Skip to content

fix: resolve CommonJS directory requires inside dependencies - #803

Merged
privatenumber merged 2 commits into
privatenumber:masterfrom
imevanc:fix/node-modules-extension-rewrite
May 31, 2026
Merged

fix: resolve CommonJS directory requires inside dependencies#803
privatenumber merged 2 commits into
privatenumber:masterfrom
imevanc:fix/node-modules-extension-rewrite

Conversation

@imevanc

@imevanc imevanc commented May 23, 2026

Copy link
Copy Markdown
Contributor

Problem

On Node 24+, a CommonJS require() inside a dependency flows through tsx's sync ESM hook, where directory-style specifiers (require('..'), require('process/')) were resolved to a file:// URL. Node's CommonJS resolver rejects file:// URLs in a require() context, so every candidate failed — including the real .js/.ts — and the last-tried .jsx surfaced:

Error: Cannot find module '.../node_modules/ajv/dist/compile/index.jsx'

Changes

In a CommonJS require() context, resolveDirectorySync:

  • defers bare specifiers with a trailing slash (e.g. require('process/')) to Node's package resolution;
  • resolves relative directories (require('..'), require('./dir/')) from a filesystem path, falling back to the directory's package.json main when no index file exists.

The ESM import path is unchanged.

Closes #800

torbjornvatn added a commit to torbjornvatn/tsx-json-bug that referenced this pull request May 28, 2026
Replace statuses/JSON repro with superagent-based HTTP fetch so the
test exercises tsx's CJS require() hook — the actual failure surface
on Node 24 where tsx wrongly rewrites intra-node_modules relative
paths (.js → .jsx/.ts etc.).

- swap statuses → superagent (CJS pkg with internal require() calls)
- src/status.ts: fetchJson() wraps superagent GET
- src/status.test.ts: offline local http server, two JSON round-trips
- add tsx-pr (file:../tsx-fix) — local build of PR #803 fix branch
- add test:pr script; drop @types/statuses
- update README to document new bug, fix, and all four test variants

Refs privatenumber/tsx#800, privatenumber/tsx#803
@privatenumber

Copy link
Copy Markdown
Owner

Thanks for kicking this off, @imevanc! I pushed a commit that extends it to fix the underlying cause more broadly.

The directory resolution was handing Node's CommonJS resolver a file:// URL, which it rejects in a require() context — so even the real .js/.ts file failed and the last-tried .jsx is what surfaced. It now resolves the implicit index from a filesystem path.

That also covers two related shapes from the same code path:

  • Bare package specifiers with a trailing slash. readable-stream does require('process/') to load its process dependency — the trailing slash deliberately selects the npm package over Node's builtin, so it's a bare specifier, not a relative path. tsx was resolving it against the parent dir (.../streams/process/index.jsx); it's now left to Node's normal package resolution.
  • Directory requires that resolve through a nested package.json main.

Added regression tests for each, and CI is green across the Node matrix.

@privatenumber privatenumber changed the title fix: resolve node-modules extension rewrite fix: resolve CommonJS directory requires inside dependencies May 31, 2026
@privatenumber
privatenumber merged commit 1ce8463 into privatenumber:master May 31, 2026
2 checks passed
@privatenumber

Copy link
Copy Markdown
Owner

This issue is now resolved in v4.22.4.

If you're able to, your sponsorship would be very much appreciated.

ahacop added a commit to changebot-ai/widgets that referenced this pull request Aug 24, 2026
[cb skip]

== 4.23.12

=== [4.23.12](privatenumber/tsx@v4.23.11...v4.23.12) (2026-08-10)


=== Bug Fixes

* shim `import.meta` when tokens are split by comments or newlines ([#829](privatenumber/tsx#829)) ([ed9d330](privatenumber/tsx@ed9d330)), closes [#828](privatenumber/tsx#828)

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.12)

== 4.23.11

=== [4.23.11](privatenumber/tsx@v4.23.10...v4.23.11) (2026-08-07)


=== Bug Fixes

* preserve async ESM require fallback ([55cbece](privatenumber/tsx@55cbece))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.11)

== 4.23.10

=== [4.23.10](privatenumber/tsx@v4.23.9...v4.23.10) (2026-08-07)


=== Bug Fixes

* support nyc coverage discovery ([#710](privatenumber/tsx#710)) ([ec1bcd5](privatenumber/tsx@ec1bcd5))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.10)

== 4.23.9

=== [4.23.9](privatenumber/tsx@v4.23.8...v4.23.9) (2026-08-06)


=== Bug Fixes

* map Node test locations ([2f55884](privatenumber/tsx@2f55884))
* support data URLs in tsImport ([b94f46f](privatenumber/tsx@b94f46f))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.9)

== 4.23.8

=== [4.23.8](privatenumber/tsx@v4.23.7...v4.23.8) (2026-08-05)


=== Bug Fixes

* preserve package subpath resolution ([be1315e](privatenumber/tsx@be1315e))
* preserve typeless ESM dependency exports ([70dfc5e](privatenumber/tsx@70dfc5e))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.8)

== 4.23.7

=== [4.23.7](privatenumber/tsx@v4.23.6...v4.23.7) (2026-08-05)


=== Bug Fixes

* prevent tsImport cache collisions ([4e5a138](privatenumber/tsx@4e5a138))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.7)

== 4.23.6

=== [4.23.6](privatenumber/tsx@v4.23.5...v4.23.6) (2026-08-05)


=== Bug Fixes

* compose resolver URL metadata ([5040762](privatenumber/tsx@5040762))
* preserve Node resolution with allowJs ([2046d9e](privatenumber/tsx@2046d9e))
* preserve resolver URL metadata ([a91df46](privatenumber/tsx@a91df46))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.6)

== 4.23.5

=== [4.23.5](privatenumber/tsx@v4.23.4...v4.23.5) (2026-08-02)


=== Bug Fixes

* detect the Node inspector enabled via NODE_OPTIONS ([3c1d051](privatenumber/tsx@3c1d051))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.5)

== 4.23.4

=== [4.23.4](privatenumber/tsx@v4.23.3...v4.23.4) (2026-08-02)


=== Bug Fixes

* **cli:** allow async process.once() signal handlers to finish ([#827](privatenumber/tsx#827)) ([2afc7bb](privatenumber/tsx@2afc7bb))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.4)

== 4.23.3

=== [4.23.3](privatenumber/tsx@v4.23.2...v4.23.3) (2026-08-02)


=== Bug Fixes

* preserve listenerCount overload semantics ([#823](privatenumber/tsx#823)) ([b6574d4](privatenumber/tsx@b6574d4))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.3)

== 4.23.2

=== [4.23.2](privatenumber/tsx@v4.23.1...v4.23.2) (2026-08-02)


=== Bug Fixes

* **watch:** exit with 128 + signal number when interrupted ([#820](privatenumber/tsx#820)) ([0b00bc8](privatenumber/tsx@0b00bc8))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.2)

== 4.23.1

=== [4.23.1](privatenumber/tsx@v4.23.0...v4.23.1) (2026-07-13)


=== Bug Fixes

* support tsImport after global preload ([8d4ffc2](privatenumber/tsx@8d4ffc2))
* **watch:** avoid clearing piped output ([95d0672](privatenumber/tsx@95d0672))
* **watch:** treat script and dependency paths literally ([79fddde](privatenumber/tsx@79fddde))


=== Performance Improvements

* index transform cache lazily ([e818ad6](privatenumber/tsx@e818ad6))
* load esbuild lazily in CLI ([d067938](privatenumber/tsx@d067938))
* map Node TypeScript formats directly ([cdcc623](privatenumber/tsx@cdcc623))
* use sync module hooks on Node v22.22.3+ ([f8992f1](privatenumber/tsx@f8992f1))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.1)

== 4.23.0

=== [4.23.0](privatenumber/tsx@v4.22.5...v4.23.0) (2026-07-03)


=== Bug Fixes

* avoid redundant filesystem probes during module resolution ([257bbbb](privatenumber/tsx@257bbbb)), closes [privatenumber/tsx#809](privatenumber/tsx#809)


=== Features

* add multi-scenario startup benchmark suite ([c178197](privatenumber/tsx@c178197)), closes [privatenumber/tsx#809](privatenumber/tsx#809) [#809](privatenumber/tsx#809) [hi#signal](https://github.com/hi/issues/signal) [privatenumber/tsx#145](https://github.com/privatenumber/tsx/issues/145) [#809](privatenumber/tsx#809)

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.23.0)

== 4.22.5

=== [4.22.5](privatenumber/tsx@v4.22.4...v4.22.5) (2026-07-02)


=== Bug Fixes

* isolate hook state per async module.register() registration ([a305f36](privatenumber/tsx@a305f36))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.5)

== 4.22.4

=== [4.22.4](privatenumber/tsx@v4.22.3...v4.22.4) (2026-05-31)


=== Bug Fixes

* resolve CommonJS directory requires inside dependencies ([#803](privatenumber/tsx#803)) ([1ce8463](privatenumber/tsx@1ce8463))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.4)

== 4.22.3

=== [4.22.3](privatenumber/tsx@v4.22.2...v4.22.3) (2026-05-19)


=== Bug Fixes

* decode typed loader source ([dce02fc](privatenumber/tsx@dce02fc))
* preserve entrypoint with TypeScript preload hooks ([68f72f3](privatenumber/tsx@68f72f3))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.3)

== 4.22.2

=== [4.22.2](privatenumber/tsx@v4.22.1...v4.22.2) (2026-05-18)


=== Bug Fixes

* preserve CJS JSON require in ESM hooks ([35b700b](privatenumber/tsx@35b700b))
* preserve named exports from CommonJS TypeScript ([11de737](privatenumber/tsx@11de737))
* support module.exports require(esm) interop ([cf8f199](privatenumber/tsx@cf8f199))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.2)

== 4.22.1

=== [4.22.1](privatenumber/tsx@v4.22.0...v4.22.1) (2026-05-17)


=== Bug Fixes

* resolve tsconfig path aliases containing a colon ([#780](privatenumber/tsx#780)) ([6979f28](privatenumber/tsx@6979f28))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.1)

== 4.22.0

=== [4.22.0](privatenumber/tsx@v4.21.1...v4.22.0) (2026-05-14)


=== Features

* upgrade esbuild to 0.28 ([#789](privatenumber/tsx#789)) ([b29f6ee](privatenumber/tsx@b29f6ee))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.22.0)

== 4.21.1

=== [4.21.1](privatenumber/tsx@v4.21.0...v4.21.1) (2026-05-14)


=== Bug Fixes

* support Node 20.11/21.2 import.meta paths ([acf3d8f](privatenumber/tsx@acf3d8f))
* support Node.js 24.15.0 ([c1d2d45](privatenumber/tsx@c1d2d45))
* support Node.js 26.1.0 and 25.9.0 ([1d7e528](privatenumber/tsx@1d7e528))

---
This release is also available on:
- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tsx/v/4.21.1)

Release notes: https://github.com/privatenumber/tsx/releases
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Node 24: tsx incorrectly resolves .js files in node_modules to .jsx/.tsx extensions

2 participants