Cypress v15.17.0

Performance:

• The Command Log no longer becomes progressively unresponsive when moving the mouse in and out of a test's command list during long tests. Hovering over the command area previously triggered a style recalculation across the entire list of commands, causing a delay that grew with the number of commands logged. Fixes #33179.
• Fixed a memory leak where runs with screenshotOnRunFailure enabled slowed down progressively, as each failure screenshot was retained in memory for the rest of the run. Fixes #33516.

Features:

• Added Bun as a recognized package manager. The cypress npm package can now be installed and invoked with Bun (for example bun run cypress open or bun run cypress run). Addresses #28962. Addressed in #32580.
• Cypress.expose() values can now be overridden per suite or test via test config overrides (for example, describe(), context(), it(), or test()) using { expose: { key: value } }. Suite- and test-level overrides are merged, with test-level keys taking precedence; override keys are applied at test start and restored after each test without affecting unrelated values set in hooks. Addresses #33356. Addressed in #33925.
• When signing up to Cypress Cloud from the Cypress desktop app, if a project is auto-provisioned during signup, Cypress now automatically writes the projectId to the cypress.config file. If the file cannot be written, a modal is shown with the project ID as a copyable snippet and a link to open the config file directly in your IDE. Addressed in #33976.
• Improved CI environment detection and commit metadata capture for Cypress Cloud recorded runs within Argo CD and Argo Workflows. Addressed in #33932.

Bugfixes:

• Video recording no longer silently fails on Firefox 93+, where it previously produced no video and ended with a We failed processing this video or operation timed out warning. Fixes #18415. Fixed in #33960.
• Fixed an issue where, in the Electron browser, navigating away from a page whose beforeunload handler requested a confirmation prompt (for example window.onbeforeunload = () => 'message' or a beforeunload listener that sets event.returnValue) would hang and eventually fail the command with a page load timeout. Such navigations — including cy.visit(), cy.reload(), and clicking links — now proceed automatically without the confirmation prompt blocking the test, matching the behavior in Chrome. Fixes #2118.
• Fixed an issue where config.isInteractive was always true in the config passed to the plugins / setupNodeEvents function, even during cypress run. The value is now correctly false in run mode and true in open mode, so plugins can reliably distinguish between the two. Fixes #20789.
• Fixed an issue where component tests, and end-to-end tests using a local baseUrl, could fail to start with Cypress could not verify that this server is running when an HTTP_PROXY environment variable was set. Local hosts excluded from the proxy via NO_PROXY (such as localhost, 127.0.0.1, and ::1, which includes the component testing dev server) are now verified with a direct connection instead of being routed through the proxy. Fixes #27990.
• Fixed an issue where cy.wait('@alias') could time out when the connection to the browser closed before an aliased intercepted request's response completed, including during navigation such as cy.visit(). Fixes #19326.
• Fixed an issue where cy.request() with a FormData body failed to upload when a Content-Type header was provided with non-lowercase casing (for example 'Content-Type': 'multipart/form-data'). Cypress now correctly replaces the user-provided header with the generated multipart/form-data boundary instead of sending two conflicting content-type headers, which previously caused the server to reject the request with a 400 or empty body. Fixes #21173.
• Fixed an issue where Cypress could load the config file through the wrong module system (for example, treating an ESM config as CommonJS), so ESM-only APIs such as import.meta.resolve were unavailable in config and plugin code. Cypress now picks ESM or CJS before loading, using Node.js rules from the config file extension and the nearest package.json "type", then loads only via import() or require() and fails outright on error instead of retrying the other format:
  • .mjs and .mts always load as ESM
  • .cjs and .cts always load as CJS
  • .js and .ts load as ESM when the nearest package.json has "type": "module"; CJS is loaded otherwise Fixes #33801. Addresses #33892.
• Fixed an issue where a recorded Chrome or Electron run could hang for the duration of the spec timeout when the renderer crashed mid-spec, instead of failing the affected spec and continuing. Fixed in #33943.
• Fixed an issue where tests in Chrome and Electron could fail when the application made cross-origin requests to local or private network addresses (for example, a login or OAuth flow that redirects between local development hosts). Chrome 141 began enforcing Local Network Access checks that gate such requests behind a permission prompt the automated browser cannot answer. Cypress now opts out of these checks so these requests succeed as they did in Chrome 140. Fixes #32708.
• Fixed an issue where, after a same-origin fetch or XHR request updated a cookie, a subsequent page navigation or reload could send the previous (stale) cookie value to the server instead of the updated one. Fixes #25841.
• Fixed an issue where a cross-origin navigation back to a previously-visited origin (for example, completing a login that redirects from an identity provider back to your application) could intermittently load the Cypress app interface instead of your application, causing flaky tests. Fixed in #33991.
• Fixed an issue where a cy.origin() test could intermittently fail with The command was expected to run against origin <x> but the application is at origin <y> when a navigation (such as a login redirect) ran on the primary origin shortly after the runner switched super-domains. A stale internal __cypress.unload cookie could cause the proxy to redirect the navigation back to the Cypress runner instead of serving it; the cookie is now cleared whenever the application document is (re)served. Fixed in #34020.
• Fixed an issue where setting a request or response header to an empty string in a cy.intercept() handler (for example req.headers['x-foo'] = '') would report the header as set on the intercepted request while silently dropping it from the request sent over the network. Empty-string header values are now preserved; headers are only removed when deleted or set to undefined. Fixes #25767.
• Fixed an issue where runs recorded to Cypress Cloud from Jenkins could show the branch name with the remote prefix included (for example origin/main instead of main), or report the wrong branch in multibranch pipelines. Cypress now reports the actual branch name. Fixes #20833.
• Fixed an issue where invalid CYPRESS_env or CYPRESS_expose environment variables (for example, a plain string instead of a JSON object) were silently ignored with no warning. Cypress now emits a warning explaining that a JSON object is required and points to the --env or --expose CLI flags for setting individual values. Fixes #29682 and #19508. Fixed in #33945.
• Fixed an issue where cypress run could crash with TypeError: The "path" argument must be of type string. Received undefined when the project path was not resolved (for example, due to an unset CI environment variable) or when --browser was passed without a value. Cypress now falls back to the current working directory in the first case and emits a clear "browser not found" error in the second. Fixes #15418. Fixed in #33958.
• Fixed an issue where HTML markup passed as a Sinon spy argument (for example expect(spy).to.have.been.calledOnceWith('<svg>...</svg>')) was rendered as live DOM in the Cypress command log, truncating the assertion message and breaking the log layout. The assertion message is now HTML-escaped and the markup is shown as literal text. Fixes #33416. Fixed in #33941.
• Fixed a regression in 14.4.0 where Cypress incorrectly logged Warning: We failed to trash the existing run results. on Windows when the Recycle Bin is configured with "Don't move files to the Recycle Bin. Remove files immediately when deleted.", even though the assets were actually removed. Fixes #32691.
• Fixed an issue where a test or attempt that had not reached a terminal state (for example, after an interrupted or crashed run) could be reported to Cypress Cloud with an internal, display-only processing state that the Cloud rejects. Such in-flight states are now reported as pending. Fixes #27956.
• Fixed an issue where the version of WebKit was incorrectly displayed as version 0 when playwright version 1.60.0 was installed. Fixes #33953.
• Fixed an issue where clicking a cy.origin command in the Command Log to print its details to the console threw an error when the callback yielded a value that could not be serialized across origins (for example, the page's window after a cy.visit). The command now prints its origin, arguments, and yielded subject to the console without erroring; an unserializable yielded subject is shown by its type instead of throwing. Fixes #27385. Fixed in #33983. …