Cypress v15.15.0

Deprecations:

• The cy.end() command has been deprecated and will be removed in a future release. Instead of using .end() to break a chain, start a new chain of commands off of cy. Addressed in #33707.

Bugfixes:

• Fixed an issue where the proxy stripped Content-Length: 0 from empty responses (e.g. a DELETE 200 with no body) and the resulting empty body was re-emitted with Transfer-Encoding: chunked, breaking clients that assume a fixed-length response. Partially addresses #16469. Fixed in #33754.
• Fixed an issue where component specs that defined local React components could register every describe / it block twice in cypress open when using Vite 8, because React refresh treated those specs as HMR self-accepting modules. @cypress/vite-dev-server now excludes component spec files from JSX refresh while leaving Fast Refresh enabled for application source. Fixes #33750.
• Fixed an issue where multi-origin tests using cy.origin could fail to talk to a secondary origin after test isolation, when the spec-bridge iframe was already present, or when more than one secondary origin became ready around the same time. Cached spec-bridge window targets are now cleared at the correct lifecycle points, improving performance of specs with cy.origin calls. Addressed in #33704.
• Fixed an issue where a CSS selector built internally from element attributes could throw an uncaught Syntax error, unrecognized expression and crash the runner when an attribute value contained CSS-special characters (for example, an <input> with a pattern attribute containing regex metacharacters). Fixes #26967 and #29345.
• Fixed an issue where transient HTTP 500 responses from Cypress Cloud were not retried for idempotent requests. Fixed in #33718.
• Fixed an issue in Angular component testing where multiple projects in a monorepo sharing the same directory basename (e.g. libs/feature-a/feat-shell and libs/feature-b/feat-shell) would intermittently fail with spec-resolution errors when run in parallel. The temporary tsconfig.json generated by @cypress/webpack-dev-server was keyed only on the directory basename, so parallel runs would race on the same file. The temp directory is now suffixed with a short hash of the full project root path, giving each project its own isolated config. Fixes #33634.
• Fixed a race during cypress open config reload where rapid changes to cypress.config.js could leave the specs list stale. Two overlapping config-reload calls would tear down each other's IPC child processes (surfacing as ERR_STREAM_DESTROYED), causing both reloads to fail and the specs list to never refresh. Fixed in #33775.
• Fixed an issue where a transient Firefox launch failure caused Cypress to exit instead of retrying the browser launch. Fixed in #33770.

Dependency Updates:

• Upgraded socket.io from 4.0.1 to 4.8.3, socket.io-client from 4.0.1 to 4.8.3, and socket.io-parser from 4.0.5 to 4.2.6 to address a Denial of Service vulnerability reported in security scans. The engine.io, engine.io-client, and engine.io-parser direct deps in @packages/socket were also bumped to keep transitive copies aligned and the existing browser-side patches applied. Addressed in #33719.
• Upgraded uuid from 8.3.2 to 11.1.1 to address an Improper Validation of Specified Index, Position, or Offset in Input vulnerability reported in security scans. Addressed in #33765.