[dielduarte]

tsx 4.21.0 depends on esbuild ~0.27.0, which keeps esbuild 0.27.5 in the lockfile (GHSA for the dev server's file read on Windows, fixed in 0.28.1). tsx 4.23.x moves to esbuild ~0.28.0.

Changes

• pnpm-workspace.yaml catalog: tsx 4.21.0 → 4.23.15 (2026-09-20).
• pnpm-lock.yaml: re-locked. esbuild 0.27.5 and its platform binaries drop out, leaving only 0.28.2. tsx 4.23 bundles get-tsconfig and resolve-pkg-maps, so those drop out too.

tsx runs our scripts (@react-email/ui build and dev, the editor's build:css, scripts/check-dependency-versions.ts); it isn't shipped. No changeset.

Testing

Suite	Result
render	90/90
react-email	319/319
ui	113/113
editor (unit + browser)	540/540
apps/web	36 passed, 68 skipped (same as canary)
render e2e	6 passed, 2 skipped (already it.skip)
react-email e2e	2/2

• pnpm install --frozen-lockfile, pnpm build, pnpm typecheck and scripts/check-dependency-versions.ts (run through tsx) pass. The lockfile is stable under another pnpm install --lockfile-only.
• Build output, canary vs this branch:
  • @react-email/editor dist (CSS built by tsx scripts/copy-css.ts): byte-identical.
  • @react-email/ui .next (built by tsx ./scripts/build.mts): same files; differences are only per-build server action IDs and module numbering.
• Preview server: email dev on apps/demo renders and hot-reloads, no page errors.

---

Summary by cubic

Bumps tsx from 4.21.0 to 4.23.15 so the lockfile only carries esbuild 0.28.2, removing the 0.27.5 version affected by the GHSA for the dev server's Windows file read (fixed in 0.28.1).

Dependencies

• tsx 4.23.15 moves to esbuild ~0.28.0 and drops get-tsconfig and resolve-pkg-maps from the lockfile since they are now bundled.
• Lockfile re-locked; esbuild 0.27.5 and its platform binaries are removed.

^{Written for commit 9ecfbef. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-email	Ready	Preview	Oct 29, 2026 1:50pm UTC
react-email-demo	Ready	Preview	Oct 29, 2026 1:50pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9ecfbef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[klotty]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Development-only tooling bump of tsx 4.21.0→4.23.15 to drop esbuild 0.27.5 (GHSA fixed in 0.28.1); lockfile-only change, not shipped, with full test suite passing.

View guided diff | Re-trigger cubic</sub>