build(deps-dev): bump tsx from 3.14.0 to 4.0.0 in /single-pool/js/packages/classic

[dependabot]

Bumps tsx from 3.14.0 to 4.0.0.

Release notes

Sourced from tsx's releases.

v4.0.0

4.0.0 (2023-11-09)

Bug Fixes

• emit transformation warnings via stderr (97f9485)

Features

• cjs: allow query in import specifier (#366) (b32b135)
• drop support for outdated Node.js versions (#324) (acb709c)
• rename env vars to use TSX prefix (#372) (a06da32)
• resolver: support tsx,jsx extensions (#367) (c6133e5)

Performance Improvements

• check if js needs compilation (#365) (4853443)
• strip source map when unused (#374) (0e83db7)

BREAKING CHANGES

• Rename env vars prefix from ESBK_ to TSX_
• only Node.js LTS versions v18 and up are now supported

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 2995601 test: improve flaky test (#375)
• 0e83db7 perf: strip source map when unused (#374)
• c6133e5 feat(resolver): support tsx,jsx extensions (#367)
• 4853443 perf: check if js needs compilation (#365)
• b32b135 feat(cjs): allow query in import specifier (#366)
• ddf6fcc test(repl): refactor to use processInteract (#373)
• a06da32 feat: rename env vars to use TSX prefix (#372)
• f8a8540 chore: change repository org (#371)
• 3375e62 test: refactor to smoke test (#360)
• acb709c feat: drop support for outdated Node.js versions (#324)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mergify]

automerge label removed due to a CI failure

[2501babe]

@joncinque i notice you ported us to pnpm, nice work! why do we have a global lockfile tho? is there something you did so that the lockfile works with ci on your packages?

[dependabot]

Superseded by #5802.

[joncinque]

I was getting fed up merging the same exact dependabot pull request 5 times for each JS library every day, and was hoping that a global lockfile would make things simpler to manage. It's not clear how dependabot handles pnpm workspaces, so I decided to just roll the dice and give it a shot.

It might need some more tweaks because if you point it at each sub-project, it doesn't update the lockfile, as you noticed. And it also hasn't created any new PRs today (except for recreating the tsx ones, but those might have been grandfathered in).

We might need to add a repo-level package.json, which is fine, since that'll be needed to use a different build tool like turbo.

[2501babe]

yea looking at the new file it seems like the problem is theres no package.json to update in the root so it just does nothing. but just making a fake package.json would result in it making broken prs because it wouldnt update the local ones. and im not sure if its possible to get rid of the local packages json because the concept of pnpm workspaces seems to be similar to cargo where everything has its Cargo.toml

a simple solution would be if dependabot can execute some post-hook like "after updating a dependency cd to the root and pnpm i to update the lockfile" but that doesnt fix the one pr per package problem. alternatively if theres a smarter logic like "search all packages json for this dep and update it in all of them and then cd to root and pnpm i"... but idk if it provides that level of control or if we would be writing our own tooling at that point lol

[joncinque]

Yeah I see what you mean. I'll try making a top-level package.json similar to https://github.com/solana-labs/solana-web3.js/blob/master/package.json and see if that fixes the dependabot stuff, since web3.js has working dependabot PRs.

I was meaning to do it anyway so we can use turbo to build and avoid having to manually specify dependencies to build during CI scripts.