Files
overleaf-cep/services/web/test/frontend/features/file-tree
Lucie GermainandClaude Sonnet 5 57e536de79 [Security Upgrade]: cypress in root workspace (drops unpatched extract-zip) (#36689)
* [security] bump cypress 15.12.0 -> 15.20.1 to drop unpatched extract-zip

extract-zip <=2.0.1 has no patched release (GHSA-jmr9-qjv8-65gv). It was a
transitive dependency of cypress, used only to unpack Cypress's own binary.
Cypress 15.20.1 replaces extract-zip with yauzl directly, so upgrading the
parent removes the vulnerable package entirely.

Also bumps the pinned cypress/included Docker base image used by
test_frontend_ct / server-ce e2e / saas-e2e.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* [security] fix cy.get<T> alias typing broken by cypress 15.20.1

Cypress 15.20.1 adds a dedicated Chainable.get overload for alias strings
(get<S>(alias: `@${string}`): Chainable<S>), which now takes priority over
the generic selector overload. cy.get<HTMLInputElement>('@input') therefore
resolved to Chainable<HTMLInputElement> instead of
Chainable<JQuery<HTMLInputElement>>, so .then(element => element.get(0))
no longer type-checked. Pass the JQuery-wrapped type explicitly to match
the new overload.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
GitOrigin-RevId: f4a56a2d5948b5aaf00a07ecb384fc75abf6de53
2026-09-17 11:59:44 +00:00
..