[dependabot]

Bumps the npm-patch group with 2 updates in the /bridge-node directory: @cursor/sdk and tsx.

Updates @cursor/sdk from 1.0.23 to 1.0.40

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by arousselxai, a new releaser for @​cursor/sdk since your current version.

Updates tsx from 4.23.1 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[matdev83]

Closing as superseded rather than merging the two updates together.

The SDK half is not a patch. @cursor/sdk 1.0.23 is the certified baseline this repository's bridge and package lanes assert (PinnedSDKVersion, the lockfile check, and the packaged-manifest pin). Dependabot classified 1.0.23 -> 1.0.40 as a semver patch and swept it into the npm-patch group, although the config says that baseline is deliberately not automated. Beyond the version assertion, 1.0.40 changes the SDK's dependency closure (drops @connectrpc/connect-node, adds a zod peer) and is published by a new releaser, so it needs a deliberate upgrade with re-certification - not an unattended patch merge. The config was fixed in #24 so this cannot recur.

The tsx half is valid. It is carried in #25: tsx 4.23.1 -> 4.23.15, verified with npm ci, typecheck, build, and 108/108 bridge tests.

An SDK upgrade remains a good follow-up, but it should own the pin, fixtures, docs, and certification evidence in one reviewed change.