Update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	20.19.42 → 20.19.43
jose	6.2.3 → 6.2.10
tsx (source)	4.21.0 → 4.23.12

---

Release Notes

panva/jose (jose)

v6.2.10

Compare Source

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

v6.2.4

Compare Source

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

privatenumber/tsx (tsx)

v4.23.12

Compare Source

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#​829) (ed9d330), closes #​828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

Compare Source

v4.23.10

Compare Source

Bug Fixes

• support nyc coverage discovery (#​710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

Compare Source

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

Compare Source

Bug Fixes

• preserve package subpath resolution (be1315e)
• preserve typeless ESM dependency exports (70dfc5e)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.7

Compare Source

Bug Fixes

• prevent tsImport cache collisions (4e5a138)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.6

Compare Source

v4.23.5

Compare Source

v4.23.4

Compare Source

Bug Fixes

• cli: allow async process.once() signal handlers to finish (#​827) (2afc7bb)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.3

Compare Source

Bug Fixes

• preserve listenerCount overload semantics (#​823) (b6574d4)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.2

Compare Source

v4.23.1

Compare Source

Bug Fixes

• support tsImport after global preload (8d4ffc2)
• watch: avoid clearing piped output (95d0672)
• watch: treat script and dependency paths literally (79fddde)

Performance Improvements

• index transform cache lazily (e818ad6)
• load esbuild lazily in CLI (d067938)
• map Node TypeScript formats directly (cdcc623)
• use sync module hooks on Node v22.22.3+ (f8992f1)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.0

Compare Source

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #​809 hi#signal privatenumber/tsx#145 #​809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

Compare Source

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.4

Compare Source

Bug Fixes

• resolve CommonJS directory requires inside dependencies (#​803) (1ce8463)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.3

Compare Source

Bug Fixes

• decode typed loader source (dce02fc)
• preserve entrypoint with TypeScript preload hooks (68f72f3)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.2

Compare Source

Bug Fixes

• preserve CJS JSON require in ESM hooks (35b700b)
• preserve named exports from CommonJS TypeScript (11de737)
• support module.exports require(esm) interop (cf8f199)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.1

Compare Source

Bug Fixes

• resolve tsconfig path aliases containing a colon (#​780) (6979f28)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.0

Compare Source

Features

• upgrade esbuild to 0.28 (#​789) (b29f6ee)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.21.1

Compare Source

Bug Fixes

• support Node 20.11/21.2 import.meta paths (acf3d8f)
• support Node.js 24.15.0 (c1d2d45)
• support Node.js 26.1.0 and 25.9.0 (1d7e528)

---

This release is also available on:

• npm package (@​latest dist-tag)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 12:00 on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.