CHANGELOG.md

15.18.2

Performance:

• Fixed a regression in 14.0.0 where each message sent from the Cypress server to a Chromium-based browser (including Electron) leaked a small amount of browser memory until the end of the spec. During long, command- or network-heavy specs, this buildup could crash the browser (We detected that the Chrome Renderer process just crashed). Fixes #34226.
• Fixed an issue where each cy.press() call in Chromium-based browsers retained a small amount of renderer memory for the remainder of the spec file, which could contribute to memory growth in specs with many cy.press() calls. Addressed in #34240.

Bugfixes:

• Fixed an issue where, on Windows, enhancing a test failure stack could throw a secondary TypeError: Cannot read properties of undefined (reading 'replaceAll') and mask the original error. Fixed in #34252.
• Fixed an issue where experimentalMemoryManagement could fail to prevent the browser from running out of memory and crashing when Cypress was running inside a memory-limited container. Memory is now managed correctly in these environments. Fixes #34104. Addressed in #34123.

Misc:

• Corrected the @default value in the TypeScript type definitions for the videoCompression configuration option from 32 to false. Addressed in #34198.

15.18.1

Performance:

• Verifying that the Cypress binary can run, which happens the first time a newly installed version is used (before cypress open or cypress run) and whenever cypress verify is invoked, now completes more quickly. Addressed in #34133.

Bugfixes:

• Fixed an issue where Cypress could hang until the spec timed out if the browser process crashed mid-run (for example, an out-of-memory or GPU crash) while video recording was disabled. The current spec now fails and the run continues to the next spec as expected. Fixed in #34126.
• Fixed an issue where asserting focus with Chai's property syntax, such as expect($el).to.have.focus or expect($el).to.be.focused, raised a TypeScript error (Property 'focus' does not exist on type 'Assertion') even though the assertion works at runtime. Fixes #23905. Fixed in #34177.
• Fixed an issue where cy.type() fired the simulated keyup event in the same turn as keydown and input, so keyup handlers that read state updated asynchronously in an input listener could observe stale values. keyup is now deferred to the next microtask, matching real browser event ordering. Fixes #14864. Fixed in #34068.
• Fixed an issue where headless WebKit used the host machine's devicePixelRatio instead of a standard value of 1. Headless WebKit now matches headless Chrome, so screenshots taken during cypress run are consistent regardless of the host's DPI (for example 2x locally versus 1x in CI) and text is no longer fuzzy on high-DPI displays. Applies when experimentalWebKitSupport is enabled. Fixes #23808. Fixed in #34088.
• Fixed an issue where the userAgent configuration option was not applied when running tests in the experimental WebKit browser. Fixes #33349.
• Fixed an issue where, in the experimental WebKit browser, a request to focus the browser window was silently ignored, so the window could remain in the background. The active page is now correctly brought to the front. Addressed in #34137.
• Fixed an issue where opening an unconfigured project from a git repository sub-directory (such as a monorepo package) skipped project setup. Additionally, the component testing setup wizard now reliably displays the auto-detected framework and bundler. Fixes #27410 and #29544. Fixed in #34129 and #34212.
• Fixed an issue where interacting with an element inside a horizontally-scrollable container could scroll the element to the container's right edge, placing it underneath a right-floating position: sticky or position: fixed element and causing the action to fail or land on the wrong element. Elements are now scrolled to their top, leftmost point as documented. Fixes #33884. Fixed in #34108.
• Fixed a regression in 15.17.0 where cypress run --spec printed a spurious The following --spec pattern did not match any spec files and will be ignored warning for patterns that actually did match spec files, such as patterns using regex-style alternation groups (for example cypress/e2e/(a|b)/*.js). Fixes #34160.

Dependency Updates:

• Upgraded esbuild from 0.28.0 to 0.28.1 to address a Resources Downloaded over Insecure Protocol vulnerability reported in security scans. Addressed in #34211.

15.18.0

Performance:

• Fixed an issue where an application that repeatedly threw the same uncaught exception (for example, a benign ResizeObserver loop ... notification fired on every animation frame) could exhaust renderer memory and crash the browser. Consecutive identical uncaught exceptions within a test now collapse into a single, updating command-log entry, and a handled (suppressed) uncaught exception no longer captures a DOM snapshot. Addresses #27415.

Features:

• Added a removeSRIAttributes configuration option. When enabled, Cypress strips the integrity attribute from <script> and <link> elements on first-party resources so they are not blocked by Subresource Integrity (SRI) enforcement after Cypress rewrites them. This covers integrity set via static HTML, a JavaScript string literal, and runtime DOM assignment (including the webpack-subresource-integrity pattern used for lazily-loaded chunks). Addresses #34124 and #18315.

Bugfixes:

• Fixed an issue where calling req.destroy() or using { forceNetworkError: true } inside a cy.intercept() handler in experimental WebKit caused infinite request loops. Fixes #23810. Fixed in #33948.
• Fixed an issue where the before:spec plugin event fired twice for the same spec when a test navigated to a cross-origin URL via cy.visit(). Affects cypress run and cypress open with experimentalInteractiveRunEvents enabled. The event now fires exactly once per spec run, regardless of how many times the runner page reloads internally during cross-origin navigation. Fixes #26300.
• Fixed an issue where setting numTestsKeptInMemory to a value greater than 0 from setupNodeEvents would take effect during cypress run, which could prevent snapshots from being captured correctly when recording Test Replay to Cypress Cloud. During cypress run, numTestsKeptInMemory is now always treated as 0 regardless of how it is configured. Fixes #31167.
• Fixed an issue where, when Cypress was installed in a read-only location, running tests in Firefox or Chrome could log a cannot delete profileDir on exit error (EACCES/EPERM) and leave the browser profile directory behind, requiring manual cleanup before the next run. Cypress now removes the profile directory on exit as expected. Fixes #31300.
• Fixed an issue where the resolved remote origin (for example, Cypress.config('remote').origin) could include an explicit default port (:80 for HTTP or :443 for HTTPS) or embedded credentials when the visited URL contained them, which did not match the origin reported by the browser. The reported origin now always matches the browser's location.origin, omitting default ports and any embedded credentials. Fixes #28369. Fixed in #34050.
• Fixed an issue where cy.screenshot() could still capture changing pixels from some running web animations. Fixes #29144.
• Fixed an issue where, during cypress run with experimentalSingleTabRunMode and the experimental WebKit browser, component test runs with video recording enabled would only record the first spec's video and could then hang without exiting. Each spec is now recorded to its own video and the run exits normally. Fixes #23815.
• Fixed an issue where running component tests with the experimentalSingleTabRunMode experiment enabled could cause a spec to fail intermittently after many other specs had run in the same browser tab, even though that spec passed when run on its own. Fixes #24146.
• Fixed an issue where passing a cy.fixture() alias to cy.selectFile() attached the file without its name in a second or later test that loaded the same fixture (for example, when the same fixture is reused across multiple tests), causing servers to reject the upload as a missing file. The file name is now preserved every time the fixture is used. Fixes #21936.
• Fixed a regression in 15.17.0 where loading the Cypress configuration could fail with TransformError: Internal error: Expected id N but got id M when the project has the same esbuild version installed that Cypress bundles internally (currently 0.28.0) and a dependency loaded during config processing registers its own tsx loader. The tsx loader Cypress uses to load the configuration file is now removed from NODE_OPTIONS before the configuration file is sourced, so it no longer executes inside worker threads spawned by the project's own dependencies. Fixes #34076.
• Fixed an issue where cy.request() in Firefox did not send Secure cookies to localhost or loopback addresses such as 127.0.0.1 over http, even though browsers treat those origins as secure contexts. A Secure cookie set over https on such a host is now included on subsequent http requests to that host in Firefox, matching the browser's own behavior and how Cypress already behaves in Chrome. Fixes #24332.
• Fixed an issue where a transient failure to bind Cypress's internal file server to an available port (for example, an intermittent EADDRINUSE under port pressure on a reused CI machine) could crash the run with an uncaught exception before any tests started. Cypress now retries on a fresh port and, if it still cannot bind, fails with a clear error instead of crashing. Fixes #34109.
• Fixed a regression in 15.17.0 where visiting a URL with an IPv6 literal host, such as cy.visit('http://[::1]:3000'), crashed the proxy with an Internal error while proxying ... option domain is invalid error. Cypress no longer sets a Domain attribute on its internal cookies for IPv6 hosts, so such URLs work as expected. Fixes #34143. Fixed in #34146.

Misc:

• Running cypress install when Cypress is installed globally no longer prints a warning recommending that Cypress be installed as a per-project devDependency. Addresses #34134.
• Running Cypress with process profiler debug logs enabled (for example DEBUG=cypress*process_profiler) no longer intermittently prints an Expected DataContext to already have been set via setCtx error to the logs. Addresses #30670.
• Cypress now shows a clear error explaining that browsers must be an array and that a specific browser should be selected with --browser when a CYPRESS_BROWSERS environment variable is set to a plain string (for example CYPRESS_BROWSERS=chrome) instead of showing an opaque TypeError: a.map is not a function error. Addresses #33198.

Dependency Updates:

• Upgraded webdriver from 9.14.0 to 9.28.0, geckodriver from 5.0.0 to 6.1.0, and edgedriver from 6.1.1 to 6.3.0. These packages are used to launch and automate Firefox during cypress run and cypress open. Addresses #34072.
• Upgraded undici from 6.26.0 to 6.27.0 to address a CRLF Injection vulnerability reported in security scans. Addressed in #34121.

15.17.0

Performance:

• The Command Log no longer becomes progressively unresponsive when moving the mouse in and out of a test's command list during long tests. Hovering over the command area previously triggered a style recalculation across the entire list of commands, causing a delay that grew with the number of commands logged. Fixes #33179.
• Fixed a memory leak where runs with screenshotOnRunFailure enabled slowed down progressively, as each failure screenshot was retained in memory for the rest of the run. Fixes #33516.

Features:

• Added Bun as a recognized package manager. The cypress npm package can now be installed and invoked with Bun (for example bun run cypress open or bun run cypress run). Addresses #28962. Addressed in #32580.
• Cypress.expose() values can now be overridden per suite or test via test config overrides (for example, describe(), context(), it(), or test()) using { expose: { key: value } }. Suite- and test-level overrides are merged, with test-level keys taking precedence; override keys are applied at test start and restored after each test without affecting unrelated values set in hooks. Addresses #33356. Addressed in #33925.
• When signing up to Cypress Cloud from the Cypress desktop app, if a project is auto-provisioned during signup, Cypress now automatically writes the projectId to the cypress.config file. If the file cannot be written, a modal is shown with the project ID as a copyable snippet and a link to open the config file directly in your IDE. Addressed in #33976.
• Improved CI environment detection and commit metadata capture for Cypress Cloud recorded runs within Argo CD and Argo Workflows. Addressed in #33932.

Bugfixes:

• Video recording no longer silently fails on Firefox 93+, where it previously produced no video and ended with a We failed processing this video or operation timed out warning. Fixes #18415. Fixed in #33960.
• Fixed an issue where, in the Electron browser, navigating away from a page whose beforeunload handler requested a confirmation prompt (for example window.onbeforeunload = () => 'message' or a beforeunload listener that sets event.returnValue) would hang and eventually fail the command with a page load timeout. Such navigations — including cy.visit(), cy.reload(), and clicking links — now proceed automatically without the confirmation prompt blocking the test, matching the behavior in Chrome. Fixes #2118.
• Fixed an issue where config.isInteractive was always true in the config passed to the plugins / setupNodeEvents function, even during cypress run. The value is now correctly false in run mode and true in open mode, so plugins can reliably distinguish between the two. Fixes #20789.
• Fixed an issue where component tests, and end-to-end tests using a local baseUrl, could fail to start with Cypress could not verify that this server is running when an HTTP_PROXY environment variable was set. Local hosts excluded from the proxy via NO_PROXY (such as localhost, 127.0.0.1, and ::1, which includes the component testing dev server) are now verified with a direct connection instead of being routed through the proxy. Fixes #27990.
• Fixed an issue where cy.wait('@alias') could time out when the connection to the browser closed before an aliased intercepted request's response completed, including during navigation such as cy.visit(). Fixes #19326.
• Fixed an issue where cy.request() with a FormData body failed to upload when a Content-Type header was provided with non-lowercase casing (for example 'Content-Type': 'multipart/form-data'). Cypress now correctly replaces the user-provided header with the generated multipart/form-data boundary instead of sending two conflicting content-type headers, which previously caused the server to reject the request with a 400 or empty body. Fixes #21173.
• Fixed an issue where Cypress could load the config file through the wrong module system (for example, treating an ESM config as CommonJS), so ESM-only APIs such as import.meta.resolve were unavailable in config and plugin code. Cypress now picks ESM or CJS before loading, using Node.js rules from the config file extension and the nearest package.json "type", then loads only via import() or require() and fails outright on error instead of retrying the other format:
  • .mjs and .mts always load as ESM
  • .cjs and .cts always load as CJS
  • .js and .ts load as ESM when the nearest package.json has "type": "module"; CJS is loaded otherwise Fixes #33801. Addresses #33892.
• Fixed an issue where a recorded Chrome or Electron run could hang for the duration of the spec timeout when the renderer crashed mid-spec, instead of failing the affected spec and continuing. Fixed in #33943.
• Fixed an issue where tests in Chrome and Electron could fail when the application made cross-origin requests to local or private network addresses (for example, a login or OAuth flow that redirects between local development hosts). Chrome 141 began enforcing Local Network Access checks that gate such requests behind a permission prompt the automated browser cannot answer. Cypress now opts out of these checks so these requests succeed as they did in Chrome 140. Fixes #32708.
• Fixed an issue where, after a same-origin fetch or XHR request updated a cookie, a subsequent page navigation or reload could send the previous (stale) cookie value to the server instead of the updated one. Fixes #25841.
• Fixed an issue where a cross-origin navigation back to a previously-visited origin (for example, completing a login that redirects from an identity provider back to your application) could intermittently load the Cypress app interface instead of your application, causing flaky tests. Fixed in #33991.
• Fixed an issue where a cy.origin() test could intermittently fail with The command was expected to run against origin <x> but the application is at origin <y> when a navigation (such as a login redirect) ran on the primary origin shortly after the runner switched super-domains. A stale internal __cypress.unload cookie could cause the proxy to redirect the navigation back to the Cypress runner instead of serving it; the cookie is now cleared whenever the application document is (re)served. Fixed in #34020.
• Fixed an issue where setting a request or response header to an empty string in a cy.intercept() handler (for example req.headers['x-foo'] = '') would report the header as set on the intercepted request while silently dropping it from the request sent over the network. Empty-string header values are now preserved; headers are only removed when deleted or set to undefined. Fixes #25767.
• Fixed an issue where runs recorded to Cypress Cloud from Jenkins could show the branch name with the remote prefix included (for example origin/main instead of main), or report the wrong branch in multibranch pipelines. Cypress now reports the actual branch name. Fixes #20833.
• Fixed an issue where invalid CYPRESS_env or CYPRESS_expose environment variables (for example, a plain string instead of a JSON object) were silently ignored with no warning. Cypress now emits a warning explaining that a JSON object is required and points to the --env or --expose CLI flags for setting individual values. Fixes #29682 and #19508. Fixed in #33945.
• Fixed an issue where cypress run could crash with TypeError: The "path" argument must be of type string. Received undefined when the project path was not resolved (for example, due to an unset CI environment variable) or when --browser was passed without a value. Cypress now falls back to the current working directory in the first case and emits a clear "browser not found" error in the second. Fixes #15418. Fixed in #33958.
• Fixed an issue where HTML markup passed as a Sinon spy argument (for example expect(spy).to.have.been.calledOnceWith('<svg>...</svg>')) was rendered as live DOM in the Cypress command log, truncating the assertion message and breaking the log layout. The assertion message is now HTML-escaped and the markup is shown as literal text. Fixes #33416. Fixed in #33941.
• Fixed a regression in 14.4.0 where Cypress incorrectly logged Warning: We failed to trash the existing run results. on Windows when the Recycle Bin is configured with "Don't move files to the Recycle Bin. Remove files immediately when deleted.", even though the assets were actually removed. Fixes #32691.
• Fixed an issue where a test or attempt that had not reached a terminal state (for example, after an interrupted or crashed run) could be reported to Cypress Cloud with an internal, display-only processing state that the Cloud rejects. Such in-flight states are now reported as pending. Fixes #27956.
• Fixed an issue where the version of WebKit was incorrectly displayed as version 0 when playwright version 1.60.0 was installed. Fixes #33953.
• Fixed an issue where clicking a cy.origin command in the Command Log to print its details to the console threw an error when the callback yielded a value that could not be serialized across origins (for example, the page's window after a cy.visit). The command now prints its origin, arguments, and yielded subject to the console without erroring; an unserializable yielded subject is shown by its type instead of throwing. Fixes #27385. Fixed in #33983.
• The internal --dev, --inspect, and --inspect-brk command line flags are no longer listed in the cypress CLI help output. These flags are only intended for developing Cypress itself and would error when used against an installed version, so they are no longer advertised to users. Fixes #21320 and addresses #23058.
• Fixed an issue where cypress open --detached blocked the CLI process until the GUI was closed rather than returning once Cypress was ready to use. Fixed in #33972.

Misc:

• Improved TypeScript types for cy.get('@alias') and cy.wait('@alias') so that @-prefixed strings correctly resolve to Chainable<S> instead of Chainable<JQuery<HTMLElement>>. Addresses #8762.
• When running cypress run --spec with multiple patterns and one or more patterns do not match any spec files, Cypress now emits a warning identifying each unmatched pattern instead of silently skipping it. Addresses #22645.
• When Cypress cannot connect to a Chromium-based browser such as Chrome or Edge over the Chrome DevTools Protocol, the resulting error now suggests checking whether remote debugging has been disabled by an enterprise or group policy. Because Cypress relies on remote debugging to control the browser, the RemoteDebuggingAllowed policy being disabled prevents Cypress from connecting, and the error now points to chrome://policy or edge://policy to investigate. Addresses #32526.

Dependency Updates:

• Upgraded tsx from 4.20.6 to 4.22.4. Its bundled esbuild Go binary no longer reports CVE-2025-68121 in security scans, and loading TypeScript config files no longer emits the Node.js [DEP0205] module.register() is deprecated warning. Fixes #33954 and #33744.
• Upgraded watchpack (a transitive dependency of webpack) from 2.4.2 to 2.5.1. On Windows, running a spec in cypress open from an elevated (Administrator) shell no longer logs Watchpack Error (initial scan): EINVAL warnings for root-of-drive system files such as pagefile.sys. Fixes #33586.

15.16.0

Features:

• Cypress Cloud sign up is supported from the Cypress desktop app in addition to log in. Addressed in #33805.
• The Cypress Cloud log in and sign up modals in the Cypress desktop app now automatically start the browser-based authentication flow when opened, removing the extra "Log in" click. Addressed in #33831.

Bugfixes:

• Fixed an issue on Node 24.16.0+ and Node 26.1.0+ where installing Cypress could silently extract only the first file from the binary archive, causing the test runner to fail to launch with a "Cypress binary is missing" error. Addresses #33891. Addressed in #33887.
• Fixed a regression in 15.14.2 where the cypress install and cypress verify task list output could render one character per line in CI environments that allocate a pseudo-TTY without setting COLUMNS. Fixed in #33890.
• Fixed an issue where Cypress would abort the process and show a crash dialog when it received a SIGINT. Fixes #29228. Fixed in #33542.
• Fixed an issue where the clientCertificates config option failed to load ECDSA (EC) PEM or PKCS#12 client certificates. Fixes #33767. Fixed in #33799.
• Fixed an issue where clicking "back to projects" or switching projects while a project's initial config load was still in flight could fail. Fixed in #33810.
• Fixed an intermittent ENOENT: no such file or directory, open <path>/bundle.tar-<rand> error during cy.prompt and Studio bundle initialization. Fixed in #33748.
• Fixed a regression in 14.3.3 where deleting results.video in after:spec to keep videos only for failing specs could leave an empty *-compressed.mp4 file in cypress/videos. Fixes #32883.
• Fixed an issue where Cypress's bundled TypeScript type definitions could fail to compile in a project that also installed @sinonjs/fake-timers@>=15.3.0, because the bundled @types/sinon file imported FakeTimers from @sinonjs/fake-timers and TypeScript would prefer the user's installed copy over the bundled @types/sinonjs__fake-timers. The shipped types now reference the @types package directly so resolution is independent of the user's installed version. Fixes #33829. Fixed in #33886.

Dependency Updates:

• Upgraded esbuild to ^0.28.0 to address CVE-2025-68121 in the bundled esbuild Go binary (incorrect TLS certificate validation during session resumption), as reported in container and image security scans. Fixes #33599. Addressed in #33816.

15.15.0

Deprecations:

• The cy.end() command has been deprecated and will be removed in a future release. Instead of using .end() to break a chain, start a new chain of commands off of cy. Addressed in #33707.

Bugfixes:

• Fixed an issue where the proxy stripped Content-Length: 0 from empty responses (e.g. a DELETE 200 with no body) and the resulting empty body was re-emitted with Transfer-Encoding: chunked, breaking clients that assume a fixed-length response. Partially addresses #16469. Fixed in #33754.
• Fixed an issue where component specs that defined local React components could register every describe / it block twice in cypress open when using Vite 8, because React refresh treated those specs as HMR self-accepting modules. @cypress/vite-dev-server now excludes component spec files from JSX refresh while leaving Fast Refresh enabled for application source. Fixes #33750.
• Fixed an issue where multi-origin tests using cy.origin could fail to talk to a secondary origin after test isolation, when the spec-bridge iframe was already present, or when more than one secondary origin became ready around the same time. Cached spec-bridge window targets are now cleared at the correct lifecycle points, improving performance of specs with cy.origin calls. Addressed in #33704.
• Fixed an issue where a CSS selector built internally from element attributes could throw an uncaught Syntax error, unrecognized expression and crash the runner when an attribute value contained CSS-special characters (for example, an <input> with a pattern attribute containing regex metacharacters). Fixes #26967 and #29345.
• Fixed an issue where transient HTTP 500 responses from Cypress Cloud were not retried for idempotent requests. Fixed in #33718.
• Fixed an issue in Angular component testing where multiple projects in a monorepo sharing the same directory basename (e.g. libs/feature-a/feat-shell and libs/feature-b/feat-shell) would intermittently fail with spec-resolution errors when run in parallel. The temporary tsconfig.json generated by @cypress/webpack-dev-server was keyed only on the directory basename, so parallel runs would race on the same file. The temp directory is now suffixed with a short hash of the full project root path, giving each project its own isolated config. Fixes #33634.
• Fixed a race during cypress open config reload where rapid changes to cypress.config.js could leave the specs list stale. Two overlapping config-reload calls would tear down each other's IPC child processes (surfacing as ERR_STREAM_DESTROYED), causing both reloads to fail and the specs list to never refresh. Fixed in #33775.
• Fixed an issue where a transient Firefox launch failure caused Cypress to exit instead of retrying the browser launch. Fixed in #33770.

Dependency Updates:

• Upgraded socket.io from 4.0.1 to 4.8.3, socket.io-client from 4.0.1 to 4.8.3, and socket.io-parser from 4.0.5 to 4.2.6 to address a Denial of Service vulnerability reported in security scans. The engine.io, engine.io-client, and engine.io-parser direct deps in @packages/socket were also bumped to keep transitive copies aligned and the existing browser-side patches applied. Addressed in #33719.
• Upgraded uuid from 8.3.2 to 11.1.1 to address an Improper Validation of Specified Index, Position, or Offset in Input vulnerability reported in security scans. Addressed in #33765.

15.14.2

Performance:

• Reduced main-thread overhead when scrolling the command log in cypress open by fixing an issue where the reporter could register more than one scroll listener on the log if its scroll container was set more than once. Addressed in #33607.

Bugfixes:

• Fixed an issue where cy.wait on multiple aliases could surface an unhandled Cannot read properties of undefined (reading 'routeId') rejection when a retry short-circuited during runnable teardown. Fixed in #33651.
• Fixed an issue where an application under test containing <base target="_top"> or <base target="_parent"> would navigate out of the Cypress iframe when untargeted links were clicked or forms were submitted, breaking the test run. The unsafe target is now stripped from <base> tags as part of the existing modifyObstructiveCode rewriting (enabled by default for the primary super-domain, and extendable to third-party origins with experimentalModifyObstructiveThirdPartyCode). A runtime guard also neutralizes any <base> inserted or modified after load, matching the always-on behavior of the existing <a> / <form> target guards. Fixed in #33667.
• Fixed a race during cypress open config reload where the internal HTTP server would begin accepting requests before the primary remote state had been initialized, occasionally crashing in-flight browser requests (iframe loads) on an empty remoteStates map. Fixed in #33686.

Dependency Updates:

• Upgraded cachedir from ^2.3.0 to ^2.4.0. Addressed in #33608.
• Upgraded listr2 from 3.8.3 to ^9.0.5. Addressed in #33640.
• Upgraded simple-git from 3.33.0 to 3.36.0 to address a Remote Code Execution vulnerability reported in security scans. Addressed in #33680.
• Upgraded ts-loader from 9.5.2 to 9.5.7. Addresses #33648. Addressed in #33691
• Upgraded @cypress/request from ^3.0.10 to ^4.0.0. Addresses #33668. Addressed in #33712

15.14.1

Performance:

• Fixed a memory leak in cypress open where each spec rerun accumulated an additional uncaughtException listener, preventing the previous Mocha runner — and all the objects it retained (commands, snapshots, logs) — from being garbage collected. Fixed in #33631.

Bugfixes:

• Increased the limit for decrypted payloads to support large cy.prompt requests and responses. Fixed in #33619.
• Fixed a race condition in @cypress/vite-dev-server where the Cypress iframe could attempt to import the support file before Vite had finished serving it, causing intermittent "Failed to fetch dynamically imported module" errors in component tests. The dev server now waits until the support file URL returns a successful response before signaling that it is ready. Addressed in #33487.

15.14.0

Performance:

• Reduced browser memory growth during long interactive runs by clearing stored command log data (messages, URLs, snapshots, console props, and other fields—including custom Cypress.log properties) once tests age out of numTestsKeptInMemory, so the runner can reclaim memory and stay more responsive. Addressed in #33601.

Features:

• Cypress now officially supports TypeScript 6. Addresses #33385 and #33511.
• Adds Vite 8 support for component testing. Addresses #32550 and #33078.

Bugfixes:

• Fixed an issue where Cypress tests in open mode would not pick up on modified env values in the user's config file. Fixed in #33567. Fixes #33372.
• Fixed an issue where cy.wrap would not preserve a custom onFail handler when wrapping a rejected promise. Fixed in #33570.

Dependency Updates:

• Upgraded axios to 1.15.0 to address CVE-2025-62718 and CVE-2026-40175 vulnerabilities reported in security scans. Fixes #33590.

15.13.1

Performance:

• When recording to Cypress Cloud, the App now sends a smaller snapshot of your project config, which reduces payload size and can make Cloud recording faster. Addressed in #33517.
• Eliminated unnecessary git status and git log subprocess calls during cypress run, which were collecting spec file git metadata only used in the interactive GUI. Fixed in #33552.

Bugfixes:

• Fixed an issue where cy.intercept delay values >= 2**31 (approximately 24.8 days) were silently ignored by setTimeout. A clear validation error is now thrown for such values. Fixed in #33377. Fixes #33183.

Dependency Updates:

• Upgraded node-forge from 1.3.x to ^1.4.0 to address CVE-2026-33896 vulnerability reported in security scans. Addressed in #33546.

15.13.0

Features:

• cy.prompt is now in beta and available without any configuration. cy.prompt is an AI-powered command that lets you write test steps in plain English instead of code. The experimentalPromptCommand flag was removed and can be deleted from your config. Addressed in #33497.
• Studio now allows adding a new test when focused on a single test, supporting a workflow to add new tests as you record. Addressed in #33481

Bugfixes:

• Fixed an issue where Cypress may hang when running component tests and a connection to the dev server can no longer be made. Addressed in #33469

Misc:

• When a test is isolated in Studio, the 'rerun' button now properly says 'Run test'. Addressed in #33466
• Studio now warns users before navigating if they try to exit when they have unsaved changes in the editor. Addressed in #33457

Dependency Updates:

• Upgraded simple-git from 3.27.0 to 3.32.3 to address Improper Handling of Case Sensitivity (CVE-2026-28292) vulnerability reported in security scans. Addressed in #33470
• Upgraded minimatch to 3.1.3 to address CVE-2026-26996, CVE-2026-27903, and CVE-2026-27904 ReDoS vulnerabilities reported in security scans. Addressed in #33461.
• Upgraded serialize-javascript to 7.0.3 to address GHSA-5c6j-r48x-rmvq vulnerability reported in security scans. Addressed in #33461.
• Upgraded flatted from 3.2.9 to 3.4.2 to address Prototype Pollution (CVE-2026-33228) vulnerability reported in security scans. Addressed in #33501

15.12.0

Features:

• Adds an option to enable word wrap for Studio panel code. Addressed in #33411.

Bugfixes:

• Fixed an issue where sending SIGINT (e.g. Ctrl+C) to exit Cypress left the terminal displaying raw characters. Fixes #33367. Addressed in #33431.
• Fixed an issue in develop mode (when running Cypress via gulp with file watching) where closing the Electron window did not exit the gulp process, leaving it running. Addressed in #33431.
• Fixed an issue where internal tags on stderr streams were surfacing to the end user CLI during component testing. Addresses #32769. Addressed in #33400.
• Fixed an issue where Cypress may hang when waiting on multiple intercepts and the page navigates causing a stability change. Addressed in #33446.

Dependency Updates:

• Upgraded basic-ftp to 5.2.0 to address CVE-2026-27699 vulnerability reported in security scans. Addresses #33436.
• Upgraded fast-xml-parser to 4.5.4 to address CVE-2026-25896 vulnerability reported in security scans. Addresses #33434.

15.11.0

Features:

• Adds --pass-with-no-tests command line flag. Addresses #23019. Addressed in #33384.
• Introduces manual bootstrap script injection via a <script data-cy-bootstrap> tag. This is a workaround to fix React SSR hydration mismatches, and enables React apps to use suppressHydrationWarning to ignore the mismatch. Addresses #27204. Addressed in #33295.
• Added Brotli compression support to the proxy. Addresses #6197.
• Improved CI environment detection and CI/commit metadata capture for Cypress Cloud recorded runs. Added support for Harness CI, AWS Amplify Console, Buddy, Bitrise, and Cloudbees Unify and removed support for EOL providers. Addressed in #33396.

Bugfixes:

• Fixed an issue where a cancelled or incomplete login attempt would not properly open a browser window or tab, and required a restart of Cypress to enable a new login attempt. Fixed in #33366. Fixes #33350.
• Fixed an issue on Windows where extracting the Studio or Prompt bundle could fail with EPERM: operation not permitted when renaming extracted files. The extract step now retries on EPERM/EACCES with a short delay to handle transient file locks. Addressed in #33330.
• The capture protocol is now properly cleaned up when the protocol is re-initialized or when the run closes, ensuring CDP client listeners and resources are removed. Addressed in #33391.

Misc:

• The Node.js path is now displayed correctly in run log headers for typical GitHub Actions paths. ANSI escape sequences are no longer incorrectly displayed for longer Node.js paths. Addresses #32736.
• Fixed an issue that caused a Node.js DEP0169 deprecation warning to be output when executing cypress install to download and install the Cypress binary. Addresses #33347.

Dependency Updates:

• Upgraded qs to 6.14.2 to address CVE-2026-2391 vulnerability reported in security scans. Addresses #33363.
• Upgraded rimraf to 6.1.1 to address CVE-2026-25547 vulnerability reported in security scans. Addressed in #33336.
• Upgraded squirrelly to 9.1.0 to address CVE-2021-32819 vulnerability reported in security scans. Addresses #33354.
• Upgraded systeminformation to 5.31.1 to address CVE-2026-26280 and CVE-2026-26318 vulnerabilities reported in security scans. Addresses #33389.

15.10.0

Deprecations:

Cypress.env() is now deprecated and will be removed in a future major release of Cypress. To understand why, and how to migrate, please read our Migration Guide. Addressed in #33181.

Features:

• Introduced a new cy.env() command that can be used to asynchronously and securely access Cypress environment variables. Addressed in #33181.
• Added a allowCypressEnv configuration option that disallows use of the deprecated Cypress.env() API. Addressed in #33181.
• Introduced the new Cypress.expose() API, intended for use of public configuration of non-sensitive values. Addressed in #33238.
• Displays the resolved expose values in the App's resolved configuration user interface. Addressed in #33322.

Bugfixes:

• Fixed an issue where the user did not always have the ability to create a new test in Studio. Also, fixed an issue where creating a new test from an empty spec would display the welcome to studio screen instead of the form to name the new test. Addressed in #33236.

Misc:

• The icon in the 'Open in IDE' button in the command log is now the correct size. Addresses #32779. Addressed in #33217.

Dependency Updates:

• Upgraded express to 4.22.0 and body-parser to 1.20.4. This removes the CVE-2025-15284 vulnerability being reported in security scans. Addressed in #33305.
• Upgraded lodash to 4.17.23. This removes the CVE-2025-13465 vulnerability being reported in security scans. Addresses #33269.
• Upgraded shell-env to 4.0.1 and @cypress/commit-info to 2.2.2. This removes the GMS-2020-2 vulnerability being reported in security scans. Addressed in #33226 and #33263.

15.9.0

Features:

• The experimentalRunAllSpecs option can now be used for component testing as well as e2e testing. Addresses #25636.

15.8.2

Bugfixes:

• Fixed an issue where the ffprobe path was not properly configured for video operations. The path is now set at module load time, ensuring it's available for all video operations. Upgraded @ffprobe-installer/ffprobe from 1.1.0 to 2.1.2 to support darwin-arm64 (Apple Silicon). Addressed in #33136.
• Fixed an issue where test:after:run and test:after:run:async events were not firing after both a before all and after all hook failed. Addressed in #33172.

Dependency Updates:

• Upgraded @cypress/request to 3.0.10. This removes the CVE-2025-15284 vulnerability being reported in security scans. Addressed in #33188.

15.8.1

Dependency Updates:

• Upgraded systeminformation to 5.27.14. This removes the CVE-2025-68154 vulnerability being reported in security scans. Fixes #33146. Addressed in #33150.

15.8.0

Performance:

• Introduced a new experimentalFastVisibility experiment. Enabling this experiment changes how Cypress performs visibility checks and assertions. Read more about experimental fast visibility. Addresses #33044. Addressed in #32801.

Features:

• Angular version 21 is now supported within component testing. Addressed in #33004.
• Adds zoneless support for Angular Component Testing through the angular-zoneless mount function. Addresses #31504 and #30070.
• After receiving feedback on its usefulness outside of Studio, the Selector Playground is now available for all users in open mode. When opened, the playground automatically enables interactive mode to help you build and test selectors directly in your application. Addresses #32672. Addressed in #33073.

Bugfixes:

• Fixed an issue where a EPIPE error shows up after CTRL+C is done in terminal. Fixes #30659. Addressed in #32873.
• Fixed an issue where the browser would freeze when Cypress intercepts a synchronous XHR request and a routeHandler is used. Fixes #32874. Addressed in #32925.
• Fixed an issue where Next.js Component Testing would not load correctly without a TypeScript-based Next config in versions 16.0.3 and up. Fixes #32968.
• Fixed an issue where the error message for not.have.length was not correctly displaying the expected length in the Command Log. Addressed in #18927.
• Fixed an issue where removeAttribute() would not work for attributes other than target on anchor or form elements after clicking links with target="_top" or target="_parent". Fixes #26206. Addressed in #33051.

Dependency Updates:

• Removed extraneous dependencies that are no longer used. Addressed in #33098.
• Upgraded brace-expansion. This removes the CVE-2025-5889 vulnerability being reported in security scans. Addressed in #33112.
• Upgraded form-data. This removes the CVE-2025-7783 vulnerability being reported in security scans. Addressed in #33113.

15.7.1

Performance:

• Improved performance when viewing command snapshots in the Command Log. Element highlighting is now significantly faster, especially when highlighting multiple elements or complex pages. This is achieved by reducing redundant style calculations and batching DOM operations to minimize browser reflows. Addressed in #32951.

Bugfixes:

• Updated the error message shown when the cy.prompt() bundle is deleted while in use. Ensured that the Cloud bundles are written atomically to avoid concurrent downloads causing issues. Addressed in #33034.

Dependency Updates:

• Upgraded yargs-unparser from 1.6.0 to 1.6.4 (which upgraded flat from 4.1.1 to 5.0.2) to resolve CVE-2020-36632. Addressed #27763.

15.7.0

Performance:

• Limits the number of matched elements that are tested for visibility when added to a command log entry. Fixes a crash scenario related to rapid successive DOM additions in conjunction with a large number of elements returned from a query. Addressed in #32937.

Features:

• Next.js version 16 is now supported within component testing. Currently, webpack is used to bundle Next.js components. Turbopack, the new default inside Next.js 16, is not yet supported within Cypress. Addresses #32857.

Bugfixes:

• Fixed an issue where cy.wrap() would cause infinite recursion and freeze the Cypress App when called with objects containing circular references. Fixes #24715. Addressed in #32917.
• Fixed an issue where top changes on test retries could cause attempt numbers to show up more than one time in the reporter and cause attempts to be lost in Test Replay. Addressed in #32888.
• Fixed an issue where stack traces that are used to determine a test's invocation details are sometimes incorrect. Addressed in #32699.
• Fixed an issue where larger than expected config values were causing issues in certain cases when recording to the Cypress Cloud. Addressed in #32957.

Misc:

• The keyboard shortcuts modal now displays the keyboard shortcut for saving Studio changes - ⌘ + s for Mac or Ctrl + s for Windows/Linux. Addressed #32862. Addressed in #32864.
• The Cursor logo now correctly displays in the External editor dropdown. Addresses #32062. Addressed in #32911.

15.6.0

Features:

• Added a 'Self-healed' badge to the Command Log when cy.prompt() steps automatically recover after the element they need is not found in the cache. Addressed in #32802.
• cy.prompt() will now show a warning in the Get code modal when there are unsaved changes in Studio that will be lost if the user saves the generated code. Addressed in #32741.

Bugfixes:

• Fixed an issue where command snapshots were not correctly displayed in Studio. Addressed in #32808.
• Chrome's autofill popup is now disabled when filling address and credit card forms during test execution. We also added some other Chrome flags and preferences that are common when automating browsers. Fixes #25608. Addressed in #32811.
• Fixed an issue where grouped command text jumps up and down when expanding and collapsing in the command log. Addressed in #32757.
• Fixed an issue with grouped console prop items having a hard to read blue color in the console log and duplicate : characters being displayed. Addressed in #32776.
• Added more context to the error message shown when cy.prompt() fails to download. Addressed in #32822.
• Fixed an issue where absolute file paths were not correctly determined from the source map when the source map root was updated. Fixes #32809.

Misc:

• Add top padding for command log labels. Addressed in #32774.
• The hitbox for expanding a grouped command has been widened. Addresses #32778. Addressed in #32783.
• Have cursor on hover of the AUT URL to show as pointer. Addresses #32777. Addressed in #32782.
• WebKit now prefers a cookie's fully qualified domain when requesting a cookie value via cy.getCookie(). If none are found, the cookie's apex domain will be used as a fallback. Addresses #29954, #29973 and #30392. Addressed in #32852.
• Make test name header sticky in studio mode and in the tests list. Addresses #32591. Addressed in #32840
• The cy.exec() type now reflects the correct yielded response type of exitCode. Addresses #32875. Addressed in #32885.

Dependency Updates:

• Upgraded better-sqlite3 from 11.10.0 to 12.4.1. Addressed in #32755.
• Upgraded recast from 0.20.4 to 0.23.11. Addressed in #32742.

15.5.0

Features:

• When cypress run is used with both --record and --posix-exit-codes enabled, Cypress will now exit with code 112 when it cannot determine which spec to run next due to network conditions. Addresses #32485. Addressed in #32635.

Bugfixes:

• An error is no longer thrown during command execution when the application under test overwrites the window.$ property with a non-function. Fixes #1502. Fixed in #32682.
• When running cypress in Cypress development environments, or when ELECTRON_ENABLE_LOGGING is otherwise set to 1, certain messages written to stderr will no longer be bracketed with verbose tags. Addresses #32569. Addressed in #32674.
• Improve performance of time between specs by not resetting the file_systems StorageType state when executing the CDP command Storage.clearDataForOrigin. Fixed in #32703.

Misc:

• Browser detection in Cypress now always prefers 64-bit browser installs to 32-bit browser installs. Addressed in #32656.
• Update code button styles and rename Get Code for Code on cy.prompt(). Addressed in #32745.

Dependency Updates:

• Upgraded tsx from 4.20.5 to 4.20.6. Addressed in #32730.

15.4.0

Features:

• Cypress Studio is now available by default. You no longer have to set the experimentalStudio flag. Addresses #30997. Addressed in #32571.
• An option is now available to 'Hide HTTP Requests' in the Cypress Command Log. This can be found in the new dropdown menu at the top of the Command Log. Addresses #7362. Addressed in #32658.
• Added the --posix-exit-codes flag for the run command. When this flag is passed, Cypress will exit with 1 if any tests fail, rather than the number of failed tests. Addresses #32605 and #24695. Addressed in #32609.
• cy.prompt() is now a reserved Cypress command, currently gated behind a feature flag that requires an invite from Cypress. This means any custom commands named 'prompt' will no longer work. Stay tuned for updates on when this feature will become more widely available. Addresses #31826.

Bugfixes:

• Fixed a regression introduced in 15.0.0 where dbus connection error messages appear in docker containers when launching Cypress. Fixes #32290.
• Fixed code frames in cy.origin() so that failed commands will show the correct line/column within the corresponding spec file. Addressed in #32597.
• Fixed Cypress cloud requests so that they properly verify SSL certificates. Addressed in #32629.

Misc:

• Added a dropdown menu in the Command Log that includes actions like Open in IDE and Add New Test in Studio, along with test preferences such as Auto-Scroll and Hide HTTP Requests. Addresses #32556 and #32558. Addressed in #32611.
• Updated the Studio test editing header to include a Back button. This change ensures the Specs button remains functional for expanding or collapsing the specs panel. Addresses #32556 and #32558. Addressed in #32611.
• Fixed the Studio panel resizing when dragging. Addressed in #32584.
• The Next button now maintains consistent visibility during stepping sessions when using cy.pause(), staying visible but disabled when no immediate next command is available, providing clear visual feedback to users about stepping state. Addresses #32476. Addressed in #32536.

Dependency Updates:

• Upgraded electron from 36.8.1 to 37.6.0. Addressed in #32607.
• Upgraded bundled Node.js version from 22.18.0 to 22.19.0. Addressed in #32607.
• Upgraded bundled Chromium version from 136.0.7103.177 to 138.0.7204.251. Addressed in #32607.

15.3.0

Features:

• Added Escape key support to cy.press(). Addresses#32429. Addressed in #32545.

Bugfixes:

• In development mode, Electron stderr is piped directly to Cypress' stderr to make it clear why Electron failed to start, if it fails to start. Fixes #32358. Addressed in 32468.
• Fixed an issue where ESM Cypress configurations were not being interpreted correctly. Fixes #32493. Fixed in #32515.

Misc:

• Update the styles for command grouping 'line' so on expansion it is displayed correctly. Addressed in #32521.
• Test hook names now correctly display with a semi-bold font weight. Addresses #32477. Addressed in #32491.
• Updated the Cypress Studio panel to not show bottom border. Addresses #32478.

15.2.0

Features:

• Added support for using @cypress/grep with Cypress Studio. Addresses #32292.

Bugfixes:

• We now properly partition the host with port when caching family DNS lookups. This resolves issues where some localhost URLs were not resolving in cy.visit() in Cypress when they should have. Fixes #25397. Addressed in #32403.

Dependency Updates:

• Updated better-sqlite3 from 11.9.1 to 11.10.0. Addressed in #32404.

15.1.0

Features:

• Expanded cy.press() to support more key types. Addresses #31051 and #31488. Addressed in #31496.

Bugfixes:

• Fixed an issue where OS distributions and releases were sometimes not properly populated for Module API results and Cloud recordings. Fixes #30533. Addressed in #32283.
• Fixed an issue where Cypress would fail to run on GNOME if GTK 4 and GTK 2/3 were detected in the Electron process. Addresses #32361.
• Fixed an issue where the open Studio button would incorrectly show for component tests. Addressed in #32315.
• Fixed an issue where the TypeScript compiler wasn't being resolved correctly when @cypress/webpack-batteries-included-preprocessor was used as a standalone package. Fixes #32338.
• Fixed an issue where tsx was not being loaded correctly into the Cypress configuration process due to spaces being present in the path. Fixes #32398.

Misc:

• Updated the Cypress Studio panel to have a darker gray background. Addressed in #32333.

Dependency Updates:

• Upgraded esbuild from 0.15.3 to 0.25.2. Addressed in #32231.
• Upgraded image-size from 1.1.1 to 1.2.1. Addressed in #32232.
• Upgraded tar from 6.1.5 to 6.2.1. Addressed in #32229.
• Upgraded axios from 1.8.3 to 1.11.0. Addresses #32347.

15.0.0

Breaking Changes:

• Removed support for Node.js 18 and Node.js 23. Addresses #31302.
• Removed support for Linux distributions with glibc older than 2.31. This support is in-line with Node.js' support for Linux in Node v20+. Addressed in #31912.
• Removed support for Chrome DevTools Protocol with the Firefox browser. Addresses #31189.
• Removed support of the deprecated 3 argument signature of cy.stub. Use cy.stub(object, name).callsFake(fn) instead. Addresses #31346.
• @cypress/webpack-preprocessor no longer supports webpack version 4. Addresses #31344. If you still need to use webpack version 4, please see our migration guide.
• In order to better align with best practices, @cypress/webpack-batteries-included-preprocessor no longer includes certain browser built-ins that were automatically provided by Webpack 4. The removed built-ins are assert, constants, crypto, domain, events, http, https, punycode, querystring, string_decoder, sys, timers, tty, url, util, vm, and zlib. However, we know that certain built-ins are popular, given that many users have files that are shared between their Cypress tests and node context. Because of this, @cypress/webpack-batteries-included-preprocessor will ship with built-in support for buffer, path, process, os, and stream. If there is a built-in that isn't supported by default and you need to add support, please refer to the Webpack resolve.fallback documentation and the @cypress/webpack-batteries-included-preprocessor README. Addresses #31039.
• The application under test's pagehide event in Chromium browsers will no longer trigger Cypress's window:unload event. Addressed in #31853.
• The Cypress.SelectorPlayground API has been renamed to Cypress.ElementSelector. This API was renamed to accommodate its use for defining selectorPriority in Cypress Studio and our future cy.prompt release. Additionally, the getSelector method and the onElement option of defaults were removed from this API. Addresses #31801. Addressed in #31889 and #32098.
• The direct download option for installing Cypress is no longer supported. Users should install via a package manager. Addressed in #32249.
• Updated execa from 1.0.0 to 4.1.0. This changes the code property returned by cy.exec() to exitCode. Addressed in #32238.
• Component Testing breaking changes:
  • Removed support for Angular 17. The minimum supported version is now 18.0.0. Addresses #31303.
  • @cypress/angular now requires a minimum of zone.js 0.14.0. Addresses #31582.
  • The Cypress configuration wizard for Component Testing supports TypeScript 5.0 or greater. Addresses #31187.
  • @cypress/vite-dev-server is now an ESM only package. You will no longer be able to use this package from a CommonJS context. Addresses #28373, #29557 and #31882.
    • Removed support for Vite 4 inside @cypress/vite-dev-server. The minimum Vite version is 5. Addresses #32038.
  • @cypress/webpack-dev-server no longer supports webpack-dev-server version 4. Addresses #31605. If you still need to use webpack-dev-server version 4, please see our migration guide.

Features:

• cy.url(), cy.hash(), cy.go(), cy.reload(), cy.title(), and cy.location() now use the automation client (CDP for Chromium browsers and WebDriver BiDi for Firefox) to return the appropriate values from the commands to the user instead of the window object. This is to avoid cross origin issues with cy.origin() so these commands can be invoked anywhere inside a Cypress test without having to worry about origin access issues. Experimental WebKit still will use the window object to retrieve these values. Also, cy.window() will always return the current window object, regardless of origin restrictions. Not every property from the window object will be accessible depending on the origin context. Addresses #31196.
• Selectors accepted in the selectorPriority of the SelectorPlayground (renamed to ElementSelector) API have been expanded to accept name and attributes:*. Additionally, the default selector priority used by Cypress now includes name. Addresses #31801 and #6876. Addressed in #31889.
• tsx is now used in all cases to run the Cypress config, replacing ts-node for TypeScript and Node.js for CommonJS/ESM. This should allow for more interoperability for users who are using any variant of ES Modules. Addresses #8090, #15724, #21805, #22273, #22747, #23141, #25958, #25959, #26606, #27359, #27450, #28442, #28696, #29186, #30318, #30718, #30907, #30915, #30925, #30954, and #31185.
• Component Testing features:
  • @cypress/vite-dev-server now supports vite version 7. Addresses #31882.
  • Angular version 20 is now supported within component testing. As of now, cypress/angular still requires zone.js and @angular-devkit/build-angular. Addresses #31304.

Bugfixes:

• Fixed an issue where Create from Component feature might not be able to parse React components from project files. Fixed in #31457.
• Fixed an issue where isSecureContext would be false on localhost when testing with Cypress. Addresses #18217.
• Fixed an issue where Angular legacy Output() decorators were broken when making component instance field references safe. Fixes #32137.
• Fixed an issue where .fixture() would not return updated content after the underlying file was modified via .writeFile(). The fixture cache is now properly invalidated when the backing file is written to, ensuring updated content is returned in subsequent .fixture() calls. Fixes #4716.
• Fixed an issue where .fixture() calls with a specified encoding would sometimes still attempt to parse the file based on its extension. Files with an explicit encoding are now always treated as raw content. Fixes #32139.
• Fixed an issue where .fixture() calls with different encoding options would return inconsistent content based on execution order. Fixes #32138.
• Filters content written to stderr to prevent Electron from spamming with inconsequential errors/warnings. This stderr content can be viewed by enabling the cypress:internal-stderr debug namespace. Fixes #32070
• Fixed an issue where Angular Component Testing was printing extraneous warnings to the console by default. By default, errors only will now print to the console. This can still be overridden by passing in a custom webpack config or setting the verbose option inside your angular.json. Addresses #26456.
• Fixed an issue where ts-loader was improperly being detected inside @cypress/webpack-preprocessor. Fixes #32265.
• Fixed an issue where .fixture() calls with null and undefined encoding options would incorrectly share cache entries, causing unexpected content to be returned. Cache keys now properly distinguish between these encoding values. Fixes #32274.

Misc:

• The Cypress Command log has a new design when viewing a list of tests. Addresses #31677. Addressed in #31914.
• Migration helpers and related errors are no longer shown when upgrading from Cypress versions earlier than 10.0.0. To migrate from a pre-10.0.0 version, upgrade one major version at a time to receive the appropriate guidance. Addresses #31345. Addressed in https://github.com/cypress-io/cypress/pull/31629/.

Dependency Updates:

• Upgraded electron from 33.2.1 to 36.4.0. Addresses #31257. Addressed in #31912.
• Upgraded bundled Node.js version from 20.18.1 to 22.15.1. Addresses #31257. Addressed in #31912.
• Upgraded bundled Chromium version from 130.0.6723.137 to 136.0.7103.149. Addresses #31257. Addressed in #31912.
• Upgraded body-parser from 1.20.2 to 1.20.3. This removes the SNYK-JS-BODYPARSER-7926860 vulnerability being reported in security scans. Addressed in #32225.
• Upgraded systeminformation from 5.22.8 to 5.27.7. Addressed in #32234.
• Upgraded tmp from ~0.2.3 to ~0.2.4. This removes the CVE-2025-54798 vulnerability being reported in security scans. Addresses #32176.

14.5.4

Dependency Updates:

• Upgraded tar-fs to 2.1.3 and 3.1.0 in places we can control, to resolve CVE-2024-12905. @puppeteer/browsers still references 3.0.4, but it is only used to download browsers which is not a feature of puppeteer that we utilize. Addressed in #32160.

14.5.3

Bugfixes:

• Fixed missing support for setting an absolute path for component.indexHtmlFile in @cypress/webpack-dev-server. Fixes #31819.
• Fixed an issue where TypeScript ESM projects using .js and .mjs extensions where not resolving correctly within @cypress/webpack-batteries-included-preprocessor. Addressed in #31994. Fixes #26827 and #28805.
• Fixed an issue in @cypress/angular where component instance fields were not reference safe and were being overwritten. Fixes #31238 and #31983. Fixed in #31993.

Dependency Updates:

• Upgraded @cypress/request to 3.0.9, to resolve CVE-2025-7783 in form-data. Addresses #32091.

14.5.2

Bugfixes:

• Fixed a regression introduced in 14.5.0 where the Stop button would not immediately stop the spec timer. Addresses #31920.
• Fixed an issue with the CloudRequest where it used the wrong port for https requests. Addressed in #31992.

14.5.1

Bugfixes:

• Fixed an issue where prerequests with Firefox BiDi were prematurely being removed or matched incorrectly. Addresses #31482.

Dependency Updates:

• Updated pbkdf2 from 3.1.2 to 3.1.3. This removes the SNYK-JS-PBKDF2-10495498 vulnerability being reported in security scans. Addressed in #31941.

14.5.0

Features:

• Install Cypress win32-x64 binary on Windows win32-arm64 systems. Cypress runs in emulation. Addresses #30252.

Bugfixes:

• Fixed an issue when using Cypress.stop() where a run may be aborted prior to receiving the required runner events causing Test Replay to not be available. Addresses #31781.

14.4.1

Bugfixes:

• Fixed an issue where cy.session() may fail internally if navigating to about:blank takes longer than the defaultCommandTimeout. Addresses #29496.

Misc:

• The design of commands that display as grouped (such as .within() and cy.session()) has been updated to provide better clarity when collapsing groups. Addressed in #31739.

Dependency Updates:

• Updated @sinonjs/fake-timers from 10.3.0 to 11.3.1. Addressed in #31746.

14.4.0

Features:

• @cypress/webpack-dev-server and @cypress/webpack-batteries-included-preprocessor now ship with webpack-bundle-analyzer as a diagnostic tool to determine bundle statistics, which can be enabled via DEBUG=cypress-verbose:webpack-dev-server:bundle-analyzer ( component tests using webpack) or DEBUG=cypress-verbose:webpack-batteries-included-preprocessor:bundle-analyzer (e2e tests using webpack, which is the default preprocessor), respectively. Addresses #30461.

Bugfixes:

• Fixed an issue where framebusting was occurring when top.window.location was being set explicitly. This fix does not require the experimentalModifyObstructiveThirdPartyCode configuration option. Addresses #31687.
• cy.press() now has a return type of Chainable<null> instead of void to match the convention of other commands that yield null. Addressed in #31698.
• Fixed an issue with the experimental usage of WebKit where Cypress incorrectly displayed 0 as the WebKit version. Addresses #31684.

Misc:

• Chrome 137+ no longer supports --load-extension in branded Chrome, breaking the @cypress/puppeteer plugin in open mode and headed run mode and launchOptions.extensions. We recommend using Electron, Chrome for Testing or Chromium to continue using these features. See Cypress Docker image examples for Chrome for Testing and Chromium. Addresses #31702 and #31703.
• Cursor is now available as an IDE option for opening files in Cypress, if it is installed on your system. Addressed in #31691.
• The error shown when the --record flag is missing has been updated to be shorter. Addressed in #31676.

Dependency Updates:

• Upgraded @sinonjs/fake-timers from 8.1.0 to 10.3.0. Addressed in #31725 and #31737.
• Upgraded trash from 5.2.0 to 7.2.0. Addressed in #31667.
• Upgraded webdriver from 9.11.0 to 9.14.0. Addressed in #31689.

14.3.3

Performance:

• Ensure the previous pausing event handlers are removed before new ones are added. Addressed in #31596.

Bugfixes:

• Fixed an issue where the configuration setting trashAssetsBeforeRuns=false was ignored for assets in the videosFolder. These assets were incorrectly deleted before running tests with cypress run. Addresses #8280.
• Fixed an issue where Cypress was hanging when piping stdout and stderr to a file, and using @cypress/grep results in many matched files. Fixes #31625. Addressed in 31631.
• Fixed a potential hang condition when navigating to about:blank. Addressed in #31634.

Misc:

• The Assertions menu when you right click in experimentalStudio tests now displays in dark mode. Addresses #10621. Addressed in #31598.
• The URL in the Cypress App no longer displays a white background when the URL is loading. Fixes #31556.

Dependency Updates:

• Downgraded cli-table3 to 0.6.1. Addressed in 31631.

14.3.2

Bugfixes:

• Fixed an issue where auto scroll in the Cypress Command Log was not scrolling correctly. Fixes #31530.
• Fixed an issue where a message pointing users to the Cypress Cloud was not displaying on runs with failures in CI. Fixes #31550.

14.3.1

Performance:

• Reduced the initial timeout for the preflight API request to determine proxy conditions from sixty seconds to five, and made this timeout duration configurable with the CYPRESS_INITIAL_PREFLIGHT_TIMEOUT environment variable. Addresses #28423. Addressed in #31283.

Bugfixes:

• The cy.press() command no longer errors when used in specs subsequent to the first spec in run mode. Fixes #31466.
• Fixed an issue where certain proxy conditions prevented test runs from being recorded. Fixes #31485.

Misc:

• Suppress benign warnings that reference OOM score of renderer. Addresses #29563. Addressed in #31521.
• The UI of the reporter and URL were updated to a darker gray background for better color contrast. Addressed in #31475.
• Fixed an issue where the error message output when attempting to install Cypress on an unsupported architecture included an outdated documentation link to Cypress system requirements. Fixes #31512.

14.3.0

Features:

• The cy.press() command is now available. It supports dispatching native Tab keyboard events to the browser. Addresses #31050. Addresses #299. Addressed in #31398.

Bugfixes:

• Allows for babel-loader version 10 to be a peer dependency of @cypress/webpack-preprocessor. Fixed in #31218.
• Fixed an issue where Firefox BiDi was prematurely removing prerequests on pending requests. Fixes #31376.
• Fixed an issue with Electron causing slow animations and increased test times by starting a CDP screencast with a noop configuration. Fixes #30980.

Misc:

• Added an automation command for dispatching key press events to CDP and BiDi automated browsers. Addressed in #31366.
• Updated error message around injectDocumentDomain removal to mention a future version of Cypress instead of Cypress 15. Addresses #31373. Addressed in #31375.

Dependency Updates:

• Upgraded mocha from 7.0.1 to 7.2.0. Addressed in #31423 and #31432.
• Upgraded webdriver from 9.7.3 to 9.11.0. Addressed in #31315.
• Upgraded win-version-info from 5.0.1 to 6.0.1. Addressed in #31358.

14.2.1

Bugfixes:

• Applies a fix from #30730 and #30099 related to Node.js turning on ESM flags by default in Node.js version 20.19.0. Fixed in #31308.
• Fixed an issue where Firefox BiDi was not correctly removing prerequests on expected network request failures. Fixes #31325.
• Fixed an issue in @cypress/webpack-batteries-included-preprocessor and @cypress/webpack-preprocessor where sourceMaps were not being set correctly in TypeScript 5. This should now make error code frames accurate for TypeScript 5 users. Fixes #29614.

Misc:

• The UI above the application under test now displays in dark mode. Addresses #31106. Addressed in #31360.

Dependency Updates:

• Upgraded @cypress/request from 3.0.7 to 3.0.8. Addressed in #31311.
• Upgraded cross-fetch from 3.1.8 to 4.1.0. Addressed in #31327.
• Upgraded micromatch from 4.0.6 to 4.0.8. Addressed in #31330.
• Upgraded resolve from 1.17.0 to 1.22.10. Addressed in #31333.
• Upgraded semver from 7.5.3 to 7.7.1. Addressed in #31341.
• Upgraded systeminformation from 5.21.7 to 5.22.8. Addressed in #31281.

14.2.0

Features:

• Cypress.stop() is now available to stop the Cypress App on the current machine while tests are running. This can be useful for stopping test execution upon failures or other predefined conditions. Addresses #518. Addressed in #31225.

Misc:

• The browser dropdown now has a more minimal design - showing only the icon of the browser selected to the left of the URL. The currently selected browser also now shows at the top of the browser dropdown. Browsers with longer names will now have their names correctly left aligned in the browser dropdown. Addresses #21755 and #30998. Addressed in #31216.
• Additional CLI options will be displayed in the terminal for some Cloud error messages. Addressed in #31211.
• Updated Cypress Studio with url routing to support maintaining state when reloading. Addresses #31000 and #30996.

Dependency Updates:

• Upgraded cli-table3 from 0.5.1 to 0.6.5. Addressed in #31166.
• Upgraded simple-git from 3.25.0 to 3.27.0. Addressed in #31198.

14.1.0

Features:

• Firefox versions 135 and up are now automated with WebDriver BiDi instead of Chrome Devtools Protocol. Addresses #30220.

Bugfixes:

• Fixed the calculation of upload throughput units when displaying the 'stream stalled' error message during Test Replay archive uploads. Fixes #31075. Addressed in #31160.

Misc:

• Viewport width, height, and scale now display in a badge above the application under test. The dropdown describing how to set viewport height and width has been removed from the UI. Additionally, component tests now show a notice about URL navigation being disabled in component tests. Addresses #30999. Addressed in #31119.
• Updated types around .readFile() and .scrollTo() arguments and Cypress.dom methods. Addressed in #31055.
• Updated types around .shadow() and .root() options. Addressed in #31154.

Dependency Updates:

• Upgraded chrome-remote-interface from 0.33.2 to 0.33.3. Addressed in #31128.
• Upgraded ci-info from 4.0.0 to 4.1.0. Addressed in #31132.
• Upgraded compression from 1.7.5 to 1.8.0. Addressed in #31151.

14.0.3

Bugfixes:

• Fixed an issue in Cypress 14.0.2 where privileged commands did not run correctly when a spec file or support file contained certain encoded characters. Fixes #31034 and #31060.

Dependency Updates:

• Upgraded @cypress/request from 3.0.6 to 3.0.7. Addressed in #31063.
• Upgraded compression from 1.7.4 to 1.7.5. Addressed in #31004.

14.0.2

Bugfixes:

• Fixed a regression introduced in 14.0.0 where error codeframes in the runner UI were not populated with the correct data in failed retry attempts. Fixes #30927.
• All commands performed in after and afterEach hooks will now correctly retry when a test fails. Commands that are actions like .click() and .type() will now perform the action in this situation also. Fixes #2831.
• Fixed an issue in Cypress 14.0.0 where privileged commands did not run correctly when a spec file or support file contained characters that required encoding. Fixes #30933.
• Re-enabled retrying Cloud instance creation for runs that are parallel or recorded. Fixes #31002.

Misc:

• Updated the mismatched dependencies warning message to be neutral, avoiding assumptions about upgrading or downgrading. Fixes #30990.

Dependency Updates:

• Upgraded mime from 2.6.0 to 3.0.0. Addressed in #30966.

14.0.1

Bugfixes:

• Fixed an issue where Cypress would incorrectly navigate to about:blank when test isolation was disabled and the last test would fail and then retry. Fixes #28527.
• Fixed a regression introduced in 14.0.0 where an element would not return the correct visibility if its offset parent was within the clipping element. Fixes #30922.
• Fixed a regression introduced in 14.0.0 where the incorrect visibility would be returned when either overflow-x or overflow-y was visible but the other one was clipping. Fixed in #30934.
• Fixed an issue where an option element would not return the correct visibility if its parent element has a clipping overflow. Fixed in #30934.
• Fixed an issue where non-HTMLElement(s) may fail during assertions. Fixes #30944

Misc:

• Some broken links displayed in 14+ now link to the correct documentation URL. Addresses #30951. Addressed in #30953.
• Benign Mesa/GLX related warnings are now hidden in the terminal output when running Cypress in certain Linux environments or containers. Addresses #29521 and #29554.

14.0.0

Breaking Changes:

• Removed support for Node.js 16 and Node.js 21. Addresses #29930.
• Upgraded bundled Node.js version from 18.17.0 to 20.18.1. Addresses #29547.
• Prebuilt binaries for Linux are no longer compatible with Linux distributions based on glibc <2.28, for example: Ubuntu 14-18, RHEL 7, CentOS 7, Amazon Linux 2. Addresses #29601.
• Cypress now only officially supports the latest 3 major versions of Chrome, Firefox, and Edge - older browser versions may still work, but we recommend keeping your browsers up to date to ensure compatibility with Cypress. A warning will no longer be displayed on browser selection in the Launchpad for any 'unsupported' browser versions. Additionally, the undocumented minSupportedVersion property has been removed from Cypress.browser. Addressed in #30462.
• The cy.origin() command must now be used when navigating between subdomains. Because this is a fairly disruptive change for users who frequently navigate between subdomains, a new configuration option is being introduced. injectDocumentDomain can be set to true in order to re-enable the injection of document.domain by Cypress. This configuration option is marked as deprecated and you will receive a warning when Cypress is launched with this option set to true. It will be removed in a future version of Cypress. Addressed in #30770. Addresses #25806, #25987, #27528, #29445, #29590 and #30571.
• It is no longer possible to make a fetch or XMLHttpRequest request from the about:blank page in Electron (i.e. cy.window().then((win) => win.fetch('<some-url>'))). You must use cy.request instead or perform some form of initial navigation via cy.visit(). Addressed in #30394.
• The experimentalJustInTimeCompile configuration option for component testing has been replaced with a justInTimeCompile option that is true by default. This option will only compile resources directly related to your spec, compiling them 'just-in-time' before spec execution. This should result in improved memory management and performance for component tests in cypress open and cypress run modes, in particular for large component testing suites. justInTimeCompile is now only supported for webpack. Addresses #30234. Addressed in #30641.
• Cypress Component Testing no longer supports:
  • create-react-app. Addresses #30028.
  • @vue/cli-service. Addresses #30481.
  • Angular versions 13, 14, 15, and 16. The minimum supported version is now 17.2.0 in order to fully support Angular signals. Addresses #29582. Addressed in #30539.
  • Next.js versions 10, 11, 12, and 13. Addresses #29583.
  • Nuxt.js version 2. Addresses #30468.
  • React versions 16 and 17. Addresses #29607.
  • Svelte versions 3 and 4. Addresses #30492 and #30692.
  • Vue version 2. Addresses #30295.
• The cypress/react18 test harness is no longer included in the Cypress binary. Instead, React 18 support is now shipped with cypress/react! Addresses #29607.
• The cypress/angular-signals test harness is no longer included in the Cypress binary. Instead, signals support is now shipped with cypress/angular! This requires rxjs to be installed as a peerDependency. Addresses #29606.
• The Cypress configuration wizard for Component Testing supports TypeScript 4.0 or greater. Addresses #30493.
• @cypress/webpack-dev-server no longer supports webpack-dev-server version 3. Additionally, @cypress/webpack-dev-server now ships with webpack-dev-server version 5 by default. webpack-dev-server version 4 will need to be installed alongside Cypress if you are still using webpack version 4. Addresses #29308, #30347, and #30141.
• @cypress/vite-dev-server no longer supports vite versions 2 and 3. Addresses #29377 and #29378.
• The delayMs option of cy.intercept() has been removed. This option was deprecated in Cypress 6.4.0. Please use the delay option instead. Addressed in #30463.
• The experimentalFetchPolyfill configuration option was removed. This option was deprecated in Cypress 6.0.0. We recommend using cy.intercept() for handling fetch requests. Addressed in #30466.
• We removed yielding the second argument of before:browser:launch as an array of browser arguments. This behavior has been deprecated since Cypress 4.0.0. Addressed in #30460.
• The cypress open-ct and cypress run-ct CLI commands were removed. Please use cypress open --component or cypress run --component respectively instead. Addressed in #30456
• The undocumented methods Cypress.backend('firefox:force:gc') and Cypress.backend('log:memory:pressure') were removed. Addresses #30222.

Deprecations:

• The resourceType option on cy.intercept has been deprecated. We anticipate the resource types to change or be completely removed in the future. Our intention is to replace essential functionality dependent on the resourceType within Cypress in a future version (like hiding network logs that are not fetch/xhr). Please leave feedback on any essential uses of resourceType in this GitHub issue. Addresses #30433.
• The new injectDocumentDomain configuration option is released as deprecated. It will be removed in a future version of Cypress. Addressed in #30770.

Features:

• injectDocumentDomain, a new configuration option, can be set to true in order to re-enable the injection of document.domain by Cypress. Addressed in #30770.
• Cypress Component Testing now supports:
  • Next.js version >=15.0.4. Versions 15.0.0 - 15.0.3 depend on the React 19 Release Candidate and are not officially supported by Cypress, but should still work. Addresses #30445.
  • React version 19. Addresses #29470.
  • Angular version 19. Addresses #30175.
  • Vite version 6. Addresses #30591.
  • Svelte version 5. Addresses #29641.

Bugfixes:

• Elements with display: contents will no longer use box model calculations for visibility, and correctly show as visible when they are visible. Fixed in #29680. Fixes #29605.
• Fixed a visibility issue when the element is positioned static or relative and the element's offset parent is positioned absolute, a descendent of the ancestor, and has no clippable overflow. Fixed in #29689. Fixes #28638.
• Fixed a visibility issue for elements with textContent but without a width or height. Fixed in #29688. Fixes #29687.
• Elements whose parent elements has overflow: clip and no height/width will now correctly show as hidden. Fixed in #29778. Fixes #23852.
• The CSS pseudo-class :dir() is now supported when testing in Electron. Addresses #29766.
• Fixed an issue where the spec filename was not updating correctly when changing specs in open mode. Fixes #30852.
• cy.origin() now correctly errors when the cy.window(), cy.document(), cy.title(), cy.url(), cy.location() ,cy.hash(), cy.go(), cy.reload(), and cy.scrollTo() commands are used outside of the cy.origin() command after the AUT has navigated away from the primary origin. Fixes #30848. Fixed in #30858.

Misc:

• Removed some component testing API stubs that were removed in Cypress v11.0.0. Addressed in #30696. Addresses #30623.
• Updated to use Cypress design system browser icons. Addressed in #30790.

Dependency Updates:

• Upgraded electron from 27.3.10 to 33.2.1. Addresses #29547 and #30561.
• Upgraded @electron/rebuild from 3.2.10 to 3.7.1. Addresses #28766 and #30632.
• Upgraded bundled Chromium version from 118.0.5993.159 to 130.0.6723.137. Addresses #29547 and #30561.
• Updated jQuery from 3.4.1 to 3.7.1. Addressed in #30345.
• Updated react from 17.0.2 to 18.3.1 and react-dom from 17.0.2 to 18.3.1. Addresses #30511.
• Upgraded @vue/test-utils from 2.3.2 to 2.4.6. Addresses #26628.

13.17.0

Features:

• Added official support for the Google Chrome for Testing browser. Assuming the browser is in a location where it can be auto-detected, it can be launched by providing the --browser chrome-for-testing option. If it can't be auto-detected, the path to the browser can also be provided. Previously customizing the available browsers was required. Addresses #28123 and #28554.

Bugfixes:

• Fixed an issue where targets may hang if Network.enable is not implemented for the target. Addresses #29876.
• Updated Firefox userChrome.css to correctly hide the toolbox during headless mode. Addresses #30721.
• Fixed an issue loading the cypress.config.ts file with Node.js version 22.12.0 if it is loaded as an ESM. Addresses #30715.

Misc:

• Removed a comment from the scaffolded supportFile for component tests around CommonJS syntax. Addresses #23287.

Dependency Updates:

• Updated chai from 4.2.0 to 4.5.0. Addressed in #30737.

13.16.1

Bugfixes:

• During recorded or parallel runs, execution will fail if Cypress is unable to confirm the creation of an instance instead of skipping the spec. Addresses #30628.

13.16.0

Features:

• Updated the protocol to be able to flex logic based on project config. Addresses #30560.
• Added new defaultBrowser configuration option to specify the default browser to launch. This option only affects the first browser launch; changing this option after the browser is already launched will have no effect. Addresses #6646.

Bugfixes:

• Fixed an issue where some JS assets were not properly getting sourcemaps included with the vite dev server if they had a cache busting query parameter in the URL. Fixed some scenarios to ensure that the sourcemaps that were included by the vite dev server were inlined. Addressed in #30606.

13.15.2

Bugfixes:

• Fixed an issue where the Cypress runner could hang in after or afterEach hooks that run Cypress commands after a page load timeout error occurs. Addresses #30238.

Misc:

• Fixed a typo in CLI global option help text. Addresses #30531.

Dependency Updates:

• Updated react from 16.8.6 to 17.0.2 and react-dom from 16.8.6 to 17.0.2. Addresses #30510.
• Updated mobx from 5.15.4 to 6.13.5 and mobx-react from 6.1.8 to 9.1.1. Addresses #30509.
• Updated @cypress/request from 3.0.4 to 3.0.6. Addressed in #30488.

13.15.1

Bugfixes:

• Patched find-process to fix an issue where trying to clean up browser profiles can throw an error on Windows. Addresses #30378.
• Fixed an issue where requests to the same resource in rapid succession may not have the appropriate static response intercept applied if there are multiple intercepts that apply for that resource. Addresses #30375.

Misc:

• Cypress now consumes geckodriver to help automate the Firefox browser instead of marionette-client. Addresses #30217.
• Cypress now consumes webdriver to help automate the Firefox browser and firefox-profile to create a firefox profile and convert it to Base64 to save user screen preferences via xulstore.json. Addresses #30300 and #30301.
• Pass spec information to protocol's beforeSpec to improve troubleshooting when reporting on errors. Addressed in #30316.

Dependency Updates:

• Updated simple-git from 3.16.0 to 3.25.0. Addressed in #30076.

13.15.0

Features:

• Cypress now displays more actionable errors when a Test Replay upload takes too long, and more verbose messages when uncategorized errors occur during the upload process. Addressed in #30235.

Bugfixes:

• Fixed an issue where Firefox was incorrectly mutating the state of click events on checkboxes after Firefox version 129 and up. Addressed in #30245.
• Fixed a regression introduced in 13.13.0 where 'Open in IDE' would not work for filepaths containing spaces and various other characters on Windows. Addresses #29820.

Misc:

• Pass along the related log to the createSnapshot function for protocol usage. Addressed in #30244.

Dependency Updates:

• Update @cypress/request from 3.0.1 to 3.0.4. Addressed in #30194.
• Updated express from 4.19.2 to 4.21.0. This removes the CVE-2024-43796, CVE-2024-45590, and CVE-2024-43800 vulnerabilities being reported in security scans. Addresses #30241.
• Update launch-editor from 2.8.0 to 2.9.1. Addressed in #30247.
• Updated loader-utils from 1.4.0 to 1.4.2. This removes the CVE-2022-37601 vulnerability being reported in security scans. Addresses #28208.
• Updated send from 0.17.1 to 0.19.0. This removes the CVE-2024-43799 vulnerability being reported in security scans. Addressed in #30241.

13.14.2

Bugfixes:

• Fixed an issue where Cypress could crash with a WebSocket Connection Closed error. Fixes #30100.
• Fixed an issue where cy.screenshot() was timing out and Cypress was failing to start due to GLib-GIO-ERROR error. Reverts #30109, the change to allow HiDPI screen for Wayland users. Fixes #30172 and #30160.

13.14.1

Bugfixes:

• Fixed an issue where no description was available for the experimentalJustInTimeCompile feature inside the Cypress application settings page. Addresses #30126.

13.14.0

Performance:

• Fixed a potential memory leak in the Cypress server when re-connecting to an unintentionally disconnected CDP connection. Fixes #29744. Addressed in #29988.

Features:

• Added new experimentalJustInTimeCompile configuration option for component testing. This option will only compile resources directly related to your spec, compiling them 'just-in-time' before spec execution. This should result in improved memory management and performance for component tests in cypress open and cypress run modes, in particular for large component testing suites. experimentalJustInTimeCompile is currently supported for webpack and vite. Addresses #29244.
• .type({upArrow}) and .type({downArrow}) now also works for date, month, week, time, datetime-local and range input types. Addresses #29665.
• Added a CYPRESS_SKIP_VERIFY flag to enable suppressing Cypress verification checks. Addresses #22243.
• Updated the protocol to allow making Cloud API requests. Addressed in #30066.
• Passing --browser flag alone will automatically launch browser after being guided through project and/or testing type selection. Addressed in #28538.

Bugfixes:

• Fixed an issue where files outside the Cypress project directory were not calculating the bundle output path correctly for the file:preprocessor. Addresses #8599.
• Fixed an issue where Cypress would not run if Node.js version 22.7.0 was being used with TypeScript and ES Modules. Fixes #30084.
• Correctly determines current browser family when choosing between unload and pagehide options in App Runner. Fixes #29880.

Misc:

• Allow HiDPI screen running Wayland to use Cypress window/browser by adding --ozone-platform-hint=auto flag to Electron's runtime argument. Addresses #20891.

Dependency Updates:

• Updated detect-port from 1.3.0 to 1.6.1. Addressed in #30038.

13.13.3

Bugfixes:

• A console error will no longer display in Chrome about a deprecated unload call originating from jQuery. Addressed in #29944.
• Fixed an issue where certain Test Replay upload error messages were too vague. Connection failures now report the precise system error, and the stall error message is reported rather than the vague, "The user aborted a request." Addressed in #29959.

Misc:

• Updated cypress open hints displayed after Cypress binary install. Addresses #29935.

Dependency Updates:

• Updated image-size from 0.8.3 to 1.1.1. Addressed in #30023.

13.13.2

Performance:

• Fixed a memory leak with command logs with Test Replay enabled. Addressed in #29939.
• Improved performance of reduce in a method within our proxy. Addressed in #29887.

Bugfixes:

• Fixed an issue where Yarn PnP was not working correctly with Cypress and @cypress/webpack-batteries-included-preprocessor. Fixes #27947.

Dependency Updates:

• Updated @cypress/request from 3.0.0 to 3.0.1. Addresses #29863.
• Updated chrome-remote-interface from 0.33.0 to 0.33.2. Addressed in #29932.
• Updated mime from 2.4.4 to 2.6.0. Addressed in #29870.
• Updated strip-ansi from 6.0.0 to 6.0.1. Addressed in #29931.

13.13.1

Bugfixes:

• Fixed an issue where unhandled WebSocket connection closed exceptions would be thrown when CDP connections rapidly connect, disconnect, and connect again while there are pending commands. Fixes #29572.
• CLI output properly displays non-JSON response bodies when a Test Replay upload attempt returns a non-JSON response body for a non-200 status code. Addressed in #29801.
• Fixed an issue where the ReadStream used to upload a Test Replay recording could erroneously be re-used when retrying in cases of retryable upload failures. Fixes #29227.
• Fixed an issue where command snapshots were not being captured within the cy.origin() command within Test Replay. Addressed in #29828.

Dependency Updates:

• Updated jquery from 3.1.1 to 3.4.1. Addresses #29822. Addressed in #29837.
• Replaced json-lint with json-parse-even-better-errors. This removes the CVE-2021-23358 vulnerability being reported in security scans. Addresses #28207.
• Updated minimatch from 3.0.4 to 3.1.2. Addressed in #29821.

13.13.0

Performance:

• Improved performance of experimentalSourceRewriting option. Fixed in #29540.

Features:

• Adds Signal support for Angular Component Testing versions 17.2 and up. Addresses #29264.

Bugfixes:

• Fixed an issue where Chrome launch instances would not recreate the browser CRI client correctly after recovering from an unexpected browser closure. Fixes #27657. Fixed in #29663.
• Fixed an issue where Firefox 129 (Firefox Nightly) would not launch with Cypress. Fixes #29713. Fixed in #29720.

Dependency Updates:

• Updated launch-editor from 2.3.0 to 2.8.0. Addressed in #29770.
• Updated memfs from 3.4.12 to 3.5.3. Addressed in #29746.
• Updated tmp from 0.2.1 to 0.2.3. Addresses #29693.
• Updated ws from 5.2.3 to 5.2.4. Addressed in #29698.

13.12.0

Features:

• Added Component Testing support for Angular version 18. Addresses #29309.

Bugfixes:

• We now trigger input and change events when typing {upArrow} and {downArrow} via .type() on input[type=number] elements. Fixes #29611
• Fixed an issue where auto scrolling the reporter would sometimes be disabled without the user's intent. Fixes #25084.
• Fixed an issue where inlineSourceMaps was still being used when sourceMaps was provided in a users typescript config for typescript version 5. Fixes #26203.
• When capture protocol script fails verification, an appropriate error is now displayed. Previously, an error regarding Test Replay archive location was shown. Addressed in #29603.
• Fixed an issue where receiving HTTP responses with invalid headers raised an error. Now cypress removes the invalid headers and gives a warning in the console with debug mode on. Fixes #28865.

Misc:

• Report afterSpec durations to Cloud API when running in record mode with Test Replay enabled. Addressed in #29500.

Dependency Updates:

• Updated firefox-profile from 4.3.1 to 4.6.0. Addressed in #29662.
• Updated typescript from 4.7.4 to 5.3.3. Addressed in #29568.
• Updated url-parse from 1.5.9 to 1.5.10. Addressed in #29650.

13.11.0

Performance:

• Improved performance when setting console props within Cypress.log. Addressed in #29501.

Features:

• Added support for Next.js 14 for component testing. Addresses #28185.
• Added an IGNORE_CHROME_PREFERENCES environment variable to ignore Chrome preferences when launching Chrome. Addresses #29330.

Bugfixes:

• Fixed a situation where the Launchpad would hang if the project config had not been loaded when the Launchpad first queries the current project. Fixes #29486.
• Preemptively fix behavior with Chrome for when unload events are forcefully deprecated by using pagehide as a proxy. Fixes #29241.

Misc:

• Enhanced the type definitions available to cy.intercept and cy.wait. The body property of both the request and response in an interception can optionally be specified with user-defined types. Addresses #29507.

13.10.0

Features:

• Added support for vite v5 to @cypress/vite-dev-server. Addresses #28347.

Bugfixes:

• Fixed an issue where orphaned Electron processes were inadvertently terminating the browser's CRI client. Fixes #28397. Fixed in #29515.
• Fixed an issue where Cypress would use the wrong URL to upload Test Replay recordings when it wasn't able to determine the upload URL. It now displays an error when the upload URL cannot be determined, rather than a "Request Entity Too Large" error. Addressed in #29512.
• Fixed an issue where Cypress was unable to search in the Specs list for files or folders containing numbers. Fixes #29034.
• Fixed an issue setting the x-cypress-file-path header when there are invalid header characters in the file path. Fixes #25839.
• Fixed the display of some command assertions. Fixed in #29517.

Dependency Updates:

• Updated js-cookie from 2.2.1 to 3.0.5. Addressed in #29497.
• Updated randomstring from 1.1.5 to 1.3.0. Addressed in #29503.

13.9.0

Features:

• Added more descriptive error messages when Test Replay fails to record or upload. Addresses #29022.

Bugfixes:

• Fixed a bug where promises rejected with undefined were failing inside cy.origin(). Addresses #23937.
• We now pass the same default Chromium flags to Electron as we do to Chrome. As a result of this change, the application under test's navigator.webdriver property will now correctly be true when testing in Electron. Fixes #27939.
• Fixed network issues in requests using fetch for users where Cypress is run behind a proxy that performs HTTPS decryption (common among corporate proxies). Fixes #29171.
• Fixed an issue where extra windows weren't being closed between specs in Firefox causing potential issues in subsequent specs. Fixes #29473.

Misc:

• Improved accessibility of the Cypress App in some areas. Addressed in #29322.

Dependency Updates:

• Updated electron from 27.1.3 to 27.3.10 to address CVE-2024-3156. Addressed in #29431.

13.8.1

Performance:

• Fixed a performance issue with activated service workers that aren't controlling clients which could lead to correlation timeouts. Fixes #29333 and #29126.

Bugfixes:

• Fixed a regression introduced in 13.6.0 where Cypress would occasionally exit with status code 1, even when a test run was successful, due to an unhandled WebSocket exception (Error: WebSocket connection closed). Addresses #28523.
• Fixed an issue where Cypress would hang on some commands when an invalid timeout option was provided. Fixes #29323.

Misc:

• .its() type now excludes null and undefined. Fixes #28872.

Dependency Updates:

• Updated zod from 3.20.3 to 3.22.5. Addressed in #29367.

13.8.0

Features:

• Added support for webpack-dev-server v5 to @cypress/webpack-dev-server. Addresses #29305.

Bugfixes:

• Fixed a regression introduced in 13.7.3 where Cypress could hang handling long assertion messages. Fixes #29350.

Misc:

• The SEMAPHORE_GIT_PR_NUMBER environment variable from Semaphore CI is now captured to display the linked PR number in the Cloud. Addressed in #29314.

13.7.3

Bugfixes:

• Fixed an issue where asserts with custom messages weren't displaying properly. Fixes #29167.
• Fixed and issue where Cypress launch arguments were not being escaped correctly with multiple values inside quotes. Fixes #27454.

Misc:

• Updated the Chrome flags to not show the "Enhanced Ad Privacy" dialog. Addresses #29199.
• Suppresses benign warnings that reference Vulkan on GPU-less hosts. Addresses #29085. Addressed in #29278.

13.7.2

Performance:

• Improvements to Test Replay upload resiliency. Fixes #28890. Addressed in #29174

Bugfixes:

• Fixed an issue where Cypress was not executing beyond the first spec in cypress run for versions of Firefox 124 and up when a custom user agent was provided. Fixes #29190.
• Fixed a bug where fields using arrays in cypress.config are not correctly processed. Fixes #27103. Fixed in #27312.
• Fixed a hang where Cypress would run indefinitely while recording to the cloud when CDP disconnects during the middle of a test. Fixes #29209.
• Fixed a bug where option values containing quotation marks could not be selected. Fixes #29213

Dependency Updates:

• Updated express from 4.17.3 to 4.19.2. Addressed in #29211.

13.7.1

Bugfixes:

• Fixed an issue where Cypress was not executing beyond the first spec in cypress run for versions of Firefox 124 and up. Fixes #29172.
• Fixed an issue blurring shadow dom elements. Fixed in #29125.

Dependency Updates:

• Updated jose from 4.11.2 to 4.15.5. Addressed in #29086.

13.7.0

Features:

• Added shadow DOM snapshot support within Test Replay in order to highlight elements correctly within the Cypress reporter. Addressed in #28823.
• Added TypeScript support for Vue 2.7+. Addresses #28591.
• Adds additional context to error messages displayed when Test Replay artifacts fail to upload. Addressed in #28986

Performance:

• Fixed a performance regression from 13.6.3 where unhandled service worker requests may not correlate correctly. Fixes #28868.
• Reduces the number of attempts to retry failed Test Replay artifact uploads from 8 to 3, to reduce time spent on artifact upload attempts that will not succeed. Addressed in #28986

Bugfixes:

• Changed screenshot capture behavior in Chromium to activate the main Cypress tab before capturing. This prevents screenshot capture from timing out in certain situations. Fixed in #29038. Fixes #5016
• Fixed an issue where .click() commands on children of disabled elements would still produce "click" events -- even without { force: true }. Fixes #28788.
• Changed RequestBody type to allow for boolean and null literals to be passed as body values. #28789

Misc:

• Changed Component Testing scaffolding instruction to pnpm add to add framework dependencies when a project uses pnpm as package manager. Addresses #29052.
• Command messages in the Cypress command logs will now truncate display at 100 lines instead of 50. Fixes #29023.
• Capture the beforeTest timestamp inside the browser for the purposes of accurately determining test start for Test Replay. Addressed in #29061.

Dependency Updates:

• Updated jimp from 0.14.0 to 0.22.12. Addressed in #29055.
• Updated http-proxy-middleware from 2.0.4 to 2.0.6. Addressed in #28902.
• Updated signal-exit from 3.0.3 to 3.0.7. Addressed in #28979.

13.6.6

Bugfixes:

• Fixed an issue where cypress verify was failing for nx users. Fixes #28982.

13.6.5

Bugfixes:

• Fixed tests hanging when the Chrome browser extension is disabled. Fixes #28392.
• Fixed an issue which caused the browser to relaunch after closing the browser from the Launchpad. Fixes #28852.
• Fixed an issue with the unzip promise never being rejected when an empty error happens. Fixed in #28850.
• Fixed a regression introduced in 13.6.3 where Cypress could crash when processing service worker requests through our proxy. Fixes #28950.
• Fixed incorrect type definition of dom.getContainsSelector. Fixed in #28339.

Misc:

• Improved accessibility of the Cypress App in some areas. Addressed in #28774.
• Changed references of LayerCI to webapp.io. Addressed in #28874.

Dependency Updates:

• Upgraded electron from 25.8.4 to 27.1.3.
• Upgraded bundled Node.js version from 18.15.0 to 18.17.0.
• Upgraded bundled Chromium version from 114.0.5735.289 to 118.0.5993.117.
• Updated buffer from 5.6.0 to 5.7.1. Addressed in #28934.
• Updated duplexify from 4.1.1 to 4.1.2. Addressed in #28941.
• Updated is-ci from 3.0.0 to 3.0.1. Addressed in #28933.

13.6.4

Performance:

• Fixed a performance regression from 13.3.2 where aborted requests may not correlate correctly. Fixes #28734.

Bugfixes:

• Fixed an issue with capturing assets for Test Replay when service workers are registered in Cypress support files. This issue would cause styles to not render properly in Test Replay. Fixes #28747.

Misc:

• Added missing properties to the Cypress.spec interface for TypeScript users. Addresses #27835.

13.6.3

Bugfixes:

• Force moduleResolution to node when typescript projects are detected to correctly run Cypress. This change should not have a large impact as commonjs is already forced when ts-node is registered. This fix does not impact the ESM Typescript configuration loader. Fixes #27731.
• No longer wait for additional frames when recording a video for a spec that was skipped by the Cloud due to Auto Cancellation. Fixes #27898.
• Now node_modules will not be ignored if a project path or a provided path to spec files contains it. Fixes #23616.
• Updated display of assertions and commands with a URL argument to escape markdown formatting so that values are displayed as is and assertion values display as bold. Fixes #24960 and #28100.
• When generating assertions via Cypress Studio, the preview of the generated assertions now correctly displays the past tense of 'expected' instead of 'expect'. Fixed in #28593.
• Fixed a regression in 13.6.2 where the body element was not highlighted correctly in Test Replay. Fixed in #28627.
• Correctly sync Cypress.currentRetry with secondary origin so test retries that leverage cy.origin() render logs as expected. Fixes #28574.
• Fixed an issue where some cross-origin logs, like assertions or cy.clock(), were getting too many dom snapshots. Fixes #28609.
• Fixed asset capture for Test Replay for requests that are routed through service workers. This addresses an issue where styles were not being applied properly in Test Replay and cy.intercept() was not working properly for requests in this scenario. Fixes #28516.
• Fixed an issue where visiting an http:// site would result in an infinite reload/redirect loop in Chrome 114+. Fixes #25891.
• Fixed an issue where requests made from extra tabs do not include their original headers. Fixes #28641.
• Fixed an issue where cy.wait() would sometimes throw an error reading a property of undefined when returning responses. Fixes #28233.

Performance:

• Fixed a performance regression from 13.3.2 where requests may not correlate correctly when test isolation is off. Fixes #28545.

Dependency Updates:

• Remove dependency on @types/node package. Addresses #28473.
• Updated @cypress/unique-selector to include a performance optimization. It's possible this could improve performance of the selector playground. Addressed in #28571.
• Replace CircularJSON with its successor flatted version 3.2.9. This resolves decoding issues observed in complex objects sent from the browser. Addressed in #28683.
• Updated better-sqlite3 from 8.7.0 to 9.2.2 to fix macOS Catalina issues. Addresses #28697.

Misc:

• Improved accessibility of some areas of the Cypress App. Addressed in #28628.
• Updated some documentation links to go through on.cypress.io. Addressed in #28623.

13.6.2

Bugfixes:

• Fixed a regression in 13.6.1 where a malformed URI would crash Cypress. Fixes #28521.
• Fixed a regression in 12.4.0 where erroneous <br> tags were displaying in error messages in the Command Log making them less readable. Fixes #28452.

Performance:

• Improved performance when finding unique selectors for command log snapshots for Test Replay. Addressed in #28536.

Dependency Updates:

• Updated ts-node from 10.9.1 to 10.9.2. Cypress will longer error during cypress run or cypress open when using Typescript 5.3.2+ with extends in tsconfig.json. Addresses #28385.

13.6.1

Bugfixes:

• Fixed an issue where pages or downloads opened in a new tab were missing basic auth headers. Fixes #28350.
• Fixed an issue where request logging would default the message to the args of the currently running command even though those args would not apply to the request log and are not displayed. If the args are sufficiently large (e.g. when running the cy.task from the code-coverage plugin) there could be performance/memory implications. Addressed in #28411.
• Fixed an issue where commands would fail with the error must only be invoked from the spec file or support file if the project's baseUrl included basic auth credentials. Fixes #27457 and #28336.
• Fixed an issue where some URLs would timeout in pre-request correlation. Addressed in #28427.
• Cypress will now correctly log errors and debug logs on Linux machines. Fixes #5051 and #24713.

Misc:

• Artifact upload duration is now reported to Cypress Cloud. Fixes #28238. Addressed in #28418.

13.6.0

Features:

• Added an activity indicator to CLI output when artifacts (screenshots, videos, or Test Replay) are being uploaded to the cloud. Addresses #28239. Addressed in #28277.
• When artifacts are uploaded to the Cypress Cloud, the duration of each upload will be displayed in the terminal. Addresses #28237.

Bugfixes:

• We now allow absolute paths when setting component.indexHtmlFile in the Cypress config. Fixes #27750.
• Fixed an issue where dynamic intercept aliases now show with alias name instead of "no alias" in driver. Addresses #24653
• Fixed an issue where aliasing individual requests with cy.intercept() led to an error when retrieving all of the aliases with cy.get(@alias.all) . Addresses #25448
• The URL of the application under test and command error "Learn more" links now open externally instead of in the Cypress-launched browser. Fixes #24572.
• Fixed issue where some URLs would timeout in pre-request correlation. Addressed in #28354.

Misc:

• Browser tabs and windows other than the Cypress tab are now closed between tests in Chromium-based browsers. Addressed in #28204.
• Cypress now ensures the main browser tab is active before running each command in Chromium-based browsers. Addressed in #28334.

Dependency Updates:

• Upgraded chrome-remote-interface from 0.31.3 to 0.33.0 to increase the max payload from 100MB to 256MB. Addressed in #27998.

13.5.1

Bugfixes:

• Fixed a regression in 13.5.0 where requests cached within a given spec may take longer to load than they did previously. Addresses #28295.
• Fixed an issue where pages opened in a new tab were missing response headers, causing them not to load properly. Fixes #28293 and #28303.
• We now pass a flag to Chromium browsers to disable default component extensions. This is a common flag passed during browser automation. Fixed in #28294.

13.5.0

Features:

• Added Component Testing support for Angular version 17. Addresses #28153.

Bugfixes:

• Fixed an issue in chromium based browsers, where global style updates can trigger flooding of font face requests in DevTools and Test Replay. This can affect performance due to the flooding of messages in CDP. Fixes #28150 and #28215.
• Fixed a regression in 13.3.3 where Cypress would hang on loading shared workers when using cy.reload to reload the page. Fixes #28248.
• Fixed an issue where network requests made from tabs, or windows other than the main Cypress tab, would be delayed. Fixes #28113.
• Fixed an issue with 'other' targets (e.g. pdf documents embedded in an object tag) not fully loading. Fixes #28228 and #28162.
• Fixed an issue where clicking a link to download a file could cause a page load timeout when the download attribute was missing. Note: download behaviors in experimental Webkit are still an issue. Fixes #14857.
• Fixed an issue to account for canceled and failed downloads to correctly reflect these status in Command log as a download failure where previously it would be pending. Fixed in #28222.
• Fixed an issue determining visibility when an element is hidden by an ancestor with a shared edge. Fixes #27514.
• We now pass a flag to Chromium browsers to disable Chrome translation, both the manual option and the popup prompt, when a page with a differing language is detected. Fixes #28225.
• Stopped processing CDP events at the end of a spec when Test Isolation is off and Test Replay is enabled. Addressed in #28213.

13.4.0

Features:

• Introduced experimental configuration options for advanced retry logic: adds experimentalStrategy and experimentalOptions keys to the retry configuration key. See Experimental Flake Detection Features in the documentation. Addressed in #27930.

Bugfixes:

• Fixed a regression in 13.3.2 where Cypress would crash with 'Inspected target navigated or closed' or 'Session with given id not found'. Fixes #28141 and #28148.

13.3.3

Bugfixes:

• Fixed a performance regression in 13.3.1 with proxy correlation timeouts and requests issued from web and shared workers. Fixes #28104.
• Fixed a performance problem with proxy correlation when requests are aborted and then incorrectly correlated with follow-up requests. Addressed in #28094.
• Fixed a regression in 10.0.0, where search would not find a spec if the file name contains "-" or "_", but search prompt contains " " instead (e.g. search file "spec-file.cy.ts" with prompt "spec file"). Fixes #25303.

13.3.2

Bugfixes:

• Fixed a performance regression in 13.3.1 with proxy correlation timeouts and requests issued from service workers. Fixes #28054 and #28056.
• Fixed an issue where proxy correlation would leak over from a previous spec causing performance problems, cy.intercept problems, and Test Replay asset capturing issues. Addressed in #28060.
• Fixed an issue where redirects of requests that knowingly don't have CDP traffic should also be assumed to not have CDP traffic. Addressed in #28060.
• Fixed an issue with Accept Encoding headers by forcing gzip when no accept encoding header is sent and using identity if gzip is not sent. Fixes #28025.

Dependency Updates:

• Upgraded @babel/core from 7.22.9 to 7.23.2 to address the SNYK-JS-SEMVER-3247795 security vulnerability. Addressed in #28063.
• Upgraded @babel/traverse from 7.22.8 to 7.23.2 to address the SNYK-JS-BABELTRAVERSE-5962462 security vulnerability. Addressed in #28063.
• Upgraded react-docgen from 6.0.0-alpha.3 to 6.0.4 to address the SNYK-JS-BABELTRAVERSE-5962462 security vulnerability. Addressed in #28063.

13.3.1

Bugfixes:

• Fixed an issue where requests were correlated in the wrong order in the proxy. This could cause an issue where the wrong request is used for cy.intercept or assets (e.g. stylesheets or images) may not properly be available in Test Replay. Addressed in #27892.
• Fixed an issue where a crashed Chrome renderer can cause the Test Replay recorder to hang. Addressed in #27909.
• Fixed an issue where multiple responses yielded from calls to cy.wait() would sometimes be out of order. Fixes #27337.
• Fixed an issue where requests were timing out in the proxy. This could cause an issue where the wrong request is used for cy.intercept or assets (e.g. stylesheets or images) may not properly be available in Test Replay. Addressed in #27976.
• Fixed an issue where Test Replay couldn't record tests due to issues involving GLIBC. Fixed deprecation warnings during the rebuild of better-sqlite3. Fixes #27891 and #27902.
• Enables test replay for executed specs in runs that have a spec that causes a browser crash. Addressed in #27786.

13.3.0

Features:

• Introduces new layout for Runs page providing additional run information. Addresses #27203.

Bugfixes:

• Fixed an issue where actionability checks trigger a flood of font requests. Removing the font requests has the potential to improve performance and removes clutter from Test Replay. Addressed in #27860.
• Fixed network stubbing not permitting status code 999. Fixes #27567. Addressed in #27853.

13.2.0

Features:

• Adds support for Nx users who want to run Angular Component Testing in parallel. Addressed in #27723.

Bugfixes:

• Edge cases where cy.intercept() would not properly intercept and asset response bodies would not properly be captured for Test Replay have been addressed. Addressed in #27771.
• Fixed an issue where enter, keyup, and space events were not triggering click events properly in some versions of Firefox. Addressed in #27715.
• Fixed a regression in 13.0.0 where tests using Basic Authorization can potentially hang indefinitely on chromium browsers. Addressed in #27781.
• Fixed a regression in 13.0.0 where component tests using an intercept that matches all requests can potentially hang indefinitely. Addressed in #27788.

Dependency Updates:

• Upgraded Electron from 21.0.0 to 25.8.0, which updates bundled Chromium from 106.0.5249.51 to 114.0.5735.289. Additionally, the Node version binary has been upgraded from 16.16.0 to 18.15.0. This does NOT have an impact on the node version you are using with Cypress and is merely an internal update to the repository & shipped binary. Addressed in #27715. Addresses #27595.

13.1.0

Features:

• Introduces a status icon representing the latest test run in the Sidebar for the Runs Page. Addresses #27206.

Bugfixes:

• Fixed a regression introduced in Cypress 13.0.0 where the Module API, after:run, and after:spec results did not include the stats.skipped field for each run result. Fixes #27694. Addressed in #27695.
• Individual CDP errors that occur while capturing data for Test Replay will no longer prevent the entire run from being available. Addressed in #27709.
• Fixed an issue where the release date on the v13 landing page was a day behind. Fixed in #27711.
• Fixed an issue where fatal protocol errors would leak between specs causing all subsequent specs to fail to upload protocol information. Fixed in #27720
• Updated plist from 3.0.6 to 3.1.0 to address CVE-2022-37616 and CVE-2022-39353. Fixed in #27710.

13.0.0

Breaking Changes:

• The video configuration option now defaults to false. Addresses #26157.
• The videoCompression configuration option now defaults to false. Addresses #26160.
• The videoUploadOnPasses configuration option has been removed. Please see our screenshots & videos guide on how to accomplish similar functionality. Addresses #26899.
• Requests for assets at relative paths for component testing are now correctly forwarded to the dev server. Fixes #26725.
• The cy.readFile() command is now retry-able as a query command. This should not affect any tests using it; the functionality is unchanged. However, it can no longer be overwritten using Cypress.Commands.overwrite(). Addressed in #25595.
• The current spec path is now passed from the AUT iframe using a query parameter rather than a path segment. This allows for requests for assets at relative paths to be correctly forwarded to the dev server. Fixes #26725.
• The deprecated configuration option nodeVersion has been removed. Addresses #27016.
• The properties and values returned by the Module API and included in the arguments of handlers for the after:run and after:spec have been changed to be more consistent. Addresses #23805.
• For Cypress Cloud runs with Test Replay enabled, the Cypress Runner UI is now hidden during the run since the Runner will be visible during Test Replay. As such, if video is recorded (which is now defaulted to false) during the run, the Runner will not be visible. In addition, if a runner screenshot (cy.screenshot({ capture: runner })) is captured, it will no longer contain the Runner.
• The browser and browser page unexpectedly closing in the middle of a test run are now gracefully handled. Addressed in #27592.
• Automation performance is now improved by switching away from websockets to direct CDP calls for Chrome and Electron browsers. Addressed in #27592.
• Edge cases where cy.intercept() would not properly intercept have been addressed. Addressed in #27592.
• Node 14 support has been removed and Node 16 support has been deprecated. Node 16 may continue to work with Cypress v13, but will not be supported moving forward to closer coincide with Node 16's end-of-life schedule. It is recommended that users update to at least Node 18.
• The minimum supported Typescript version is 4.x.

Features:

• Consolidates and improves terminal output when uploading test artifacts to Cypress Cloud. Addressed in #27402

Bugfixes:

• Fixed an issue where Cypress's internal tsconfig would conflict with properties set in the user's tsconfig.json such as module and moduleResolution. Fixes #26308 and #27448.
• Clarified Svelte 4 works correctly with Component Testing and updated dependencies checks to reflect this. It was incorrectly flagged as not supported. Fixes #27465.
• Resolve the process/browser global inside @cypress/webpack-batteries-included-preprocessor to resolve to process/browser.js in order to explicitly provide the file extension. File resolution must include the extension for .mjs and .js files inside ESM packages in order to resolve correctly. Fixes#27599.
• Fixed an issue where the correct pnp process was not being discovered. Fixes #27562.
• Fixed incorrect type declarations for Cypress and Chai globals that asserted them to be local variables of the global scope rather than properties on the global object. Fixes #27539. Fixed in #27540.
• Dev Servers will now respect and use the port configuration option if present. Fixes #27675.

Dependency Updates:

• Upgraded @cypress/request from ^2.88.11 to ^3.0.0 to address the CVE-2023-28155 security vulnerability. Addresses #27535. Addressed in #27495.

12.17.4

Bugfixes:

• Fixed an issue where having cypress.config in a nested directory would cause problems with locating the component-index.html file when using component testing. Fixes #26400.

Dependency Updates:

• Upgraded webpack from v4 to v5. This means that we are now bundling your e2e tests with webpack 5. We don't anticipate this causing any noticeable changes. However, if you'd like to keep bundling your e2e tests with webpack 4 you can use the same process as before by pinning @cypress/webpack-batteries-included-preprocessor to v2.x.x and hooking into the file:preprocessor plugin event. This will restore the previous bundling process. Additionally, if you're using @cypress/webpack-batteries-included-preprocessor already, a new version has been published to support webpack v5.
• Upgraded tough-cookie from 4.0 to 4.1.3, @cypress/request from 2.88.11 to 2.88.12 and @cypress/request-promise from 4.2.6 to 4.2.7 to address a security vulnerability. Fixes #27261.

12.17.3

Bugfixes:

• Fixed an issue where unexpected branch names were being recorded for cypress runs when executed by GitHub Actions. The HEAD branch name will now be recorded by default for pull request workflows if a branch name cannot otherwise be detected from user overrides or from local git data. Fixes #27389.

Performance:

• Fixed an issue where unnecessary requests were being paused. No longer sends X-Cypress-Is-XHR-Or-Fetch header and infers resource type off of the server pre-request object. Fixes #26620 and #26622.

12.17.2

Bugfixes:

• Fixed an issue where commands would fail with the error must only be invoked from the spec file or support file if their arguments were mutated. Fixes #27200.
• Fixed an issue where cy.writeFile() would erroneously fail with the error cy.writeFile() must only be invoked from the spec file or support file. Fixes #27097.
• Fixed an issue where web workers could not be created within a spec. Fixes #27298.

12.17.1

Bugfixes:

• Fixed invalid stored preference when enabling in-app notifications that could cause the application to crash. Fixes #27228.
• Fixed an issue with the Typescript types of cy.screenshot(). Fixed in #27130.

Dependency Updates:

• Upgraded @cypress/request from 2.88.10 to 2.88.11 to address CVE-2022-24999 security vulnerability. Addressed in #27005.

12.17.0

Features:

• Cypress Cloud users can now receive desktop notifications about their runs, including when one starts, finishes, or fails. Addresses #26686.

Bugfixes:

• Fixed issues where commands would fail with the error must only be invoked from the spec file or support file. Fixes #27149 and #27163.
• Fixed a regression introduced in Cypress 12.12.0 where Cypress may fail to reconnect to the Chrome DevTools Protocol in Electron. Fixes #26900.
• Fixed an issue where chrome was not recovering from browser crashes properly. Fixes #24650.
• Fixed a race condition that was causing a GraphQL error to appear on the Debug page when viewing a running Cypress Cloud build. Fixed in #27134.
• Fixed a race condition in electron where the test window exiting prematurely during the browser launch process was causing the whole test run to fail. Addressed in #27167.
• Fixed minor issues with Typescript types in the CLI. Fixes #24110.
• Fixed an issue where a value for the Electron debug port would not be respected if defined using the ELECTRON_EXTRA_LAUNCH_ARGS environment variable. Fixes #26711.

Dependency Updates:

• Update dependency semver to ^7.5.3. Addressed in #27151.

12.16.0

Features:

• Added support for Angular 16.1.0 in Cypress Component Testing. Addresses #27049.

Bugfixes:

• Fixed an issue where certain commands would fail with the error must only be invoked from the spec file or support file when invoked with a large argument. Fixes #27099.

12.15.0

Features:

• Added support for running Cypress tests with Chrome's new --headless=new flag. Chrome versions 112 and above will now be run in the headless mode that matches the headed browser implementation. Addresses #25972.
• Cypress can now test pages with targeted Content-Security-Policy and Content-Security-Policy-Report-Only header directives by specifying the allow list via the experimentalCspAllowList configuration option. Addresses #1030. Addressed in #26483
• The videoCompression configuration option now accepts both a boolean or a Constant Rate Factor (CRF) number between 1 and 51. The videoCompression default value is still 32 CRF and when videoCompression is set to true the default of 32 CRF will be used. Addresses #26658.
• The Cypress Cloud data shown on the Specs page and Runs page will now reflect Cloud Runs that match the current Git tree if Git is being used. Addresses #26693.

Bugfixes:

• Fixed an issue where video output was not being logged to the console when videoCompression was turned off. Videos will now log to the terminal regardless of the compression value. Addresses #25945.

Dependency Updates:

• Removed @cypress/mocha-teamcity-reporter as this package was no longer being referenced. Addressed in #26938.

12.14.0

Features:

• A new testing type switcher has been added to the Spec Explorer to make it easier to move between E2E and Component Testing. An informational overview of each type is displayed if it hasn't already been configured to help educate and onboard new users to each testing type. Addresses #26448, #26836 and #26837.

Bugfixes:

• Fixed an issue to now correctly detect Angular 16 dependencies (@angular/cli, @angular-devkit/build-angular, @angular/core, @angular/common, @angular/platform-browser-dynamic) during Component Testing onboarding. Addresses #26852.
• Ensures Git-related messages on the Runs page remain dismissed. Addresses #26808.

Dependency Updates:

• Upgraded find-process from 1.4.1 to 1.4.7 to address this Snyk security vulnerability. Addressed in #26906.
• Upgraded firefox-profile from 4.0.0 to 4.3.2 to address security vulnerabilities within sub-dependencies. Addressed in #26912.

12.13.0

Features:

• Adds Git-related messages for the Runs page and Debug page when users aren't using Git or there are no recorded runs for the current branch. Addresses #26680.

Bugfixes:

• Reverted #26452 which introduced a bug that prevents users from using End to End with Yarn 3. Fixed in #26735. Fixes #26676.
• Moved types condition to the front of package.json#exports since keys there are meant to be order-sensitive. Fixed in #26630.
• Fixed an issue where newly-installed dependencies would not be detected during Component Testing setup. Addresses #26685.
• Fixed a UI regression that was flashing an "empty" state inappropriately when loading the Debug page. Fixed in #26761.
• Fixed an issue in Component Testing setup where TypeScript version 5 was not properly detected. Fixes #26204.

Misc:

• Updated styling & content of Cypress Cloud slideshows when not logged in or no runs have been recorded. Addresses #26181.
• Changed the nomenclature of 'processing' to 'compressing' when terminal video output is printed during a run. Addresses #26657.
• Changed the nomenclature of 'Upload Results' to 'Uploading Screenshots & Videos' when terminal output is printed during a run. Addresses #26759.

12.12.0

Features:

• Added a new informational banner to help get started with component testing from an existing end-to-end test suite. Addresses #26511.

Bugfixes:

• Fixed an issue in Electron where devtools gets out of sync with the DOM occasionally. Addresses #15932.
• Updated the Chromium renderer process crash message to be more terse. Addressed in #26597.
• Fixed an issue with CYPRESS_DOWNLOAD_PATH_TEMPLATE regex to allow multiple replacements. Addresses #23670.
• Moved types condition to the front of package.json#exports since keys there are meant to be order-sensitive. Fixed in #26630.

Dependency Updates:

• Upgraded plist from 3.0.5 to 3.0.6 to address CVE-2022-26260 NVD security vulnerability. Addressed in #26631.
• Upgraded engine.io from 6.2.1 to 6.4.2 to address CVE-2023-31125 NVD security vulnerability. Addressed in #26664.
• Upgraded @vue/test-utils from 2.0.2 to 2.3.2. Addresses #26575.

12.11.0

Features:

• Adds Component Testing support for Angular 16. Addresses #26044.
• The run navigation component on the Debug page will now display a warning message if there are more relevant runs than can be displayed in the list. Addresses #26288.

Bugfixes:

• Fixed an issue where setting videoCompression to 0 would cause the video output to be broken. 0 is now treated as false. Addresses #5191 and #24595.
• Fixed an issue on the Debug page where the passing run status would appear even if the Cypress Cloud organization was over its monthly test result limit. Addresses #26528.

Misc:

• Cleaned up our open telemetry dependencies, reducing the size of the open telemetry modules. Addressed in #26522.

Dependency Updates:

• Upgraded vue from 3.2.31 to 3.2.47. Addressed in #26555.

12.10.0

Features:

• The Component Testing setup wizard will now show a warning message if an issue is encountered with an installed third party framework definition. Addresses #25838.

Bugfixes:

• Capture the Azure CI provider's environment variable SYSTEM_PULLREQUEST_PULLREQUESTNUMBER to display the linked PR number in the Cloud. Addressed in #26215.
• Fixed an issue in the onboarding wizard where project framework & bundler would not be auto-detected when opening directly into component testing mode using the --component CLI flag. Fixes #22777 and #26388.
• Updated to use the SEMAPHORE_GIT_WORKING_BRANCH Semaphore CI environment variable to correctly associate a Cloud run to the current branch. Previously this was incorrectly associating a run to the target branch. Fixes #26309.
• Fix an edge case in Component Testing where a custom baseUrl in tsconfig.json for Next.js 13.2.0+ is not respected. This was partially fixed in #26005, but an edge case was missed. Fixes #25951.
• Fixed an issue where click events fired on .type('{enter}') did not propagate through shadow roots. Fixes #26392.

Misc:

• Removed unintentional debug logs. Addressed in #26411.
• Improved styling on the Runs Page. Addresses #26180.

Dependency Updates:

• Upgraded commander from ^5.1.0 to ^6.2.1. Addressed in #26226.
• Upgraded minimist from 1.2.6 to 1.2.8 to address this CVE-2021-44906 NVD security vulnerability. Addressed in #26254.

12.9.0

Features:

• The Debug page now allows for navigating between all runs recorded for a commit. Addresses #25899 and #26018.

Bugfixes:

• Fixed a compatibility issue so that component test projects can use Vite version 4.2.0 and greater. Fixes #26138.
• Fixed an issue where cy.intercept() added an additional content-length header to spied requests that did not set a content-length header on the original request. Fixes #24407.
• Changed the way that Git hashes are loaded so that non-relevant runs are excluded from the Debug page. Fixes #26058.
• Corrected the .type() command to account for shadow root elements when determining whether or not focus needs to be simulated before typing. Fixes #26198.
• Fixed an issue where an incorrect working directory could be used for Git operations on Windows. Fixes #23317.
• Capture the Buildkite CI provider's environment variable BUILDKITE_RETRY_COUNT to handle CI retries in the Cloud. Addressed in #25750.

Misc:

• Made some minor styling updates to the Debug page. Addresses #26041.

12.8.1

Bugfixes:

• Fixed a regression in Cypress 10 where the reporter auto-scroll configuration inside user preferences was unintentionally being toggled off. User's must now explicitly enable/disable auto-scroll under user preferences, which is enabled by default. Fixes #24171 and #26113.

Dependency Updates:

• Upgraded ejs from 3.1.6 to 3.1.8 to address this CVE-2022-29078 NVD security vulnerability. Addressed in #25279.

12.8.0

Features:

• The Debug page is now able to show real-time results from in-progress runs. Addresses #25759.
• Added the ability to control whether a request is logged to the command log via cy.intercept() by passing log: false or log: true. Addresses #7362.
  • This can be used to override Cypress's default behavior of logging all XHRs and fetches, see the example.
• It is now possible to control the number of connection attempts to the browser using the CYPRESS_CONNECT_RETRY_THRESHOLD Environment Variable. Learn more here. Addressed in #25848.

Bugfixes:

• Fixed an issue where using Cypress.require() would throw the error Cannot find module 'typescript'. Fixes #25885.
• The before:spec API was updated to correctly support async event handlers in run mode. Fixes #24403.
• Updated the Component Testing community framework definition detection logic to take into account monorepo structures that hoist dependencies. Fixes #25993.
• The onboarding wizard for Component Testing will now detect installed dependencies more reliably. Fixes #25782.
• Fixed an issue where Angular components would sometimes be mounted in unexpected DOM locations in component tests. Fixes #25956.
• Fixed an issue where Cypress component testing would fail to work with Next.js 13.2.1. Fixes #25951.
• Fixed an issue where migrating a project from a version of Cypress earlier than 10.0.0 could fail if the project's testFiles configuration was an array of globs. Fixes #25947.

Misc:

• Removed "New" badge in the navigation bar for the debug page icon. Addresses #25925.
• Removed inline "Connect" buttons within the Specs Explorer. Addresses #25926.
• Added an icon for "beta" versions of the Chrome browser. Addresses #25968.

Dependency Updates:

• Upgraded mocha-junit-reporter from 2.1.0 to 2.2.0 to be able to use new placeholders such as [suiteFilename] or [suiteName] when defining the test report name. Addressed in #25922.

12.7.0

Features:

• It is now possible to set hostOnly cookies with cy.setCookie() for a given domain. Addresses #16856 and #17527.
• Added a Public API for third party component libraries to define a Framework Definition, embedding their library into the Cypress onboarding workflow. Learn more here. Implemented in #25780 and closes #25638.
• Added a Debug Page tutorial slideshow for projects that are not connected to Cypress Cloud. Addresses #25768.
• Improved various error message around interactions with the Cypress cloud. Implemented in #25837
• Updated the "new" status badge for the Debug page navigation link to be less noticeable when the navigation is collapsed. Addresses #25739.

Bugfixes:

• Fixed various bugs when recording to the cloud. Fixed in #25837
• Fixed an issue where cookies were being duplicated with the same hostname, but a prepended dot. Fixed an issue where cookies may not be expiring correctly. Fixes #25174, #25205 and #25495.
• Fixed an issue where cookies weren't being synced when the application was stable. Fixed in #25855. Fixes #25835.
• Added missing TypeScript type definitions for the cy.reload() command. Addressed in #25779.
• Ensure Angular components are mounted inside the correct element. Fixes #24385.
• Fix a bug where files outside the project root in a monorepo are not correctly served when using Vite. Addressed in #25801.
• Fixed an issue where using cy.intercept's req.continue() with a non-function parameter would not provide an appropriate error message. Fixed in #25884.
• Fixed an issue where Cypress would erroneously launch and connect to multiple browser instances. Fixes #24377.

Misc:

• Made updates to the way that the Debug Page header displays information. Addresses #25796 and #25798.

12.6.0

Features:

• Added a new CLI flag, called --auto-cancel-after-failures, that overrides the project-level "Auto Cancellation" value when recording to the Cloud. This gives Cloud users on Business and Enterprise plans the flexibility to alter the auto-cancellation value per run. Addressed in #25237.
• It is now possible to overwrite query commands using Cypress.Commands.overwriteQuery. Addressed in #25078.
• Added Cypress.require() for including dependencies within the cy.origin() callback. This change removed support for using require() and import() directly within the callback because we found that it impacted performance not only for spec files using them within the cy.origin() callback, but even for spec files that did not use them. Addresses #24976.
• Added the ability to open the failing test in the IDE from the Debug page before needing to re-run the test. Addressed in #24850.

Bugfixes:

• When a Cloud user is apart of multiple Cloud organizations, the Connect to Cloud setup now shows the correct organizational prompts when connecting a new project. Fixes #25520.
• Fixed an issue where Cypress would fail to load any specs if the project specPattern included a resource that could not be accessed due to filesystem permissions. Fixes #24109.
• Fixed an issue where the Debug page would display a different number of specs for in-progress runs than the in-progress specs reported in Cypress Cloud. Fixes #25647.
• Fixed an issue in middleware where error-handling code could itself generate an error and fail to report the original issue. Fixes #22825.
• Fixed an regression introduced in Cypress 12.3.0 where custom browsers that relied on process environment variables were not found on macOS arm64 architectures. Fixed in #25753.

Misc:

• Improved the UI of the Debug page. Addresses #25664, #25669, #25665, #25666, and #25667.
• Updated the Debug page sidebar badge to to show 0 to 99+ failing tests, increased from showing 0 to 9+ failing tests, to provide better test failure insights. Addresses #25662.

Dependency Updates:

• Upgrade debug to 4.3.4. Addressed in #25699.

12.5.1

Bugfixes:

• Fixed a regression introduced in Cypress 12.5.0 where the runnable was not included in the test:after:run event. Fixes #25663.

Dependency Updates:

• Upgraded simple-git from 3.15.0 to 3.16.0 to address this security vulnerability where Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods due to improper input sanitization was possible. Addressed in #25603.

12.5.0

Features:

• Easily debug failed CI test runs recorded to the Cypress Cloud from your local Cypress app with the new Debug page. Please leave any feedback here. Your feedback will help us make decisions to improve the Debug experience. For more details, see our blog post. Addressed in #25488.

Performance:

• Improved memory consumption in run mode by removing reporter logs for successful tests. Fixes #25230.

Bugfixes:

• Fixed an issue where alternative Microsoft Edge Beta, Canary, and Dev binary versions were not being discovered by Cypress. Fixes #25455.

Dependency Updates:

• Upgraded underscore.string from 3.3.5 to 3.3.6 to reference rebuilt assets after security patch to fix regular expression DDOS exploit. Addressed in #25574.

12.4.1

Bugfixes:

• Fixed a regression from Cypress 12.4.0 where Cypress was not exiting properly when running multiple Component Testing specs in electron in run mode. Fixes #25568.

Dependency Updates:

• Upgraded ua-parser-js from 0.7.24 to 0.7.33 to address this security vulnerability where crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition. Addressed in #25561.

12.4.0

Features:

• Added official support for Vite 4 in component testing. Addresses #24969.
• Added new experimentalMemoryManagement configuration option to improve memory management in Chromium-based browsers. Enable this option with experimentalMemoryManagement=true if you have experienced "Out of Memory" issues. Addresses #23391.
• Added new experimentalSkipDomainInjection configuration option to disable Cypress from setting document.domain on injection, allowing users to test Salesforce domains. If you believe you are having document.domain issues, please see the experimentalSkipDomainInjection guide. This config option is end-to-end only. Addresses #2367, #23958, #24290, and #24418.
• The .as command now accepts an options argument, allowing an alias to be stored as type "query" or "static" value. This is stored as "query" by default. Addresses #25173.
• The cy.log() command will now display a line break where the \n character is used. Addresses #24964.
• component.specPattern now utilizes a JSX/TSX file extension when generating a new empty spec file if project contains at least one file with those extensions. This applies only to component testing and is skipped if component.specPattern has been configured to exclude files with those extensions. Addresses #24495.
• Added support for the data-qa selector in the Selector Playground in addition to data-cy, data-test and data-testid. Addresses #25305.

Bugfixes:

• Fixed an issue where component tests could incorrectly treat new major versions of certain dependencies as supported. Fixes #25379.
• Fixed an issue where new lines or spaces on new lines in the Command Log were not maintained. Fixes #23679 and #24964.
• Fixed an issue where Angular component testing projects would fail to initialize if an unsupported browserslist entry was specified in the project configuration. Fixes #25312.

Misc

• Video output link in cypress run mode has been added to it's own line to make the video output link more easily clickable in the terminal. Addresses #23913.