What cypress-io/cypress shipped
Written by FoxPlug from the repository's own releases; not affiliated with Cypress. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/cypress-io/cypress; Cypress did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Added a built-in cy.getByRole() query for finding elements by ARIA role and accessible name without a third-party package. Pull request #34937
- Client certificates are now presented on the browser network path, so mutual TLS can be negotiated for requests. Pull request #34904
- Cy.go() now waits for the page it navigates to before resolving and enforces its timeout and page load timeout options. Pull request #34938
- Cy.get() on an intercept alias index of 0 now fails immediately instead of waiting out the full command timeout. Pull request #34936
- Fixed a crash when decorating an error whose message is a getter-only accessor, such as DOMException. Pull request #34821
- Cypress run no longer writes lastBrowser to the global user cache, so run mode stops changing what open mode preselects. Pull request #34924
- Video chapter timestamps are now aligned with the first captured frame. Pull request #35018
- A query called directly off cy, such as cy.eq, now reports a clear error about not being chained off a subject. Pull request #35024
- When writing the prompt or Studio bundle to the default directory fails, Cypress retries once in a tmp directory. Pull request #35013
- Stderr lines from the config process are kept when consecutive writes are read together. Pull request #35022
Why it matters
This week brought a new built-in cy.getByRole() query and client certificate support on the browser network path, both of which remove work users previously had to do themselves. Navigation and query behavior got more predictable, with cy.go() waiting for the page it loads and alias index errors failing fast instead of burning the timeout. Several flaky test and tooling fixes landed alongside, including removing the last mocha unit tests from the server package.
Changelog entry
- Added a built-in cy.getByRole() query for finding elements by ARIA role and accessible name. Pull request #34937
- Client certificates are now presented on the browser network path. Pull request #34904
- Cy.go() now waits for the page it navigates to before resolving. Pull request #34938
- Cy.get() on an intercept alias index of 0 now fails without waiting out the command timeout. Pull request #34936
- Fixed a crash when decorating an error with a getter-only message, such as DOMException. Pull request #34821
- Cypress run no longer writes lastBrowser to the user cache, so it no longer changes what cypress open preselects. Pull request #34924
- Video chapter timestamps are now aligned with the first captured frame. Pull request #35018
- Calling a query that needs a subject directly off cy, such as cy.eq, now reports a clear error. Pull request #35024
- When writing the prompt or Studio bundle to the default directory fails, Cypress now retries once in a tmp directory. Pull request #35013
- Stderr lines from the config process are now kept when consecutive writes are read together. Pull request #35022
- Released @cypress/webpack-dev-server v6.1.0. Release
- Stopped passing spec file names to execa in GitDataSource. Pull request #35011
Cy.getByRole() is now built in. This week also brought client certificates on the browser network path, cy.go() waiting for the page it loads, and faster alias index errors.
This week in Cypress: a built-in cy.getByRole() query is now available, so finding elements by ARIA role and accessible name no longer requires a third-party package. Client certificates are now presented on the browser network path, enabling mutual TLS for requests. cy.go() now waits for the page it navigates to before resolving and enforces its timeout options, cy.get() on an intercept alias index of 0 fails without waiting out the command timeout, error decoration no longer crashes on getter-only messages, and cypress run no longer writes lastBrowser to the user cache. On the tooling side, the last @packages/server unit tests moved to vitest.
Week of September 28, 2026
What shipped
- Released Cypress v16.1.1. Release
- Fixed cookie jar synchronization when cookies are set outside the proxy via cy.request() or cy.setCookie(). Pull request #34894
- Updated axios to 1.20.0 to address CVE-2026-44494 and related security advisories. Pull request #34918
- Upgraded shell-quote and simple-git to fix five critical Snyk security advisories. Pull request #34960
- Corrected cy.location() type signature to match the plain object it actually yields instead of the browser DOM Location type. Pull request #34956
- Optimized shadow-aware.closest() from quadratic to linear performance on large shadow DOM subjects. Pull request #34925
- Fixed cy.contains() to display as a parent command in the Command Log when it starts a chain. Pull request #34939
- Refactored electron import in cloud auth to load only when needed during interactive login flow. Pull request #34946
- Fixed type reference casing in @cypress/puppeteer to resolve types correctly on case-sensitive file systems. Pull request #34954
- Fixed a flaky component test in the InlineRunAllSpecs tooltip. Pull request #34972
Why it matters
Version 16.1.1 ships critical security updates for axios, shell-quote, and simple-git, plus a cookie synchronization fix that affects request handling and a performance improvement for shadow DOM traversal. Type corrections and test stability improvements round out the release.
Changelog entry
- V16.1.1 released Release
- Fixed cookie jar synchronization when cookies are set outside the proxy via cy.request() or cy.setCookie() Pull request #34894
- Updated axios to 1.20.0 to address CVE-2026-44494 Pull request #34918
- Upgraded shell-quote to 1.11.0 and simple-git for critical security advisories Pull request #34960
- Corrected cy.location() type to reflect plain object yielded at runtime Pull request #34956
- Optimized shadow-aware.closest() to linear time complexity Pull request #34925
- Fixed cy.contains() display in Command Log as parent command when starting a chain Pull request #34939
- Made electron require lazy in cloud auth module Pull request #34946
- Fixed type reference casing in @cypress/puppeteer for case-sensitive file systems Pull request #34954
Cypress 16.1.1 is out with security updates for axios, shell-quote, and simple-git; fixes for cookie sync and cy.location() typing; and better shadow DOM performance.
Cypress 16.1.1 is now available. This release includes critical security updates for axios, shell-quote, and simple-git to address vulnerabilities. We've also fixed cookie jar synchronization when cookies are set via cy.request() and cy.setCookie(), corrected the cy.location() type signature, and optimized shadow-aware DOM traversal from quadratic to linear performance.
Week of September 21, 2026
What shipped
- Fixed cy.clock() to fake cancelIdleCallback alongside requestIdleCallback, preventing timer ID mismatches when apps use idle callbacks. Pull request #34926
- Fixed three bugs in @cypress/puppeteer: connection leaks on refocus failure, falsy rejection reporting, and retry timeout handling. Pull request #34907
- Fixed the
cross_origin_commanderror to show the injectDocumentDomain hint when it should appear. Pull request #34930 - Improved.each() and.spread() error messages to name the running command accurately and typed.each()'s third argument as the jQuery collection. Pull request #34933
- Corrected cy.clear()'s invalid element error to describe which elements it actually accepts instead of listing focusable elements. Pull request #34914
- Fixed type definitions to document the correct default value for the multiple option in.dblclick(). Pull request #34929
- Updated cy.clock() types to accept all function names that @sinonjs/fake-timers 14 supports and to accept null in the now parameter. Pull request #34912
- Added security testing guidance to SECURITY.md. Pull request #34923
- Enabled path filtering on develop branch merges to skip unnecessary CI jobs. Pull request #34817
- Switched PR jobs to expression-based filtering so path-filtered jobs are never scheduled instead of being disabled after startup. Pull request #34866
Why it matters
This week's fixes target accuracy in error messages, type definitions, and timer behavior so developers get truthful feedback and type safety. CI improvements reduce unnecessary job scheduling on develop and pull requests, speeding up feedback. The puppeteer fixes eliminate connection leaks and improve error reporting in browser automation.
Changelog entry
- Fixed cy.clock() to fake cancelIdleCallback alongside requestIdleCallback Pull request #34926
- Fixed @cypress/puppeteer connection leaks, falsy rejection reporting, and retry timeout handling Pull request #34907
- Fixed
cross_origin_commanderror to show injectDocumentDomain hint Pull request #34930 - Improved.each() and.spread() error messages and typed.each()'s third argument Pull request #34933
- Corrected cy.clear() invalid element error to list clearable elements Pull request #34914
- Fixed.dblclick() type definition for multiple option default Pull request #34929
- Updated cy.clock() types to accept all @sinonjs/fake-timers function names and null Pull request #34912
- Added security testing guidance to SECURITY.md Pull request #34923
- Enabled path filtering on develop branch to skip unnecessary CI jobs Pull request #34817
- Switched to expression-based job filters to prevent scheduling of path-filtered PR jobs Pull request #34866
This week: fixed cy.clock() timer bugs, improved error messages to say what actually ran, corrected type definitions, and made CI skip unnecessary jobs on develop and PRs.
This week in Cypress: we fixed cy.clock() to properly fake cancelIdleCallback, patched puppeteer connection leaks, improved error messages to describe what actually ran, corrected type definitions for better IDE support, and optimized CI so develop and PR builds skip unnecessary jobs. Smaller fixes, faster feedback.