email/editor dist (CSS built by tsx scripts/copy-css.ts): byte-identical.
  • @react-email/ui .next (built by tsx ./scripts/build.mts): same files; differences are only per-build server action IDs and module numbering.
• Preview server: email dev on apps/demo renders and hot-reloads, no page errors.

---

Summary by cubic

Bumps tsx from 4.21.0 to 4.23.15 so the lockfile only carries esbuild 0.28.2, removing the 0.27.5 version affected by the GHSA for the dev server's Windows file read (fixed in 0.28.1).

Dependencies

• tsx 4.23.15 moves to esbuild ~0.28.0 and drops get-tsconfig and resolve-pkg-maps from the lockfile since they are now bundled.
• Lockfile re-locked; esbuild 0.27.5 and its platform binaries are removed.