# Cypress changelog

> Fast, easy and reliable testing for anything in a browser.

- Vendor: Cypress.io
- Category: Developer Tools
- Official site: https://www.cypress.io
- Tracked by: What's New (https://whatsnew.fyi/product/cypress)
- Harvested from: GitHub (cypress-io/cypress)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v15.20.0

- Date: 2026-08-04
- Version: v15.20.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.20.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.20.0

- **fixed** — Fixed an issue where visibility checks serialized an element's entire text subtree once per overflow-hidden ancestor, which could exhaust the renderer's memory and crash it on text-heavy pages
- **changed** — Reduced the sampling overhead of experimentalMemoryManagement when Cypress runs inside a memory-limited container using cgroup v1 by eliminating helper subprocesses on every sampling interval
- **added** — scrollBehavior now accepts a per-axis value such as { block: 'start', inline: 'nearest' } to set vertical and horizontal alignment independently
- **added** — cy.request() and cy.intercept() now accept the HTTP QUERY method
- **fixed** — Fixed a regression where action commands scrolled an already-visible element's container horizontally
- **fixed** — Fixed a regression where commands that read from the application under test targeted the command log instead of your application when the application set window.name
- **fixed** — Fixed an issue where a cy.* command error message that interpolated a value containing a $ character could render incorrectly
- **fixed** — Fixed an issue where a Cypress error message that interpolated a value containing a $ sequence could render with corrupted or duplicated text
- **fixed** — Fixed an issue where cy.intercept() matching on the auth option compared only the portion of a Basic authentication password before the first colon
- **fixed** — Fixed an issue where cy.intercept() routes specifying a numeric port did not match requests on non-default ports
- **fixed** — Fixed an issue where inline source maps embedded without a charset were not decoded and were silently dropped
- **fixed** — Fixed an issue where TypeScript 7 support did not work and spec and support files failed to compile
- **fixed** — Fixed an issue where a cy.origin() block could intermittently fail with TypeError: Cannot read properties of undefined (reading 'applied')
- **fixed** — Fixed an issue where during a cy.origin() block, session cookies set on the primary origin by the first page visited in a test were not included in the identity provider's callback request
- **fixed** — Fixed an issue where the configuration validation error for passesRequired in the detect-flake-and-pass-on-threshold retry strategy reported the value of an unrelated option
- **fixed** — Fixed an issue where the configuration validation error for an absolute ca filepath in clientCertificates referenced the wrong certificate

**Performance:**

- Fixed an issue where visibility checks (such as [`.should('be.visible')`](https://on.cypress.io/should) and actionability) serialized an element's entire text subtree once per overflow-hidden ancestor, which on text-heavy pages could exhaust the renderer's memory and crash it (`We detected that the Chrome Renderer process just crashed`). Fixes [#34329](https://github.com/cypress-io/cypress/issues/34329).
- Reduced the sampling overhead of [`experimentalMemoryManagement`](https://on.cypress.io/experiments) when Cypress runs inside a memory-limited container using cgroup v1. Memory readings no longer spawn helper subprocesses on every sampling interval, which lowers CPU usage that previously competed with the tests, most noticeably on constrained CI machines. Addresses [#34105](https://github.com/cypress-io/cypress/issues/34105). Fixed in [#34331](https://github.com/cypress-io/cypress/pull/34331).

**Features:**

- [`scrollBehavior`](https://docs.cypress.io/app/references/configuration#Actionability) now accepts a per-axis value, such as `{ block: 'start', inline: 'nearest' }`, so the vertical and horizontal alignment used to scroll an element into view before an action command can be set independently. The per-axis form takes the same values as the native `scrollIntoView`: `'start'`, `'end'`, `'center'`, and `'nearest'`. Addresses [#34460](https://github.com/cypress-io/cypress/issues/34460).
- [`cy.request()`](https://on.cypress.io/request) and [`cy.intercept()`](https://on.cypress.io/intercept) now accept the HTTP `QUERY` method. Previously it was rejected as an invalid method in the browser. Fixes [#28282](https://github.com/cypress-io/cypress/issues/28282).

**Bugfixes:**

- Fixed a regression in [15.18.1](#15-18-1) where action commands scrolled an already-visible element's container horizontally. The [`scrollBehavior`](https://docs.cypress.io/app/references/configuration#Actionability) values `'top'` and `'bottom'` revert to aligning only the vertical axis; use `'start'` or `'end'` to align both. Fixes [#34460](https://github.com/cypress-io/cypress/issues/34460).
- Fixed a regression in [15.19.0](#15-19-0) where commands that read from the application under test, such as [`cy.url()`](https://on.cypress.io/url), [`cy.title()`](https://on.cypress.io/title) and [`cy.reload()`](https://on.cypress.io/reload), targeted the command log instead of your application when the application set `window.name`. Fixes [#34435](https://github.com/cypress-io/cypress/issues/34435).
- Fixed an issue where a `cy.*` command error message that interpolated a value containing a `$` character could render incorrectly, with a leaked `{{...}}` placeholder or duplicated or dropped surrounding text. Such values are now inserted verbatim. Fixed in [#34221](https://github.com/cypress-io/cypress/pull/34221).
- Fixed an issue where a Cypress error message that interpolated a value containing a `$` sequence (such as `$&`, `` $` ``, `$'`, or `$$`) could render with corrupted or duplicated text. Such values are now shown verbatim. Fixed in [#34220](https://github.com/cypress-io/cypress/pull/34220).
- Fixed an issue where [`cy.intercept()`](https://on.cypress.io/intercept) matching on the `auth` option compared only the portion of a Basic authentication password before the first colon, so a request whose password contained a colon (permitted by RFC 7617) failed to match. The full password is now compared. Fixed in [#34206](https://github.com/cypress-io/cypress/pull/34206).
- Fixed an issue where [`cy.intercept()`](https://on.cypress.io/intercept) routes specifying a numeric `port` (for example `port: 8080` or `port: [8080]`) did not match requests on non-default ports. Such routes now match as documented. Fixes [#17653](https://github.com/cypress-io/cypress/issues/17653). Fixed in [#34205](https://github.com/cypress-io/cypress/pull/34205).
- Fixed an issue where inline source maps embedded without a `charset` (for example those emitted by e

_[Truncated at 4000 characters — full notes: https://github.com/cypress-io/cypress/releases/tag/v15.20.0]_

### v15.19.0

- Date: 2026-07-21
- Version: v15.19.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.19.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.19.0

- **fixed** — Fixed an issue where the browser's renderer process could crash when the application under test triggered a ResizeObserver loop while the command log was visible
- **fixed** — Fixed a regression where each message sent from the Cypress server to a Chromium-based browser leaked a small amount of browser memory until the end of the spec, which could crash the browser during long, command- or network-heavy specs
- **fixed** — Fixed an issue where each cy.press() call in Chromium-based browsers retained a small amount of renderer memory for the remainder of the spec file, which could contribute to memory growth in specs with many cy.press() calls
- **added** — Added support for TypeScript 7 when preprocessing TypeScript spec and support files, and the component testing setup wizard now accepts TypeScript 7
- **added** — Added support for additional assertion aliases: .exists (alias of .exist), .greaterThanOrEqual and .lessThanOrEqual (aliases of .least and .most), and .oneOf chained with .contain
- **fixed** — Fixed an issue where chaining an assertion after .should('exist') on a raw DOM element failed with expected null to exist, because the existence assertion replaced the subject with null
- **fixed** — Fixed an issue where on Windows, enhancing a test failure stack could throw a secondary TypeError and mask the original error
- **fixed** — Fixed an issue where experimentalMemoryManagement could fail to prevent the browser from running out of memory and crashing when Cypress was running inside a memory-limited container
- **changed** — Corrected the @default value in the TypeScript type definitions for the videoCompression configuration option from 32 to false

**Performance:**

- Fixed an issue where the browser's renderer process could crash (`We detected that the Chrome Renderer process just crashed`) when the application under test triggered a `ResizeObserver` loop while the command log was visible. Fixes [#33962](https://github.com/cypress-io/cypress/issues/33962) and [#34218](https://github.com/cypress-io/cypress/issues/34218).
- Fixed a regression in [14.0.0](#14-0-0) where each message sent from the Cypress server to a Chromium-based browser (including Electron) leaked a small amount of browser memory until the end of the spec. During long, command- or network-heavy specs, this buildup could crash the browser (`We detected that the Chrome Renderer process just crashed`). Fixes [#34226](https://github.com/cypress-io/cypress/issues/34226).
- Fixed an issue where each [`cy.press()`](https://on.cypress.io/press) call in Chromium-based browsers retained a small amount of renderer memory for the remainder of the spec file, which could contribute to memory growth in specs with many `cy.press()` calls. Addressed in [#34240](https://github.com/cypress-io/cypress/pull/34240).

**Features:**

- Added support for TypeScript 7 when preprocessing TypeScript spec and support files. The component testing setup wizard now accepts TypeScript 7 as well. Addresses [#34258](https://github.com/cypress-io/cypress/issues/34258). Addressed in [#34277](https://github.com/cypress-io/cypress/pull/34277).
- Added support for additional assertion aliases: `.exists` (alias of `.exist`), `.greaterThanOrEqual` and `.lessThanOrEqual` (aliases of `.least` and `.most`), and `.oneOf` chained with `.contain` (for example `expect('Today is sunny').to.contain.oneOf(['sunny', 'cloudy'])`). These can be used anywhere Cypress assertions are written, such as `expect`, `assert`, and `cy.get(...).should(...)`. This comes from upgrading the bundled `chai` assertion library from `4.2.0` to `4.5.0`; all existing assertions and their messages behave the same. Addressed in [#34178](https://github.com/cypress-io/cypress/pull/34178).

**Bugfixes:**

- Fixed an issue where chaining an assertion after [`.should('exist')`](https://on.cypress.io/should) on a raw DOM element (rather than a jQuery object) failed with `expected null to exist`, because the existence assertion replaced the subject with `null`. Chaining further assertions off `.exist` (or its `.exists` alias) for a raw DOM element now works as expected. Fixes [#25491](https://github.com/cypress-io/cypress/issues/25491).
- Fixed an issue where, on Windows, enhancing a test failure stack could throw a secondary `TypeError: Cannot read properties of undefined (reading 'replaceAll')` and mask the original error. Fixed in [#34252](https://github.com/cypress-io/cypress/pull/34252).
- Fixed an issue where [`experimentalMemoryManagement`](https://on.cypress.io/experiments) could fail to prevent the browser from running out of memory and crashing when Cypress was running inside a memory-limited container. Memory is now managed correctly in these environments. Fixes [#34104](https://github.com/cypress-io/cypress/issues/34104). Addressed in [#34123](https://github.com/cypress-io/cypress/pull/34123).

**Misc:**

- Corrected the `@default` value in the TypeScript type definitions for the [`videoCompression`](https://on.cypress.io/configuration#Videos) configuration option from `32` to `false`. Addressed in [#34198](https://github.com/cypress-io/cypress/pull/34198).

### v15.18.1

- Date: 2026-07-07
- Version: v15.18.1
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.18.1
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.18.1

- **changed** — Verifying that the Cypress binary can run now completes more quickly
- **fixed** — Fixed an issue where Cypress could hang until the spec timed out if the browser process crashed mid-run while video recording was disabled
- **fixed** — Fixed a TypeScript error when asserting focus with Chai's property syntax such as `expect($el).to.have.focus` or `expect($el).to.be.focused`
- **fixed** — Fixed `cy.type()` firing the simulated `keyup` event in the same turn as `keydown` and `input` by deferring `keyup` to the next microtask
- **fixed** — Fixed headless WebKit using the host machine's `devicePixelRatio` instead of a standard value of 1
- **fixed** — Fixed the `userAgent` configuration option not being applied when running tests in the experimental WebKit browser
- **fixed** — Fixed a request to focus the browser window in the experimental WebKit browser being silently ignored
- **fixed** — Fixed opening an unconfigured project from a git repository sub-directory skipping project setup
- **fixed** — Fixed the component testing setup wizard not reliably displaying the auto-detected framework and bundler
- **fixed** — Fixed interacting with an element inside a horizontally-scrollable container scrolling the element to the container's right edge instead of its top, leftmost point
- **fixed** — Fixed a regression where `cypress run --spec` printed a spurious warning for patterns that actually matched spec files
- **security** — Upgraded `esbuild` from 0.28.0 to 0.28.1 to address a Resources Downloaded over Insecure Protocol vulnerability

**Performance:**

- Verifying that the Cypress binary can run, which happens the first time a newly installed version is used (before `cypress open` or `cypress run`) and whenever `cypress verify` is invoked, now completes more quickly. Addressed in [#34133](https://github.com/cypress-io/cypress/pull/34133).

**Bugfixes:**

- Fixed an issue where Cypress could hang until the spec timed out if the browser process crashed mid-run (for example, an out-of-memory or GPU crash) while video recording was disabled. The current spec now fails and the run continues to the next spec as expected. Fixed in [#34126](https://github.com/cypress-io/cypress/pull/34126).
- Fixed an issue where asserting focus with Chai's property syntax, such as `expect($el).to.have.focus` or `expect($el).to.be.focused`, raised a TypeScript error (`Property 'focus' does not exist on type 'Assertion'`) even though the assertion works at runtime. Fixes [#23905](https://github.com/cypress-io/cypress/issues/23905). Fixed in [#34177](https://github.com/cypress-io/cypress/pull/34177).
- Fixed an issue where [`cy.type()`](https://on.cypress.io/type) fired the simulated `keyup` event in the same turn as `keydown` and `input`, so `keyup` handlers that read state updated asynchronously in an `input` listener could observe stale values. `keyup` is now deferred to the next microtask, matching real browser event ordering. Fixes [#14864](https://github.com/cypress-io/cypress/issues/14864). Fixed in [#34068](https://github.com/cypress-io/cypress/pull/34068).
- Fixed an issue where headless WebKit used the host machine's `devicePixelRatio` instead of a standard value of `1`. Headless WebKit now matches headless Chrome, so screenshots taken during `cypress run` are consistent regardless of the host's DPI (for example 2x locally versus 1x in CI) and text is no longer fuzzy on high-DPI displays. Applies when [`experimentalWebKitSupport`](https://docs.cypress.io/app/references/experiments) is enabled. Fixes [#23808](https://github.com/cypress-io/cypress/issues/23808). Fixed in [#34088](https://github.com/cypress-io/cypress/pull/34088).
- Fixed an issue where the [`userAgent`](https://on.cypress.io/configuration#Browser) configuration option was not applied when running tests in the experimental WebKit browser. Fixes [#33349](https://github.com/cypress-io/cypress/issues/33349).
- Fixed an issue where, in the experimental WebKit browser, a request to focus the browser window was silently ignored, so the window could remain in the background. The active page is now correctly brought to the front. Addressed in [#34137](https://github.com/cypress-io/cypress/pull/34137).
- Fixed an issue where opening an unconfigured project from a git repository sub-directory (such as a monorepo package) skipped project setup. Additionally, the component testing setup wizard now reliably displays the auto-detected framework and bundler. Fixes [#27410](https://github.com/cypress-io/cypress/issues/27410) and [#29544](https://github.com/cypress-io/cypress/issues/29544). Fixed in [#34129](https://github.com/cypress-io/cypress/pull/34129) and [#34212](https://github.com/cypress-io/cypress/pull/34212).
- Fixed an issue where interacting with an element inside a horizontally-scrollable container could scroll the element to the container's right edge, placing it underneath a right-floating `position: sticky` or `position: fixed` element and causing the action to fail or land on the wrong element. Elements are now scrolled to their top, leftmost point as documented. Fixes [#33884](https://github.com/cypress-io/cypress/issues/33884). Fixed in [#34108](https://github.com/cypress-io/cypress/pull/34108).
- Fixed a regression in [15.17.0](#15-17-0) where `cypress run --spec` printed a spurious `The following --spec pattern did not match any spec files and will be ignored` warning for patterns that actually did match spec files, such as patterns using regex-style alternation groups (for example `cypress/e2e/(a|b)/*.js

_[Truncated at 4000 characters — full notes: https://github.com/cypress-io/cypress/releases/tag/v15.18.1]_

### v15.18.0

- Date: 2026-06-23
- Version: v15.18.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.18.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.18.0

- **fixed** — Fixed an issue where an application that repeatedly threw the same uncaught exception could exhaust renderer memory and crash the browser; consecutive identical uncaught exceptions within a test now collapse into a single, updating command-log entry, and a handled uncaught exception no longer captures a DOM snapshot
- **added** — Added a removeSRIAttributes configuration option that strips the integrity attribute from <script> and <link> elements on first-party resources to prevent them from being blocked by Subresource Integrity enforcement after Cypress rewrites them
- **fixed** — Fixed an issue where calling req.destroy() or using { forceNetworkError: true } inside a cy.intercept() handler in experimental WebKit caused infinite request loops
- **fixed** — Fixed an issue where the before:spec plugin event fired twice for the same spec when a test navigated to a cross-origin URL via cy.visit()
- **fixed** — Fixed an issue where setting numTestsKeptInMemory to a value greater than 0 from setupNodeEvents would take effect during cypress run and prevent snapshots from being captured correctly; numTestsKeptInMemory is now always treated as 0 during cypress run
- **fixed** — Fixed an issue where Cypress installed in a read-only location could log a cannot delete profileDir on exit error and leave the browser profile directory behind
- **fixed** — Fixed an issue where the resolved remote origin could include an explicit default port or embedded credentials when the visited URL contained them, which did not match the origin reported by the browser
- **fixed** — Fixed an issue where cy.screenshot() could still capture changing pixels from some running web animations
- **fixed** — Fixed an issue where during cypress run with experimentalSingleTabRunMode and experimental WebKit, component test runs with video recording enabled would only record the first spec's video and could hang without exiting
- **fixed** — Fixed an issue where running component tests with experimentalSingleTabRunMode enabled could cause a spec to fail intermittently after many other specs had run in the same browser tab
- **fixed** — Fixed an issue where passing a cy.fixture() alias to cy.selectFile() attached the file without its name in a second or later test that loaded the same fixture, causing servers to reject the upload
- **fixed** — Fixed a regression in 15.17.0 where loading the Cypress configuration could fail with TransformError when the project has the same esbuild version installed that Cypress bundles internally and a dependency registers its own tsx loader

**Performance:**

- Fixed an issue where an application that repeatedly threw the same uncaught exception (for example, a benign `ResizeObserver loop ...` notification fired on every animation frame) could exhaust renderer memory and crash the browser. Consecutive identical uncaught exceptions within a test now collapse into a single, updating command-log entry, and a handled (suppressed) uncaught exception no longer captures a DOM snapshot. Addresses [#27415](https://github.com/cypress-io/cypress/issues/27415).

**Features:**

- Added a `removeSRIAttributes` configuration option. When enabled, Cypress strips the `integrity` attribute from `<script>` and `<link>` elements on first-party resources so they are not blocked by Subresource Integrity (SRI) enforcement after Cypress rewrites them. This covers `integrity` set via static HTML, a JavaScript string literal, and runtime DOM assignment (including the `webpack-subresource-integrity` pattern used for lazily-loaded chunks). Addresses [#34124](https://github.com/cypress-io/cypress/issues/34124) and [#18315](https://github.com/cypress-io/cypress/issues/18315).

**Bugfixes:**

- Fixed an issue where calling `req.destroy()` or using `{ forceNetworkError: true }` inside a [`cy.intercept()`](https://on.cypress.io/intercept) handler in experimental WebKit caused infinite request loops. Fixes [#23810](https://github.com/cypress-io/cypress/issues/23810). Fixed in [#33948](https://github.com/cypress-io/cypress/pull/33948).
- Fixed an issue where the [`before:spec`](https://on.cypress.io/before-spec-api) plugin event fired twice for the same spec when a test navigated to a cross-origin URL via [`cy.visit()`](https://on.cypress.io/visit). Affects `cypress run` and `cypress open` with `experimentalInteractiveRunEvents` enabled. The event now fires exactly once per spec run, regardless of how many times the runner page reloads internally during cross-origin navigation. Fixes [#26300](https://github.com/cypress-io/cypress/issues/26300).
- Fixed an issue where setting [`numTestsKeptInMemory`](https://on.cypress.io/configuration#Global) to a value greater than `0` from `setupNodeEvents` would take effect during `cypress run`, which could prevent snapshots from being captured correctly when recording Test Replay to Cypress Cloud. During `cypress run`, `numTestsKeptInMemory` is now always treated as `0` regardless of how it is configured. Fixes [#31167](https://github.com/cypress-io/cypress/issues/31167).
- Fixed an issue where, when Cypress was installed in a read-only location, running tests in Firefox or Chrome could log a `cannot delete profileDir on exit` error (`EACCES`/`EPERM`) and leave the browser profile directory behind, requiring manual cleanup before the next run. Cypress now removes the profile directory on exit as expected. Fixes [#31300](https://github.com/cypress-io/cypress/issues/31300).
- Fixed an issue where the resolved remote origin (for example, `Cypress.config('remote').origin`) could include an explicit default port (`:80` for HTTP or `:443` for HTTPS) or embedded credentials when the visited URL contained them, which did not match the origin reported by the browser. The reported origin now always matches the browser's `location.origin`, omitting default ports and any embedded credentials. Fixes [#28369](https://github.com/cypress-io/cypress/issues/28369). Fixed in [#34050](https://github.com/cypress-io/cypress/pull/34050).
- Fixed an issue where `cy.screenshot()` could still capture changing pixels from some running web animations. Fixes [#29144](https://github.com/cypress-io/cypress/issues/29144).
- Fixed an issue where, during `cypress run` with [`experimentalSingleTabRunMode`](https://docs.cypress.io/app/references/experiments) and the experimental WebKit browser, component test runs with video recording enabled would only record the first spec's video and could then hang without exiting. Each spec is now recorded to its own video and the run exits normally. Fixes [

_[Truncated at 4000 characters — full notes: https://github.com/cypress-io/cypress/releases/tag/v15.18.0]_

### v15.17.0

- Date: 2026-06-09
- Version: v15.17.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.17.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.17.0

- **fixed** — Command Log no longer becomes progressively unresponsive when moving the mouse in and out of a test's command list during long tests
- **fixed** — Fixed memory leak where runs with screenshotOnRunFailure enabled slowed down progressively as each failure screenshot was retained in memory
- **added** — Added Bun as a recognized package manager for installing and invoking Cypress
- **added** — Cypress.expose() values can now be overridden per suite or test via test config overrides using { expose: { key: value } }
- **added** — When signing up to Cypress Cloud from the desktop app, Cypress now automatically writes the projectId to the cypress.config file if a project is auto-provisioned, or shows a modal with the project ID if the file cannot be written
- **changed** — Improved CI environment detection and commit metadata capture for Cypress Cloud recorded runs within Argo CD and Argo Workflows
- **fixed** — Video recording no longer silently fails on Firefox 93+, which previously produced no video and ended with a processing warning
- **fixed** — Fixed issue where in the Electron browser, navigating away from a page with a beforeunload handler would hang and eventually fail the command with a page load timeout
- **fixed** — Fixed issue where config.isInteractive was always true in the config passed to plugins, even during cypress run mode
- **fixed** — Fixed issue where component tests and end-to-end tests using a local baseUrl could fail to start when an HTTP_PROXY environment variable was set
- **fixed** — Fixed issue where cy.wait('@alias') could time out when the connection to the browser closed before an aliased intercepted request's response completed
- **fixed** — Fixed issue where cy.request() with a FormData body failed to upload when a Content-Type header was provided with non-lowercase casing
- **fixed** — Fixed issue where Cypress could load the config file through the wrong module system, preventing ESM-only APIs like import.meta.resolve from being available
- **fixed** — Fixed issue where a recorded Chrome or Electron run could hang for the duration of the spec timeout when the renderer crashed mid-spec

**Performance:**

- The Command Log no longer becomes progressively unresponsive when moving the mouse in and out of a test's command list during long tests. Hovering over the command area previously triggered a style recalculation across the entire list of commands, causing a delay that grew with the number of commands logged. Fixes [#33179](https://github.com/cypress-io/cypress/issues/33179).
- Fixed a memory leak where runs with `screenshotOnRunFailure` enabled slowed down progressively, as each failure screenshot was retained in memory for the rest of the run. Fixes [#33516](https://github.com/cypress-io/cypress/issues/33516).

**Features:**

- Added [Bun](https://bun.sh) as a recognized package manager. The `cypress` npm package can now be installed and invoked with Bun (for example `bun run cypress open` or `bun run cypress run`). Addresses [#28962](https://github.com/cypress-io/cypress/issues/28962). Addressed in [#32580](https://github.com/cypress-io/cypress/pull/32580).
- [`Cypress.expose()`](https://on.cypress.io/expose) values can now be overridden per suite or test via test config overrides (for example, `describe()`, `context()`, `it()`, or `test()`) using `{ expose: { key: value } }`. Suite- and test-level overrides are merged, with test-level keys taking precedence; override keys are applied at test start and restored after each test without affecting unrelated values set in hooks. Addresses [#33356](https://github.com/cypress-io/cypress/issues/33356). Addressed in [#33925](https://github.com/cypress-io/cypress/pull/33925).
- When signing up to Cypress Cloud from the Cypress desktop app, if a project is auto-provisioned during signup, Cypress now automatically writes the `projectId` to the `cypress.config` file. If the file cannot be written, a modal is shown with the project ID as a copyable snippet and a link to open the config file directly in your IDE. Addressed in [#33976](https://github.com/cypress-io/cypress/pull/33976).
- Improved CI environment detection and commit metadata capture for Cypress Cloud recorded runs within Argo CD and Argo Workflows. Addressed in [#33932](https://github.com/cypress-io/cypress/pull/33932).


**Bugfixes:**

- Video recording no longer silently fails on Firefox 93+, where it previously produced no video and ended with a `We failed processing this video` or operation timed out warning. Fixes [#18415](https://github.com/cypress-io/cypress/issues/18415). Fixed in [#33960](https://github.com/cypress-io/cypress/pull/33960).
- Fixed an issue where, in the Electron browser, navigating away from a page whose `beforeunload` handler requested a confirmation prompt (for example `window.onbeforeunload = () => 'message'` or a `beforeunload` listener that sets `event.returnValue`) would hang and eventually fail the command with a page load timeout. Such navigations — including `cy.visit()`, `cy.reload()`, and clicking links — now proceed automatically without the confirmation prompt blocking the test, matching the behavior in Chrome. Fixes [#2118](https://github.com/cypress-io/cypress/issues/2118).
- Fixed an issue where `config.isInteractive` was always `true` in the config passed to the plugins / `setupNodeEvents` function, even during `cypress run`. The value is now correctly `false` in run mode and `true` in open mode, so plugins can reliably distinguish between the two. Fixes [#20789](https://github.com/cypress-io/cypress/issues/20789).
- Fixed an issue where component tests, and end-to-end tests using a local `baseUrl`, could fail to start with `Cypress could not verify that this server is running` when an `HTTP_PROXY` environment variable was set. Local hosts excluded from the proxy via `NO_PROXY` (such as `localhost`, `127.0.0.1`, and `::1`, which includes the component testing dev server) are now verified with a direct connection instead of being routed through the proxy. Fixes [#27990](https://github.com/cypress-io/cypress/issues/27990).
- Fixed an issue where `cy.wait('@alias')`

_[Truncated at 4000 characters — full notes: https://github.com/cypress-io/cypress/releases/tag/v15.17.0]_

### v15.16.0

- Date: 2026-05-26
- Version: v15.16.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.16.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.16.0

- **added** — Cypress Cloud sign up is supported from the Cypress desktop app in addition to log in
- **changed** — The Cypress Cloud log in and sign up modals in the Cypress desktop app now automatically start the browser-based authentication flow when opened
- **fixed** — Fixed an issue on Node 24.16.0+ and Node 26.1.0+ where installing Cypress could silently extract only the first file from the binary archive, causing the test runner to fail to launch with a "Cypress binary is missing" error
- **fixed** — Fixed a regression where the cypress install and cypress verify task list output could render one character per line in CI environments that allocate a pseudo-TTY without setting COLUMNS
- **fixed** — Fixed an issue where Cypress would abort the process and show a crash dialog when it received a SIGINT
- **fixed** — Fixed an issue where the clientCertificates config option failed to load ECDSA (EC) PEM or PKCS#12 client certificates
- **fixed** — Fixed an issue where clicking "back to projects" or switching projects while a project's initial config load was still in flight could fail
- **fixed** — Fixed an intermittent ENOENT: no such file or directory, open <path>/bundle.tar-<rand> error during cy.prompt and Studio bundle initialization
- **fixed** — Fixed a regression where deleting results.video in after:spec to keep videos only for failing specs could leave an empty *-compressed.mp4 file in cypress/videos
- **fixed** — Fixed an issue where Cypress's bundled TypeScript type definitions could fail to compile in a project that also installed @sinonjs/fake-timers>=15.3.0 by referencing the @types package directly so resolution is independent of the user's installed version
- **security** — Upgraded esbuild to ^0.28.0 to address CVE-2025-68121 in the bundled esbuild Go binary (incorrect TLS certificate validation during session resumption)

**Features:**

- Cypress Cloud **sign up** is supported from the Cypress desktop app in addition to log in. Addressed in [#33805](https://github.com/cypress-io/cypress/pull/33805).
- The Cypress Cloud log in and sign up modals in the Cypress desktop app now automatically start the browser-based authentication flow when opened, removing the extra "Log in" click. Addressed in [#33831](https://github.com/cypress-io/cypress/pull/33831).

**Bugfixes:**

- Fixed an issue on Node 24.16.0+ and Node 26.1.0+ where installing Cypress could silently extract only the first file from the binary archive, causing the test runner to fail to launch with a "Cypress binary is missing" error. Addresses [#33891](https://github.com/cypress-io/cypress/issues/33891). Addressed in [#33887](https://github.com/cypress-io/cypress/pull/33887).
- Fixed a regression in [15.14.2](#15-14-2) where the `cypress install` and `cypress verify` task list output could render one character per line in CI environments that allocate a pseudo-TTY without setting `COLUMNS`. Fixed in [#33890](https://github.com/cypress-io/cypress/pull/33890).
- Fixed an issue where Cypress would abort the process and show a crash dialog when it received a SIGINT. Fixes [#29228](https://github.com/cypress-io/cypress/issues/29228). Fixed in [#33542](https://github.com/cypress-io/cypress/pull/33542/).
- Fixed an issue where the [`clientCertificates`](https://docs.cypress.io/app/references/client-certificates) config option failed to load ECDSA (EC) PEM or PKCS#12 client certificates. Fixes [#33767](https://github.com/cypress-io/cypress/issues/33767). Fixed in [#33799](https://github.com/cypress-io/cypress/pull/33799).
- Fixed an issue where clicking "back to projects" or switching projects while a project's initial config load was still in flight could fail. Fixed in [#33810](https://github.com/cypress-io/cypress/pull/33810).
- Fixed an intermittent `ENOENT: no such file or directory, open <path>/bundle.tar-<rand>` error during `cy.prompt` and Studio bundle initialization. Fixed in [#33748](https://github.com/cypress-io/cypress/pull/33748).
- Fixed a regression in [14.3.3](#14-3-3) where deleting `results.video` in `after:spec` to keep videos only for failing specs could leave an empty `*-compressed.mp4` file in `cypress/videos`. Fixes [#32883](https://github.com/cypress-io/cypress/issues/32883).
- Fixed an issue where Cypress's bundled TypeScript type definitions could fail to compile in a project that also installed `@sinonjs/fake-timers@>=15.3.0`, because the bundled `@types/sinon` file imported `FakeTimers` from `@sinonjs/fake-timers` and TypeScript would prefer the user's installed copy over the bundled `@types/sinonjs__fake-timers`. The shipped types now reference the `@types` package directly so resolution is independent of the user's installed version. Fixes [#33829](https://github.com/cypress-io/cypress/issues/33829). Fixed in [#33886](https://github.com/cypress-io/cypress/pull/33886).

**Dependency Updates:**

- Upgraded `esbuild` to `^0.28.0` to address [CVE-2025-68121](https://www.cve.org/CVERecord?id=CVE-2025-68121) in the bundled `esbuild` Go binary (incorrect TLS certificate validation during session resumption), as reported in container and image security scans. Fixes [#33599](https://github.com/cypress-io/cypress/issues/33599). Addressed in [#33816](https://github.com/cypress-io/cypress/pull/33816).

### v15.15.0

- Date: 2026-05-12
- Version: v15.15.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.15.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.15.0

- **deprecated** — The cy.end() command has been deprecated and will be removed in a future release; start a new chain of commands off of cy instead
- **fixed** — Fixed an issue where the proxy stripped Content-Length: 0 from empty responses and the resulting empty body was re-emitted with Transfer-Encoding: chunked, breaking clients that assume a fixed-length response
- **fixed** — Fixed an issue where component specs that defined local React components could register every describe/it block twice in cypress open when using Vite 8; @cypress/vite-dev-server now excludes component spec files from JSX refresh while leaving Fast Refresh enabled for application source
- **fixed** — Fixed an issue where multi-origin tests using cy.origin could fail to talk to a secondary origin after test isolation; cached spec-bridge window targets are now cleared at the correct lifecycle points
- **fixed** — Fixed an issue where a CSS selector built internally from element attributes could throw an uncaught Syntax error and crash the runner when an attribute value contained CSS-special characters
- **fixed** — Fixed an issue where transient HTTP 500 responses from Cypress Cloud were not retried for idempotent requests
- **fixed** — Fixed an issue in Angular component testing where multiple projects in a monorepo sharing the same directory basename would intermittently fail with spec-resolution errors when run in parallel; the temporary tsconfig.json is now suffixed with a short hash of the full project root path
- **fixed** — Fixed a race during cypress open config reload where rapid changes to cypress.config.js could leave the specs list stale due to overlapping config-reload calls tearing down each other's IPC child processes
- **fixed** — Fixed an issue where a transient Firefox launch failure caused Cypress to exit instead of retrying the browser launch
- **security** — Upgraded socket.io, socket.io-client, and socket.io-parser to address a Denial of Service vulnerability; upgraded related engine.io packages to keep transitive copies aligned
- **security** — Upgraded uuid to address an Improper Validation of Specified Index, Position, or Offset in Input vulnerability

**Deprecations:**

- The `cy.end()` command has been deprecated and will be removed in a future release. Instead of using `.end()` to break a chain, start a new chain of commands off of `cy`. Addressed in [#33707](https://github.com/cypress-io/cypress/pull/33707).

**Bugfixes:**

- Fixed an issue where the proxy stripped `Content-Length: 0` from empty responses (e.g. a `DELETE 200` with no body) and the resulting empty body was re-emitted with `Transfer-Encoding: chunked`, breaking clients that assume a fixed-length response. Partially addresses [#16469](https://github.com/cypress-io/cypress/issues/16469). Fixed in [#33754](https://github.com/cypress-io/cypress/pull/33754).
- Fixed an issue where component specs that defined local React components could register every `describe` / `it` block twice in `cypress open` when using Vite 8, because React refresh treated those specs as HMR self-accepting modules. `@cypress/vite-dev-server` now excludes component spec files from JSX refresh while leaving Fast Refresh enabled for application source. Fixes [#33750](https://github.com/cypress-io/cypress/issues/33750).
- Fixed an issue where multi-origin tests using [`cy.origin`](https://docs.cypress.io/api/commands/origin) could fail to talk to a secondary origin after test isolation, when the spec-bridge iframe was already present, or when more than one secondary origin became ready around the same time. Cached spec-bridge window targets are now cleared at the correct lifecycle points, improving performance of specs with cy.origin calls. Addressed in [#33704](https://github.com/cypress-io/cypress/pull/33704).
- Fixed an issue where a CSS selector built internally from element attributes could throw an uncaught `Syntax error, unrecognized expression` and crash the runner when an attribute value contained CSS-special characters (for example, an `<input>` with a `pattern` attribute containing regex metacharacters). Fixes [#26967](https://github.com/cypress-io/cypress/issues/26967) and [#29345](https://github.com/cypress-io/cypress/issues/29345).
- Fixed an issue where transient HTTP 500 responses from Cypress Cloud were not retried for idempotent requests. Fixed in [#33718](https://github.com/cypress-io/cypress/pull/33718).
- Fixed an issue in Angular component testing where multiple projects in a monorepo sharing the same directory basename (e.g. `libs/feature-a/feat-shell` and `libs/feature-b/feat-shell`) would intermittently fail with spec-resolution errors when run in parallel. The temporary `tsconfig.json` generated by `@cypress/webpack-dev-server` was keyed only on the directory basename, so parallel runs would race on the same file. The temp directory is now suffixed with a short hash of the full project root path, giving each project its own isolated config. Fixes [#33634](https://github.com/cypress-io/cypress/issues/33634).
- Fixed a race during `cypress open` config reload where rapid changes to `cypress.config.js` could leave the specs list stale. Two overlapping config-reload calls would tear down each other's IPC child processes (surfacing as `ERR_STREAM_DESTROYED`), causing both reloads to fail and the specs list to never refresh. Fixed in [#33775](https://github.com/cypress-io/cypress/pull/33775).
- Fixed an issue where a transient Firefox launch failure caused Cypress to exit instead of retrying the browser launch. Fixed in [#33770](https://github.com/cypress-io/cypress/pull/33770).

**Dependency Updates:**

- Upgraded `socket.io` from `4.0.1` to `4.8.3`, `socket.io-client` from `4.0.1` to `4.8.3`, and `socket.io-parser` from `4.0.5` to `4.2.6` to address a [Denial of Service](https://github.com/advisories/GHSA-677m-j7p3-52f9) vulnerability reported in security scans. The `engine.io`, `engine.io-client`, and `engine.io-parser` direct deps in `@packages/socket` were also bumped to keep transitive copies aligned and the existing browser-side patches applied. Addressed in [#33719](https://github.com/cypress-io/cypress/pull/3371

_[Truncated at 4000 characters — full notes: https://github.com/cypress-io/cypress/releases/tag/v15.15.0]_

### v15.14.2

- Date: 2026-04-29
- Version: v15.14.2
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.14.2
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.14.2

- **fixed** — Reduced main-thread overhead when scrolling the command log in cypress open by fixing an issue where the reporter could register more than one scroll listener on the log if its scroll container was set more than once
- **fixed** — Fixed an issue where cy.wait on multiple aliases could surface an unhandled Cannot read properties of undefined (reading 'routeId') rejection when a retry short-circuited during runnable teardown
- **fixed** — Fixed an issue where an application under test containing <base target="_top"> or <base target="_parent"> would navigate out of the Cypress iframe when untargeted links were clicked or forms were submitted; the unsafe target is now stripped from <base> tags as part of the modifyObstructiveCode rewriting
- **fixed** — Fixed a race during cypress open config reload where the internal HTTP server would begin accepting requests before the primary remote state had been initialized, occasionally crashing in-flight browser requests on an empty remoteStates map
- **security** — Upgraded simple-git from 3.33.0 to 3.36.0 to address a Remote Code Execution vulnerability

**Performance:**

- Reduced main-thread overhead when scrolling the command log in `cypress open` by fixing an issue where the reporter could register more than one `scroll` listener on the log if its scroll container was set more than once. Addressed in [#33607](https://github.com/cypress-io/cypress/pull/33607).

**Bugfixes:**

- Fixed an issue where `cy.wait` on multiple aliases could surface an unhandled `Cannot read properties of undefined (reading 'routeId')` rejection when a retry short-circuited during runnable teardown. Fixed in [#33651](https://github.com/cypress-io/cypress/pull/33651).
- Fixed an issue where an application under test containing `<base target="_top">` or `<base target="_parent">` would navigate out of the Cypress iframe when untargeted links were clicked or forms were submitted, breaking the test run. The unsafe `target` is now stripped from `<base>` tags as part of the existing `modifyObstructiveCode` rewriting (enabled by default for the primary super-domain, and extendable to third-party origins with `experimentalModifyObstructiveThirdPartyCode`). A runtime guard also neutralizes any `<base>` inserted or modified after load, matching the always-on behavior of the existing `<a>` / `<form>` target guards. Fixed in [#33667](https://github.com/cypress-io/cypress/pull/33667).
- Fixed a race during `cypress open` config reload where the internal HTTP server would begin accepting requests before the primary remote state had been initialized, occasionally crashing in-flight browser requests (iframe loads) on an empty `remoteStates` map. Fixed in [#33686](https://github.com/cypress-io/cypress/pull/33686).

**Dependency Updates:**

- Upgraded `cachedir` from `^2.3.0` to `^2.4.0`. Addressed in [#33608](https://github.com/cypress-io/cypress/pull/33608).
- Upgraded `listr2` from `3.8.3` to `^9.0.5`. Addressed in [#33640](https://github.com/cypress-io/cypress/pull/33640).
- Upgraded `simple-git` from `3.33.0` to `3.36.0` to address a [Remote Code Execution](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078) vulnerability reported in security scans. Addressed in [#33680](https://github.com/cypress-io/cypress/pull/33680).
- Upgraded `ts-loader` from `9.5.2` to `9.5.7`. Addresses [#33648](https://github.com/cypress-io/cypress/issues/33648). Addressed in [#33691](https://github.com/cypress-io/cypress/pull/33691)
- Upgraded `@cypress/request` from `^3.0.10` to `^4.0.0`. Addresses [#33668](https://github.com/cypress-io/cypress/issues/33668). Addressed in [#33712](https://github.com/cypress-io/cypress/pull/33712)

### v15.14.1

- Date: 2026-04-21
- Version: v15.14.1
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.14.1
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.14.1

- **fixed** — Fixed a memory leak in cypress open where each spec rerun accumulated an additional uncaughtException listener, preventing the previous Mocha runner and all retained objects from being garbage collected
- **fixed** — Increased the limit for decrypted payloads to support large cy.prompt requests and responses
- **fixed** — Fixed a race condition in @cypress/vite-dev-server where the Cypress iframe could attempt to import the support file before Vite had finished serving it, causing intermittent Failed to fetch dynamically imported module errors in component tests

**Performance:**

- Fixed a memory leak in `cypress open` where each spec rerun accumulated an additional `uncaughtException` listener, preventing the previous Mocha runner — and all the objects it retained (commands, snapshots, logs) — from being garbage collected. Fixed in [#33631](https://github.com/cypress-io/cypress/pull/33631).

**Bugfixes:**

 - Increased the limit for decrypted payloads to support large `cy.prompt` requests and responses. Fixed in [#33619](https://github.com/cypress-io/cypress/pull/33619).
 - Fixed a race condition in `@cypress/vite-dev-server` where the Cypress iframe could attempt to import the support file before Vite had finished serving it, causing intermittent "Failed to fetch dynamically imported module" errors in component tests. The dev server now waits until the support file URL returns a successful response before signaling that it is ready. Addressed in [#33487](https://github.com/cypress-io/cypress/pull/33487).

### v15.14.0

- Date: 2026-04-16
- Version: v15.14.0
- Original notes: https://github.com/cypress-io/cypress/releases/tag/v15.14.0
- Permalink: https://whatsnew.fyi/product/cypress/releases/v15.14.0

- **changed** — Reduce browser memory growth during long interactive runs by clearing stored command log data once tests age out of numTestsKeptInMemory
- **added** — Official support for TypeScript 6
- **added** — Vite 8 support for component testing
- **fixed** — Fixed an issue where Cypress tests in open mode would not pick up on modified env values in the user's config file
- **fixed** — Fixed an issue where cy.wrap would not preserve a custom onFail handler when wrapping a rejected promise
- **security** — Upgraded axios to 1.15.0 to address CVE-2025-62718 and CVE-2026-40175 vulnerabilities

**Performance:**

- Reduced browser memory growth during long interactive runs by clearing stored command log data (messages, URLs, snapshots, console props, and other fields—including custom `Cypress.log` properties) once tests age out of `numTestsKeptInMemory`, so the runner can reclaim memory and stay more responsive. Addressed in [#33601](https://github.com/cypress-io/cypress/pull/33601).

**Features:**

- Cypress now officially supports TypeScript 6. Addresses [#33385](https://github.com/cypress-io/cypress/issues/33385) and [#33511](https://github.com/cypress-io/cypress/issues/33511).
- Adds Vite 8 support for component testing. Addresses [#32550](https://github.com/cypress-io/cypress/issues/32550) and [#33078](https://github.com/cypress-io/cypress/issues/33078).

**Bugfixes:**

- Fixed an issue where Cypress tests in open mode would not pick up on modified `env` values in the user's config file. Fixed in [#33567](https://github.com/cypress-io/cypress/pull/33567). Fixes [#33372](https://github.com/cypress-io/cypress/issues/33372).
- Fixed an issue where `cy.wrap` would not preserve a custom `onFail` handler when wrapping a rejected promise. Fixed in [#33570](https://github.com/cypress-io/cypress/pull/33570).

**Dependency Updates:**

- Upgraded `axios` to `1.15.0` to address [CVE-2025-62718](https://www.cve.org/CVERecord?id=CVE-2025-62718) and [CVE-2026-40175](https://www.cve.org/CVERecord?id=CVE-2026-40175) vulnerabilities reported in security scans. Fixes [#33590](https://github.com/cypress-io/cypress/issues/33590).