Cypress

Performance:

• Fixed an issue where visibility checks (such as .should('be.visible') and actionability) serialized an element's entire text subtree once per overflow-hidden ancestor, which on text-heavy pages could exhaust the renderer's memory and crash it (We detected that the Chrome Renderer process just crashed). Fixes #34329.
• Reduced the sampling overhead of experimentalMemoryManagement when Cypress runs inside a memory-limited container using cgroup v1. Memory readings no longer spawn helper subprocesses on every sampling interval, which lowers CPU usage that previously competed with the tests, most noticeably on constrained CI machines. Addresses #34105. Fixed in #34331.

Features:

• scrollBehavior now accepts a per-axis value, such as { block: 'start', inline: 'nearest' }, so the vertical and horizontal alignment used to scroll an element into view before an action command can be set independently. The per-axis form takes the same values as the native scrollIntoView: 'start', 'end', 'center', and 'nearest'. Addresses #34460.
• cy.request() and cy.intercept() now accept the HTTP QUERY method. Previously it was rejected as an invalid method in the browser. Fixes #28282.

Bugfixes:

• Fixed a regression in 15.18.1 where action commands scrolled an already-visible element's container horizontally. The scrollBehavior values 'top' and 'bottom' revert to aligning only the vertical axis; use 'start' or 'end' to align both. Fixes #34460.
• Fixed a regression in 15.19.0 where commands that read from the application under test, such as cy.url(), cy.title() and cy.reload(), targeted the command log instead of your application when the application set window.name. Fixes #34435.
• Fixed an issue where a cy.* command error message that interpolated a value containing a $ character could render incorrectly, with a leaked {{...}} placeholder or duplicated or dropped surrounding text. Such values are now inserted verbatim. Fixed in #34221.
• Fixed an issue where a Cypress error message that interpolated a value containing a $ sequence (such as $&, $`, $', or $$) could render with corrupted or duplicated text. Such values are now shown verbatim. Fixed in #34220.
• Fixed an issue where cy.intercept() matching on the auth option compared only the portion of a Basic authentication password before the first colon, so a request whose password contained a colon (permitted by RFC 7617) failed to match. The full password is now compared. Fixed in #34206.
• Fixed an issue where cy.intercept() routes specifying a numeric port (for example port: 8080 or port: [8080]) did not match requests on non-default ports. Such routes now match as documented. Fixes #17653. Fixed in #34205.
• Fixed an issue where inline source maps embedded without a charset (for example those emitted by esbuild) were not decoded and were silently dropped. These inline source maps are now decoded. Fixed in #34204.
• Fixed an issue where the TypeScript 7 support added in 15.18.0 did not work: TypeScript spec and support files failed to compile with Error: Cannot find module '@babel/preset-typescript'. Fixes #34359.
• Fixed an issue where a cy.origin() block could intermittently fail with TypeError: Cannot read properties of undefined (reading 'applied'), incorrectly reported as originating from your test code. Addressed in #34376.
• Fixed an issue where, during a cy.origin() block, session cookies set on the primary origin by the first page visited in a test were not included in the identity provider's callback request back to the primary origin (for example, POST /auth/callback in an OAuth Authorization Code flow). Fixes #29719. Fixed in #34287.
• Fixed an issue where the configuration validation error shown when passesRequired is omitted from the experimental detect-flake-and-pass-on-threshold retry strategy reported the value of an unrelated option instead of the passesRequired value. Fixed in #34202.
• Fixed an issue where the configuration validation error for an absolute ca filepath in clientCertificates referenced the wrong certificate. Fixed in #34201.
• Fixed an issue where HTTP 3xx responses (such as 304 Not Modified) were shown with a failed (red) indicator in the Command Log. These responses now display as successful. Fixes #34066. Fixed in #34282.

Misc:

• Fixed an issue where passing the options argument to cy.env(), such as cy.env(['FOO'], { log: false }), raised a TypeScript error (Expected 1 arguments, but got 2). Fixes #34284.

Dependency Updates:

• Upgraded tar from 6.2.1 to 7.5.21 to address CVE-2026-59873 reported in security scans. Addresses #34333. Addressed in #34335.
• Upgraded arch from 2.2.0 to 3.0.0. Addressed in #34426.
• Removed tslib (previously 1.14.1) from the cypress package's runtime dependencies. Addressed in #34372.
• Upgraded ws from 8.18.3 to 8.21.1. Addressed in #34392.

Performance:

• Fixed an issue where the browser's renderer process could crash (We detected that the Chrome Renderer process just crashed) when the application under test triggered a ResizeObserver loop while the command log was visible. Fixes #33962 and #34218.
• Fixed a regression in 14.0.0 where each message sent from the Cypress server to a Chromium-based browser (including Electron) leaked a small amount of browser memory until the end of the spec. During long, command- or network-heavy specs, this buildup could crash the browser (We detected that the Chrome Renderer process just crashed). Fixes #34226.
• Fixed an issue where each cy.press() call in Chromium-based browsers retained a small amount of renderer memory for the remainder of the spec file, which could contribute to memory growth in specs with many cy.press() calls. Addressed in #34240.

Features:

• Added support for TypeScript 7 when preprocessing TypeScript spec and support files. The component testing setup wizard now accepts TypeScript 7 as well. Addresses #34258. Addressed in #34277.
• Added support for additional assertion aliases: .exists (alias of .exist), .greaterThanOrEqual and .lessThanOrEqual (aliases of .least and .most), and .oneOf chained with .contain (for example expect('Today is sunny').to.contain.oneOf(['sunny', 'cloudy'])). These can be used anywhere Cypress assertions are written, such as expect, assert, and cy.get(...).should(...). This comes from upgrading the bundled chai assertion library from 4.2.0 to 4.5.0; all existing assertions and their messages behave the same. Addressed in #34178.

Bugfixes:

• Fixed an issue where chaining an assertion after .should('exist') on a raw DOM element (rather than a jQuery object) failed with expected null to exist, because the existence assertion replaced the subject with null. Chaining further assertions off .exist (or its .exists alias) for a raw DOM element now works as expected. Fixes #25491.
• Fixed an issue where, on Windows, enhancing a test failure stack could throw a secondary TypeError: Cannot read properties of undefined (reading 'replaceAll') and mask the original error. Fixed in #34252.
• Fixed an issue where experimentalMemoryManagement could fail to prevent the browser from running out of memory and crashing when Cypress was running inside a memory-limited container. Memory is now managed correctly in these environments. Fixes #34104. Addressed in #34123.

Misc:

• Corrected the @default value in the TypeScript type definitions for the videoCompression configuration option from 32 to false. Addressed in #34198.

Performance:

• Verifying that the Cypress binary can run, which happens the first time a newly installed version is used (before cypress open or cypress run) and whenever cypress verify is invoked, now completes more quickly. Addressed in #34133.

Bugfixes:

• Fixed an issue where Cypress could hang until the spec timed out if the browser process crashed mid-run (for example, an out-of-memory or GPU crash) while video recording was disabled. The current spec now fails and the run continues to the next spec as expected. Fixed in #34126.
• Fixed an issue where asserting focus with Chai's property syntax, such as expect($el).to.have.focus or expect($el).to.be.focused, raised a TypeScript error (Property 'focus' does not exist on type 'Assertion') even though the assertion works at runtime. Fixes #23905. Fixed in #34177.
• Fixed an issue where cy.type() fired the simulated keyup event in the same turn as keydown and input, so keyup handlers that read state updated asynchronously in an input listener could observe stale values. keyup is now deferred to the next microtask, matching real browser event ordering. Fixes #14864. Fixed in #34068.
• Fixed an issue where headless WebKit used the host machine's devicePixelRatio instead of a standard value of 1. Headless WebKit now matches headless Chrome, so screenshots taken during cypress run are consistent regardless of the host's DPI (for example 2x locally versus 1x in CI) and text is no longer fuzzy on high-DPI displays. Applies when experimentalWebKitSupport is enabled. Fixes #23808. Fixed in #34088.
• Fixed an issue where the userAgent configuration option was not applied when running tests in the experimental WebKit browser. Fixes #33349.
• Fixed an issue where, in the experimental WebKit browser, a request to focus the browser window was silently ignored, so the window could remain in the background. The active page is now correctly brought to the front. Addressed in #34137.
• Fixed an issue where opening an unconfigured project from a git repository sub-directory (such as a monorepo package) skipped project setup. Additionally, the component testing setup wizard now reliably displays the auto-detected framework and bundler. Fixes #27410 and #29544. Fixed in #34129 and #34212.
• Fixed an issue where interacting with an element inside a horizontally-scrollable container could scroll the element to the container's right edge, placing it underneath a right-floating position: sticky or position: fixed element and causing the action to fail or land on the wrong element. Elements are now scrolled to their top, leftmost point as documented. Fixes #33884. Fixed in #34108.
• Fixed a regression in 15.17.0 where cypress run --spec printed a spurious The following --spec pattern did not match any spec files and will be ignored warning for patterns that actually did match spec files, such as patterns using regex-style alternation groups (for example cypress/e2e/(a|b)/*.js). Fixes #34160.

Dependency Updates:

• Upgraded esbuild from 0.28.0 to 0.28.1 to address a Resources Downloaded over Insecure Protocol vulnerability reported in security scans. Addressed in #34211.

Performance:

• Fixed an issue where an application that repeatedly threw the same uncaught exception (for example, a benign ResizeObserver loop ... notification fired on every animation frame) could exhaust renderer memory and crash the browser. Consecutive identical uncaught exceptions within a test now collapse into a single, updating command-log entry, and a handled (suppressed) uncaught exception no longer captures a DOM snapshot. Addresses #27415.

Features:

• Added a removeSRIAttributes configuration option. When enabled, Cypress strips the integrity attribute from <script> and <link> elements on first-party resources so they are not blocked by Subresource Integrity (SRI) enforcement after Cypress rewrites them. This covers integrity set via static HTML, a JavaScript string literal, and runtime DOM assignment (including the webpack-subresource-integrity pattern used for lazily-loaded chunks). Addresses #34124 and #18315.

Bugfixes:

• Fixed an issue where calling req.destroy() or using { forceNetworkError: true } inside a cy.intercept() handler in experimental WebKit caused infinite request loops. Fixes #23810. Fixed in #33948.
• Fixed an issue where the before:spec plugin event fired twice for the same spec when a test navigated to a cross-origin URL via cy.visit(). Affects cypress run and cypress open with experimentalInteractiveRunEvents enabled. The event now fires exactly once per spec run, regardless of how many times the runner page reloads internally during cross-origin navigation. Fixes #26300.
• Fixed an issue where setting numTestsKeptInMemory to a value greater than 0 from setupNodeEvents would take effect during cypress run, which could prevent snapshots from being captured correctly when recording Test Replay to Cypress Cloud. During cypress run, numTestsKeptInMemory is now always treated as 0 regardless of how it is configured. Fixes #31167.
• Fixed an issue where, when Cypress was installed in a read-only location, running tests in Firefox or Chrome could log a cannot delete profileDir on exit error (EACCES/EPERM) and leave the browser profile directory behind, requiring manual cleanup before the next run. Cypress now removes the profile directory on exit as expected. Fixes #31300.
• Fixed an issue where the resolved remote origin (for example, Cypress.config('remote').origin) could include an explicit default port (:80 for HTTP or :443 for HTTPS) or embedded credentials when the visited URL contained them, which did not match the origin reported by the browser. The reported origin now always matches the browser's location.origin, omitting default ports and any embedded credentials. Fixes #28369. Fixed in #34050.
• Fixed an issue where cy.screenshot() could still capture changing pixels from some running web animations. Fixes #29144.
• Fixed an issue where, during cypress run with experimentalSingleTabRunMode and the experimental WebKit browser, component test runs with video recording enabled would only record the first spec's video and could then hang without exiting. Each spec is now recorded to its own video and the run exits normally. Fixes #23815.
• Fixed an issue where running component tests with the experimentalSingleTabRunMode experiment enabled could cause a spec to fail intermittently after many other specs had run in the same browser tab, even though that spec passed when run on its own. Fixes #24146.
• Fixed an issue where passing a cy.fixture() alias to cy.selectFile() attached the file without its name in a second or later test that loaded the same fixture (for example, when the same fixture is reused across multiple tests), causing servers to reject the upload as a missing file. The file name is now preserved every time the fixture is used. Fixes #21936.
• Fixed a regression in 15.17.0 where loading the Cypress configuration could fail with TransformError: Internal error: Expected id N but got id M when the project has the same esbuild version installed that Cypress bundles internally (currently 0.28.0) and a dependency loaded during config processing registers its own tsx loader. The tsx loader Cypress uses to load the configuration file is now removed from NODE_OPTIONS before the configuration file is sourced, so it no longer executes inside worker threads spawned by the project's own dependencies. Fixes #34076.
• Fixed an issue where cy.request() in Firefox did not send Secure cookies to localhost or loopback addresses such as 127.0.0.1 over http, even though browsers treat those origins as secure contexts. A Secure cookie set over https on such a host is now included on subsequent http requests to that host in Firefox, matching the browser's own behavior and how Cypress already behaves in Chrome. Fixes #24332.
• Fixed an issue where a transient failure to bind Cypress's internal file server to an available port (for example, an intermittent EADDRINUSE under port pressure on a reused CI machine) could crash the run with an uncaught exception before any tests started. Cypress now retries on a fresh port and, if it still cannot bind, fails with a clear error instead of crashing. Fixes #34109.
• Fixed a regression in 15.17.0 where visiting a URL with an IPv6 literal host, such as cy.visit('http://[::1]:3000'), crashed the proxy with an Internal error while proxying ... option domain is invalid error. Cypress no longer sets a Domain attribute on its internal cookies for IPv6 hosts, so such URLs work as expected. Fixes #34143. Fixed in #34146.

Misc:

• Running cypress install when Cypress is installed globally no longer prints a warning recommending that Cypress be installed as a per-project devDependency. Addresses #34134.
• Running Cypress with process profiler debug logs enabled (for example DEBUG=cypress*process_profiler) no longer intermittently prints an Expected DataContext to already have been set via setCtx error to the logs. Addresses #30670.
• Cypress now shows a clear error explaining that browsers must be an array and that a specific browser should be selected with --browser when a CYPRESS_BROWSERS environment variable is set to a plain string (for example CYPRESS_BROWSERS=chrome) instead of showing an opaque TypeError: a.map is not a function error. Addresses #33198.

Dependency Updates:

• Upgraded webdriver from 9.14.0 to 9.28.0, geckodriver from 5.0.0 to 6.1.0, and edgedriver from 6.1.1 to 6.3.0. These packages are used to launch and automate Firefox during cypress run and cypress open. Addresses #34072.
• Upgraded undici from 6.26.0 to 6.27.0 to address a CRLF Injection vulnerability reported in security scans. Addressed in #34121.

Performance:

• The Command Log no longer becomes progressively unresponsive when moving the mouse in and out of a test's command list during long tests. Hovering over the command area previously triggered a style recalculation across the entire list of commands, causing a delay that grew with the number of commands logged. Fixes #33179.
• Fixed a memory leak where runs with screenshotOnRunFailure enabled slowed down progressively, as each failure screenshot was retained in memory for the rest of the run. Fixes #33516.

Features:

• Added Bun as a recognized package manager. The cypress npm package can now be installed and invoked with Bun (for example bun run cypress open or bun run cypress run). Addresses #28962. Addressed in #32580.
• Cypress.expose() values can now be overridden per suite or test via test config overrides (for example, describe(), context(), it(), or test()) using { expose: { key: value } }. Suite- and test-level overrides are merged, with test-level keys taking precedence; override keys are applied at test start and restored after each test without affecting unrelated values set in hooks. Addresses #33356. Addressed in #33925.
• When signing up to Cypress Cloud from the Cypress desktop app, if a project is auto-provisioned during signup, Cypress now automatically writes the projectId to the cypress.config file. If the file cannot be written, a modal is shown with the project ID as a copyable snippet and a link to open the config file directly in your IDE. Addressed in #33976.
• Improved CI environment detection and commit metadata capture for Cypress Cloud recorded runs within Argo CD and Argo Workflows. Addressed in #33932.

Bugfixes:

• Video recording no longer silently fails on Firefox 93+, where it previously produced no video and ended with a We failed processing this video or operation timed out warning. Fixes #18415. Fixed in #33960.
• Fixed an issue where, in the Electron browser, navigating away from a page whose beforeunload handler requested a confirmation prompt (for example window.onbeforeunload = () => 'message' or a beforeunload listener that sets event.returnValue) would hang and eventually fail the command with a page load timeout. Such navigations — including cy.visit(), cy.reload(), and clicking links — now proceed automatically without the confirmation prompt blocking the test, matching the behavior in Chrome. Fixes #2118.
• Fixed an issue where config.isInteractive was always true in the config passed to the plugins / setupNodeEvents function, even during cypress run. The value is now correctly false in run mode and true in open mode, so plugins can reliably distinguish between the two. Fixes #20789.
• Fixed an issue where component tests, and end-to-end tests using a local baseUrl, could fail to start with Cypress could not verify that this server is running when an HTTP_PROXY environment variable was set. Local hosts excluded from the proxy via NO_PROXY (such as localhost, 127.0.0.1, and ::1, which includes the component testing dev server) are now verified with a direct connection instead of being routed through the proxy. Fixes #27990.
• Fixed an issue where cy.wait('@alias') could time out when the connection to the browser closed before an aliased intercepted request's response completed, including during navigation such as cy.visit(). Fixes #19326.
• Fixed an issue where cy.request() with a FormData body failed to upload when a Content-Type header was provided with non-lowercase casing (for example 'Content-Type': 'multipart/form-data'). Cypress now correctly replaces the user-provided header with the generated multipart/form-data boundary instead of sending two conflicting content-type headers, which previously caused the server to reject the request with a 400 or empty body. Fixes #21173.
• Fixed an issue where Cypress could load the config file through the wrong module system (for example, treating an ESM config as CommonJS), so ESM-only APIs such as import.meta.resolve were unavailable in config and plugin code. Cypress now picks ESM or CJS before loading, using Node.js rules from the config file extension and the nearest package.json "type", then loads only via import() or require() and fails outright on error instead of retrying the other format:
  • .mjs and .mts always load as ESM
  • .cjs and .cts always load as CJS
  • .js and .ts load as ESM when the nearest package.json has "type": "module"; CJS is loaded otherwise Fixes #33801. Addresses #33892.
• Fixed an issue where a recorded Chrome or Electron run could hang for the duration of the spec timeout when the renderer crashed mid-spec, instead of failing the affected spec and continuing. Fixed in #33943.
• Fixed an issue where tests in Chrome and Electron could fail when the application made cross-origin requests to local or private network addresses (for example, a login or OAuth flow that redirects between local development hosts). Chrome 141 began enforcing Local Network Access checks that gate such requests behind a permission prompt the automated browser cannot answer. Cypress now opts out of these checks so these requests succeed as they did in Chrome 140. Fixes #32708.
• Fixed an issue where, after a same-origin fetch or XHR request updated a cookie, a subsequent page navigation or reload could send the previous (stale) cookie value to the server instead of the updated one. Fixes #25841.
• Fixed an issue where a cross-origin navigation back to a previously-visited origin (for example, completing a login that redirects from an identity provider back to your application) could intermittently load the Cypress app interface instead of your application, causing flaky tests. Fixed in #33991.
• Fixed an issue where a cy.origin() test could intermittently fail with The command was expected to run against origin <x> but the application is at origin <y> when a navigation (such as a login redirect) ran on the primary origin shortly after the runner switched super-domains. A stale internal __cypress.unload cookie could cause the proxy to redirect the navigation back to the Cypress runner instead of serving it; the cookie is now cleared whenever the application document is (re)served. Fixed in #34020.
• Fixed an issue where setting a request or response header to an empty string in a cy.intercept() handler (for example req.headers['x-foo'] = '') would report the header as set on the intercepted request while silently dropping it from the request sent over the network. Empty-string header values are now preserved; headers are only removed when deleted or set to undefined. Fixes #25767.
• Fixed an issue where runs recorded to Cypress Cloud from Jenkins could show the branch name with the remote prefix included (for example origin/main instead of main), or report the wrong branch in multibranch pipelines. Cypress now reports the actual branch name. Fixes #20833.
• Fixed an issue where invalid CYPRESS_env or CYPRESS_expose environment variables (for example, a plain string instead of a JSON object) were silently ignored with no warning. Cypress now emits a warning explaining that a JSON object is required and points to the --env or --expose CLI flags for setting individual values. Fixes #29682 and #19508. Fixed in #33945.
• Fixed an issue where cypress run could crash with TypeError: The "path" argument must be of type string. Received undefined when the project path was not resolved (for example, due to an unset CI environment variable) or when --browser was passed without a value. Cypress now falls back to the current working directory in the first case and emits a clear "browser not found" error in the second. Fixes #15418. Fixed in #33958.
• Fixed an issue where HTML markup passed as a Sinon spy argument (for example expect(spy).to.have.been.calledOnceWith('<svg>...</svg>')) was rendered as live DOM in the Cypress command log, truncating the assertion message and breaking the log layout. The assertion message is now HTML-escaped and the markup is shown as literal text. Fixes #33416. Fixed in #33941.
• Fixed a regression in 14.4.0 where Cypress incorrectly logged Warning: We failed to trash the existing run results. on Windows when the Recycle Bin is configured with "Don't move files to the Recycle Bin. Remove files immediately when deleted.", even though the assets were actually removed. Fixes #32691.
• Fixed an issue where a test or attempt that had not reached a terminal state (for example, after an interrupted or crashed run) could be reported to Cypress Cloud with an internal, display-only processing state that the Cloud rejects. Such in-flight states are now reported as pending. Fixes #27956.
• Fixed an issue where the version of WebKit was incorrectly displayed as version 0 when playwright version 1.60.0 was installed. Fixes #33953.
• Fixed an issue where clicking a cy.origin command in the Command Log to print its details to the console threw an error when the callback yielded a value that could not be serialized across origins (for example, the page's window after a cy.visit). The command now prints its origin, arguments, and yielded subject to the console without erroring; an unserializable yielded subject is shown by its type instead of throwing. Fixes #27385. Fixed in #33983. …

Features:

• Cypress Cloud sign up is supported from the Cypress desktop app in addition to log in. Addressed in #33805.
• The Cypress Cloud log in and sign up modals in the Cypress desktop app now automatically start the browser-based authentication flow when opened, removing the extra "Log in" click. Addressed in #33831.

Bugfixes:

• Fixed an issue on Node 24.16.0+ and Node 26.1.0+ where installing Cypress could silently extract only the first file from the binary archive, causing the test runner to fail to launch with a "Cypress binary is missing" error. Addresses #33891. Addressed in #33887.
• Fixed a regression in 15.14.2 where the cypress install and cypress verify task list output could render one character per line in CI environments that allocate a pseudo-TTY without setting COLUMNS. Fixed in #33890.
• Fixed an issue where Cypress would abort the process and show a crash dialog when it received a SIGINT. Fixes #29228. Fixed in #33542.
• Fixed an issue where the clientCertificates config option failed to load ECDSA (EC) PEM or PKCS#12 client certificates. Fixes #33767. Fixed in #33799.
• Fixed an issue where clicking "back to projects" or switching projects while a project's initial config load was still in flight could fail. Fixed in #33810.
• Fixed an intermittent ENOENT: no such file or directory, open <path>/bundle.tar-<rand> error during cy.prompt and Studio bundle initialization. Fixed in #33748.
• Fixed a regression in 14.3.3 where deleting results.video in after:spec to keep videos only for failing specs could leave an empty *-compressed.mp4 file in cypress/videos. Fixes #32883.
• Fixed an issue where Cypress's bundled TypeScript type definitions could fail to compile in a project that also installed @sinonjs/fake-timers@>=15.3.0, because the bundled @types/sinon file imported FakeTimers from @sinonjs/fake-timers and TypeScript would prefer the user's installed copy over the bundled @types/sinonjs__fake-timers. The shipped types now reference the @types package directly so resolution is independent of the user's installed version. Fixes #33829. Fixed in #33886.

Dependency Updates:

• Upgraded esbuild to ^0.28.0 to address CVE-2025-68121 in the bundled esbuild Go binary (incorrect TLS certificate validation during session resumption), as reported in container and image security scans. Fixes #33599. Addressed in #33816.

Deprecations:

• The cy.end() command has been deprecated and will be removed in a future release. Instead of using .end() to break a chain, start a new chain of commands off of cy. Addressed in #33707.

Bugfixes:

• Fixed an issue where the proxy stripped Content-Length: 0 from empty responses (e.g. a DELETE 200 with no body) and the resulting empty body was re-emitted with Transfer-Encoding: chunked, breaking clients that assume a fixed-length response. Partially addresses #16469. Fixed in #33754.
• Fixed an issue where component specs that defined local React components could register every describe / it block twice in cypress open when using Vite 8, because React refresh treated those specs as HMR self-accepting modules. @cypress/vite-dev-server now excludes component spec files from JSX refresh while leaving Fast Refresh enabled for application source. Fixes #33750.
• Fixed an issue where multi-origin tests using cy.origin could fail to talk to a secondary origin after test isolation, when the spec-bridge iframe was already present, or when more than one secondary origin became ready around the same time. Cached spec-bridge window targets are now cleared at the correct lifecycle points, improving performance of specs with cy.origin calls. Addressed in #33704.
• Fixed an issue where a CSS selector built internally from element attributes could throw an uncaught Syntax error, unrecognized expression and crash the runner when an attribute value contained CSS-special characters (for example, an <input> with a pattern attribute containing regex metacharacters). Fixes #26967 and #29345.
• Fixed an issue where transient HTTP 500 responses from Cypress Cloud were not retried for idempotent requests. Fixed in #33718.
• Fixed an issue in Angular component testing where multiple projects in a monorepo sharing the same directory basename (e.g. libs/feature-a/feat-shell and libs/feature-b/feat-shell) would intermittently fail with spec-resolution errors when run in parallel. The temporary tsconfig.json generated by @cypress/webpack-dev-server was keyed only on the directory basename, so parallel runs would race on the same file. The temp directory is now suffixed with a short hash of the full project root path, giving each project its own isolated config. Fixes #33634.
• Fixed a race during cypress open config reload where rapid changes to cypress.config.js could leave the specs list stale. Two overlapping config-reload calls would tear down each other's IPC child processes (surfacing as ERR_STREAM_DESTROYED), causing both reloads to fail and the specs list to never refresh. Fixed in #33775.
• Fixed an issue where a transient Firefox launch failure caused Cypress to exit instead of retrying the browser launch. Fixed in #33770.

Dependency Updates:

• Upgraded socket.io from 4.0.1 to 4.8.3, socket.io-client from 4.0.1 to 4.8.3, and socket.io-parser from 4.0.5 to 4.2.6 to address a Denial of Service vulnerability reported in security scans. The engine.io, engine.io-client, and engine.io-parser direct deps in @packages/socket were also bumped to keep transitive copies aligned and the existing browser-side patches applied. Addressed in #33719.
• Upgraded uuid from 8.3.2 to 11.1.1 to address an Improper Validation of Specified Index, Position, or Offset in Input vulnerability reported in security scans. Addressed in #33765.

Performance:

• Reduced main-thread overhead when scrolling the command log in cypress open by fixing an issue where the reporter could register more than one scroll listener on the log if its scroll container was set more than once. Addressed in #33607.

Bugfixes:

• Fixed an issue where cy.wait on multiple aliases could surface an unhandled Cannot read properties of undefined (reading 'routeId') rejection when a retry short-circuited during runnable teardown. Fixed in #33651.
• Fixed an issue where an application under test containing <base target="_top"> or <base target="_parent"> would navigate out of the Cypress iframe when untargeted links were clicked or forms were submitted, breaking the test run. The unsafe target is now stripped from <base> tags as part of the existing modifyObstructiveCode rewriting (enabled by default for the primary super-domain, and extendable to third-party origins with experimentalModifyObstructiveThirdPartyCode). A runtime guard also neutralizes any <base> inserted or modified after load, matching the always-on behavior of the existing <a> / <form> target guards. Fixed in #33667.
• Fixed a race during cypress open config reload where the internal HTTP server would begin accepting requests before the primary remote state had been initialized, occasionally crashing in-flight browser requests (iframe loads) on an empty remoteStates map. Fixed in #33686.

Dependency Updates:

• Upgraded cachedir from ^2.3.0 to ^2.4.0. Addressed in #33608.
• Upgraded listr2 from 3.8.3 to ^9.0.5. Addressed in #33640.
• Upgraded simple-git from 3.33.0 to 3.36.0 to address a Remote Code Execution vulnerability reported in security scans. Addressed in #33680.
• Upgraded ts-loader from 9.5.2 to 9.5.7. Addresses #33648. Addressed in #33691
• Upgraded @cypress/request from ^3.0.10 to ^4.0.0. Addresses #33668. Addressed in #33712

Performance:

• Fixed a memory leak in cypress open where each spec rerun accumulated an additional uncaughtException listener, preventing the previous Mocha runner — and all the objects it retained (commands, snapshots, logs) — from being garbage collected. Fixed in #33631.

Bugfixes:

• Increased the limit for decrypted payloads to support large cy.prompt requests and responses. Fixed in #33619.
• Fixed a race condition in @cypress/vite-dev-server where the Cypress iframe could attempt to import the support file before Vite had finished serving it, causing intermittent "Failed to fetch dynamically imported module" errors in component tests. The dev server now waits until the support file URL returns a successful response before signaling that it is ready. Addressed in #33487.

Performance:

• Reduced browser memory growth during long interactive runs by clearing stored command log data (messages, URLs, snapshots, console props, and other fields—including custom Cypress.log properties) once tests age out of numTestsKeptInMemory, so the runner can reclaim memory and stay more responsive. Addressed in #33601.

Features:

• Cypress now officially supports TypeScript 6. Addresses #33385 and #33511.
• Adds Vite 8 support for component testing. Addresses #32550 and #33078.

Bugfixes:

• Fixed an issue where Cypress tests in open mode would not pick up on modified env values in the user's config file. Fixed in #33567. Fixes #33372.
• Fixed an issue where cy.wrap would not preserve a custom onFail handler when wrapping a rejected promise. Fixed in #33570.

Dependency Updates:

• Upgraded axios to 1.15.0 to address CVE-2025-62718 and CVE-2026-40175 vulnerabilities reported in security scans. Fixes #33590.