chore(deps): bump the patch-deps-updates-main group with 5 updates

[dependabot]

Bumps the patch-deps-updates-main group with 5 updates:

Package	From	To
@lambdatest/node-tunnel	4.0.12	4.0.13
browserstack-local	1.5.13	1.5.16
xpath	0.0.34	0.0.35
happy-dom	20.14.0	20.14.6
tsx	4.23.13	4.23.15

Updates @lambdatest/node-tunnel from 4.0.12 to 4.0.13

Release notes

Sourced from @​lambdatest/node-tunnel's releases.

prod-4.0.13

What's Changed

• fix(security): replace adm-zip with node-stream-zip (CVE-2026-76845) [TE-27044] by @​rachit-lambdatest in LambdaTest/node-tunnel#60

Full Changelog: LambdaTest/node-tunnel@prod-4.0.12...prod-4.0.13

Commits

• b1de2e4 Merge pull request #60 from rachit-lambdatest/TE-27044-replace-adm-zip
• 2137511 chore(release): bump version to 4.0.13
• 2d1dd59 fix(security): replace adm-zip with node-stream-zip for tunnel binary extraction
• See full diff in compare view

Updates browserstack-local from 1.5.13 to 1.5.16

Commits

• 09d9722 1.5.16
• 368f94e Merge pull request #187 from browserstack/sdk-7713-reuse-running-binary
• cfe59ce Look for BrowserStackLocal.exe on Windows before downloading
• 69b1a39 Reuse a running binary instead of replacing it
• 1e479a6 1.5.15
• a484a46 Merge pull request #185 from browserstack/loc-7420-busy-binary-download
• 2ee720a Replace an unusable binary rather than re-spawning it
• 0a426a3 Complete the async callback contract on every download path
• eecad0c LOC-7420: tolerate a busy binary instead of crashing the consumer
• 8096a53 1.5.14
• Additional commits viewable in compare view

Updates xpath from 0.0.34 to 0.0.35

Commits

• See full diff in compare view

Updates happy-dom from 20.14.0 to 20.14.6

Release notes

Sourced from happy-dom's releases.

v20.14.6

👷‍♂️ Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

v20.14.5

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #2409

v20.14.4

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #2363

v20.14.2

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #2366

Commits

• f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
• 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
• 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
• 5fb1df3 fix: #2363 Avoids cloning all properties in CSSPropertyManager.toString() (...
• de0a1e9 fix: #2344 Resolve every var() in a value, not only the first one (#2395)
• 64b8b94 fix: #2366 Invalidate the computed style cache for the whole subtree (#2367)
• See full diff in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions