[dependabot]

Bumps tsc-alias from 1.9.9 to 1.9.10.

Release notes

Sourced from tsc-alias's releases.

v1.9.10 (2026-10-31)

🚀 Release v1.9.10

🌟 New Features & Enhancements

• Configurable Bare Package Subpath Resolution (resolvePackageSubpaths) : You can now explicitly control whether --resolve-full-paths appends extensions to third-party package subpaths (e.g., next/font/google).

  When using bundlers or packages without an exports field (like Next.js), you can prevent unwanted file extensions from breaking virtual/magic imports.

---

⚙️ How to use

Via tsconfig.json

{
  "compilerOptions": {
    "moduleResolution": "node"
  },
  "tsc-alias": {
    "resolveFullPaths": true,
    "resolvePackageSubpaths": false
  }
}

Via CLI

# Keep relative and alias extensions, but preserve bare package subpaths
tsc-alias --resolve-full-paths --no-resolve-package-subpaths

Via API

await replaceTscAliasPaths({
  resolveFullPaths: true,
  resolvePackageSubpaths: false
});

---

🐛 Bug Fixes & Smarter Defaults

• Default to false for moduleResolution: "bundler": If your tsconfig.json specifies "moduleResolution": "bundler" (or "Bundler"), bare package subpaths are automatically preserved as written by default.
• Full opt-out for moduleResolution: "node": Libraries built for bundlers with "moduleResolution": "node" can now cleanly opt out without staying locked on v1.9.7.

Commits

• e314a74 1.9.10
• 4f5e0fd chore(ci): update pnpm to v12
• 4d2c016 chore: replace @​esfx/collections-hashmap with @​nestjs/common
• 63cee2f feat: add resolvePackageSubpaths option to control package subpath resolution
• a89851b Merge pull request #293 from justkey007:dependabot/npm_and_yarn/ip-address-10...
• 43dfaf0 Merge pull request #294 from awais-ur-rehman/tsc-alias:feat/preserve-bundler-...
• 22559d9 fix: preserve bundler package subpaths
• 344ac2d chore(deps): bump ip-address from 10.7.2 to 10.7.5
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​tsc-alias@​1.9.9 ⏵ 1.9.10				+1

View full report