diff --git a/.circleci/cache-version.txt b/.circleci/cache-version.txt index 3c935875a61..86c2d6c2a7a 100644 --- a/.circleci/cache-version.txt +++ b/.circleci/cache-version.txt @@ -1,2 +1,2 @@ # Bump this version to force CI to re-create the cache from scratch. -12-17-2025 +01-05-2026 diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md index 189d61f3535..3b48d041305 100644 --- a/cli/CHANGELOG.md +++ b/cli/CHANGELOG.md @@ -8,6 +8,10 @@ _Released 12/30/2025 (PENDING)_ - Fixed an issue where the ffprobe path was not properly configured for video operations. The path is now set at module load time, ensuring it's available for all video operations. Upgraded `@ffprobe-installer/ffprobe` from `1.1.0` to `2.1.2` to support darwin-arm64 (Apple Silicon). Addressed in [#33136](https://github.com/cypress-io/cypress/pull/33136). - Fixed an issue where `test:after:run` and `test:after:run:async` events were not firing after both a `before all` and `after all` hook failed. Addressed in [#33172](https://github.com/cypress-io/cypress/pull/33172). +**Dependency Updates:** + +- Upgraded `@cypress/request` to `3.0.10`. This removes the [CVE-2025-15284](https://security.snyk.io/vuln/SNYK-JS-QS-14724253) vulnerability being reported in security scans. Addressed in [#33188](https://github.com/cypress-io/cypress/pull/33188). + ## 15.8.1 _Released 12/18/2025_ diff --git a/cli/package.json b/cli/package.json index 1444185ec20..f84e2aee79e 100644 --- a/cli/package.json +++ b/cli/package.json @@ -17,7 +17,7 @@ "types": "yarn dtslint" }, "dependencies": { - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/xvfb": "^1.2.4", "@types/sinonjs__fake-timers": "8.1.1", "@types/sizzle": "^2.3.2", diff --git a/package.json b/package.json index 3f53a2c11ed..1b87356a4ab 100644 --- a/package.json +++ b/package.json @@ -79,7 +79,7 @@ "@aws-sdk/client-s3": "3.485.0", "@aws-sdk/credential-providers": "3.53.0", "@babel/eslint-parser": "7.28.0", - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/request-promise": "^5.0.0", "@electron/fuses": "1.8.0", "@electron/notarize": "^2.5.0", diff --git a/packages/https-proxy/package.json b/packages/https-proxy/package.json index ad626cd4b84..368395c7b0f 100644 --- a/packages/https-proxy/package.json +++ b/packages/https-proxy/package.json @@ -26,7 +26,7 @@ }, "devDependencies": { "@cypress/debugging-proxy": "2.0.1", - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/request-promise": "^5.0.0", "@packages/network": "0.0.0-development", "@types/semaphore": "1.1.4", diff --git a/packages/network/package.json b/packages/network/package.json index 41f1defabb1..d03f6d618b7 100644 --- a/packages/network/package.json +++ b/packages/network/package.json @@ -30,7 +30,7 @@ }, "devDependencies": { "@cypress/debugging-proxy": "2.0.1", - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/request-promise": "^5.0.0", "@packages/network-tools": "0.0.0-development", "@packages/socket": "0.0.0-development", diff --git a/packages/proxy/package.json b/packages/proxy/package.json index bc063ec31a0..9ad2cca198d 100644 --- a/packages/proxy/package.json +++ b/packages/proxy/package.json @@ -30,7 +30,7 @@ "utf8-stream": "0.0.0" }, "devDependencies": { - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/request-promise": "^5.0.0", "@cypress/sinon-chai": "2.9.1", "@packages/errors": "0.0.0-development", diff --git a/packages/server/package.json b/packages/server/package.json index b78ecc337e0..1d5fff8e8ca 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -23,7 +23,7 @@ "@babel/parser": "7.28.0", "@cypress/commit-info": "2.2.0", "@cypress/get-windows-proxy": "1.6.3", - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/request-promise": "^5.0.0", "@cypress/vite-dev-server": "0.0.0-development", "@cypress/webpack-batteries-included-preprocessor": "0.0.0-development", diff --git a/system-tests/package.json b/system-tests/package.json index accbbe5d016..c645fe0684c 100644 --- a/system-tests/package.json +++ b/system-tests/package.json @@ -23,7 +23,7 @@ "@babel/preset-env": "7.28.0", "@cypress/commit-info": "2.2.0", "@cypress/debugging-proxy": "2.0.1", - "@cypress/request": "^3.0.9", + "@cypress/request": "^3.0.10", "@cypress/request-promise": "^5.0.0", "@cypress/sinon-chai": "2.9.1", "@cypress/webpack-preprocessor": "0.0.0-development", diff --git a/yarn.lock b/yarn.lock index b8ac73fd8bf..c4a639104c4 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2766,10 +2766,10 @@ stealthy-require "^1.1.1" tough-cookie "^4.1.3" -"@cypress/request@^3.0.9": - version "3.0.9" - resolved "https://registry.yarnpkg.com/@cypress/request/-/request-3.0.9.tgz#8ed6e08fea0c62998b5552301023af7268f11625" - integrity sha512-I3l7FdGRXluAS44/0NguwWlO83J18p0vlr2FYHrJkWdNYhgVoiYo61IXPqaOsL+vNxU1ZqMACzItGK3/KKDsdw== +"@cypress/request@^3.0.10": + version "3.0.10" + resolved "https://registry.yarnpkg.com/@cypress/request/-/request-3.0.10.tgz#e09c695e8460a82acafe6cfaf089cf2ca06dc054" + integrity sha512-hauBrOdvu08vOsagkZ/Aju5XuiZx6ldsLfByg1htFeldhex+PeMrYauANzFsMJeAA0+dyPLbDoX2OYuvVoLDkQ== dependencies: aws-sign2 "~0.7.0" aws4 "^1.8.0" @@ -2784,7 +2784,7 @@ json-stringify-safe "~5.0.1" mime-types "~2.1.19" performance-now "^2.1.0" - qs "6.14.0" + qs "~6.14.1" safe-buffer "^5.1.2" tough-cookie "^5.0.0" tunnel-agent "^0.6.0" @@ -26616,10 +26616,10 @@ qs@6.13.0: dependencies: side-channel "^1.0.6" -qs@6.14.0, qs@^6.11.0, qs@^6.4.0, qs@^6.5.1, qs@^6.9.4: - version "6.14.0" - resolved "https://registry.yarnpkg.com/qs/-/qs-6.14.0.tgz#c63fa40680d2c5c941412a0e899c89af60c0a930" - integrity sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w== +qs@^6.11.0, qs@^6.4.0, qs@^6.5.1, qs@^6.9.4, qs@~6.14.1: + version "6.14.1" + resolved "https://registry.yarnpkg.com/qs/-/qs-6.14.1.tgz#a41d85b9d3902f31d27861790506294881871159" + integrity sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ== dependencies: side-channel "^1.1.0"