cypress 15.15.0 → 15.16.0

package/dist/bin/cypress

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 'use strict';
 
-var cli = require('../cli-CQHngRhO.js');
-require('../xvfb-Csr_YzMk.js');
+var cli = require('../cli-B97CK6L9.js');
+require('../xvfb-SgoMy1_9.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -32,7 +32,7 @@ require('commander');
 require('cli-table3');
 require('dayjs');
 require('dayjs/plugin/relativeTime');
-require('../spawn-D9ARC26J.js');
+require('../spawn-BZQfzolX.js');
 require('child_process');
 require('listr2');
 require('readline');
@@ -45,7 +45,7 @@ require('@cypress/request');
 require('request-progress');
 require('proxy-from-env');
 require('yauzl');
-require('extract-zip');
+require('util');
 require('pretty-bytes');
 
 // declared here in order to avoid consumers who are looking for the binary to be available relative to the dist directory

package/dist/{cli-CQHngRhO.js → cli-B97CK6L9.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-SgoMy1_9.js');
 var _ = require('lodash');
 var commander = require('commander');
 var commonTags = require('common-tags');
@@ -13,18 +13,20 @@ var dayjs = require('dayjs');
 var relativeTime = require('dayjs/plugin/relativeTime');
 var chalk = require('chalk');
 var Bluebird = require('bluebird');
-var spawn = require('./spawn-D9ARC26J.js');
+var spawn = require('./spawn-BZQfzolX.js');
 var os = require('os');
 var listr2 = require('listr2');
 var timers = require('timers/promises');
-var promises = require('fs/promises');
+var fsp = require('fs/promises');
 var assert = require('assert');
 var request = require('@cypress/request');
 var requestProgress = require('request-progress');
 var proxyFromEnv = require('proxy-from-env');
 var cp = require('child_process');
 var yauzl = require('yauzl');
-var extract = require('extract-zip');
+var fs$1 = require('fs');
+var util = require('util');
+var require$$0 = require('stream');
 var readline = require('readline');
 var prettyBytes = require('pretty-bytes');
 
@@ -304,9 +306,154 @@ const downloadModule = {
     getCA,
 };
 
+const pipelineAsync = util.promisify(require$$0.pipeline);
+// Unix file mode masks for entries stored in zip's externalFileAttributes
+// (the high 16 bits when the file was zipped on a Unix host).
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFLNK = 0o120000;
+// PATH_MAX on Linux/macOS is 4096; symlink targets larger than this are not
+// legal filesystem paths and almost certainly indicate a malformed or
+// malicious archive. The cap also prevents reading an arbitrarily large
+// "symlink" entry into memory.
+const MAX_SYMLINK_TARGET_BYTES = 4096;
+/**
+ * Extracts the contents of a zip archive into the given destination directory.
+ * Recreates directories, regular files, and symlinks while preserving Unix
+ * file modes encoded in each entry's external attributes. Calls `onEntry` once
+ * per archive entry processed. Refuses entries whose resolved path would
+ * escape the destination directory.
+ */
+const extractWithYauzl = (zipFilePath, destDir, onEntry) => xvfb.__awaiter(void 0, void 0, void 0, function* () {
+    const resolvedDest = path.resolve(destDir);
+    yield new Promise((resolve, reject) => {
+        // autoClose: false — `finish` below owns closing the zipfile, so we don't
+        // want yauzl's internal end-listener closing it first and tripping a
+        // double-close (EBADF) when we do.
+        yauzl.open(zipFilePath, { lazyEntries: true, autoClose: false }, (err, zipFile) => {
+            if (err) {
+                return reject(err);
+            }
+            // `settled` guards against an in-flight `handleEntry` calling
+            // `zipFile.readEntry()` on a now-closed handle when extraction has
+            // already failed (e.g. yauzl emitted 'error' while we were writing
+            // an entry to disk).
+            let settled = false;
+            const finish = _.once((err) => {
+                var _a, _b;
+                settled = true;
+                (_a = zipFile.removeAllListeners) === null || _a === void 0 ? void 0 : _a.call(zipFile);
+                (_b = zipFile.close) === null || _b === void 0 ? void 0 : _b.call(zipFile);
+                if (err) {
+                    return reject(err);
+                }
+                return resolve();
+            });
+            // Normalize any thrown / emitted value into a real Error so that a
+            // falsy rejection (e.g. `Promise.reject(undefined)`) doesn't get
+            // misread by `finish` as a successful completion.
+            const fail = (err) => {
+                finish(err instanceof Error ? err : new Error(typeof err === 'string' && err ? err : 'zip extraction failed'));
+            };
+            zipFile.on('error', fail);
+            zipFile.on('end', () => finish());
+            zipFile.on('entry', (entry) => {
+                handleEntry(zipFile, entry, resolvedDest)
+                    .then(() => {
+                    if (settled)
+                        return;
+                    onEntry();
+                    zipFile.readEntry();
+                })
+                    .catch(fail);
+            });
+            zipFile.readEntry();
+        });
+    });
+});
+const handleEntry = (zipFile, entry, resolvedDest) => xvfb.__awaiter(void 0, void 0, void 0, function* () {
+    const fileDest = path.resolve(resolvedDest, entry.fileName);
+    // refuse anything that would write outside the install dir
+    if (fileDest !== resolvedDest &&
+        !fileDest.startsWith(resolvedDest + path.sep)) {
+        throw new Error(`Refusing to extract entry outside of destination: ${entry.fileName}`);
+    }
+    const unixMode = (entry.externalFileAttributes >>> 16) & 0xffff;
+    // Some archivers mark directories by Unix mode bits instead of (or in
+    // addition to) a trailing slash; honor both so we don't extract a
+    // directory entry as a zero-byte file.
+    const isDir = /\/$/.test(entry.fileName) || (unixMode & S_IFMT) === S_IFDIR;
+    const isSymlink = (unixMode & S_IFMT) === S_IFLNK;
+    if (isDir) {
+        yield fsp.mkdir(fileDest, { recursive: true });
+        return;
+    }
+    yield fsp.mkdir(path.dirname(fileDest), { recursive: true });
+    if (isSymlink) {
+        if (entry.uncompressedSize > MAX_SYMLINK_TARGET_BYTES) {
+            throw new Error(`Refusing to extract symlink with target larger than ${MAX_SYMLINK_TARGET_BYTES} bytes: ${entry.fileName}`);
+        }
+        const linkTarget = yield readEntryAsString(zipFile, entry, MAX_SYMLINK_TARGET_BYTES);
+        const resolvedTarget = path.resolve(path.dirname(fileDest), linkTarget);
+        if (resolvedTarget !== resolvedDest &&
+            !resolvedTarget.startsWith(resolvedDest + path.sep)) {
+            throw new Error(`Refusing to extract symlink pointing outside of destination: ${entry.fileName} -> ${linkTarget}`);
+        }
+        yield fsp.rm(fileDest, { recursive: true, force: true });
+        yield fsp.symlink(linkTarget, fileDest);
+        return;
+    }
+    const readStream = yield new Promise((res, rej) => {
+        zipFile.openReadStream(entry, (err, rs) => {
+            if (err) {
+                return rej(err);
+            }
+            return res(rs);
+        });
+    });
+    // Preserve the Unix mode bits when present; otherwise fall back to a sane default.
+    const fileMode = (unixMode & 0o7777) || 0o644;
+    const writeStream = fs$1.createWriteStream(fileDest, { mode: fileMode });
+    yield pipelineAsync(readStream, writeStream);
+});
+const readEntryAsString = (zipFile, entry, maxBytes) => {
+    return new Promise((resolve, reject) => {
+        zipFile.openReadStream(entry, (err, rs) => {
+            if (err) {
+                return reject(err);
+            }
+            const chunks = [];
+            let received = 0;
+            let bailed = false;
+            const bail = (err) => {
+                var _a;
+                if (bailed)
+                    return;
+                bailed = true;
+                (_a = rs.destroy) === null || _a === void 0 ? void 0 : _a.call(rs, err);
+                reject(err);
+            };
+            rs.on('data', (chunk) => {
+                received += chunk.length;
+                if (received > maxBytes) {
+                    bail(new Error(`Refusing to read entry body larger than ${maxBytes} bytes: ${entry.fileName}`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            rs.on('end', () => {
+                if (bailed)
+                    return;
+                resolve(Buffer.concat(chunks).toString('utf8'));
+            });
+            rs.on('error', bail);
+        });
+    });
+};
+
 const debug$5 = Debug('cypress:cli:unzip');
 const unzipTools = {
-    extract,
+    extractWithYauzl,
 };
 // expose this function for simple testing
 const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFilePath, installDir, progress }) {
@@ -319,7 +466,10 @@ const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFileP
     let yauzlDoneTime = 0;
     yield fs.ensureDir(installDir);
     yield new Promise((resolve, reject) => {
-        return yauzl.open(zipFilePath, (err, zipFile) => {
+        // Open with lazyEntries so yauzl doesn't auto-emit entries (which would
+        // require the fd to stay open for the duration of the OS-tool extraction).
+        // We only need the entryCount here for the progress calculation.
+        return yauzl.open(zipFilePath, { lazyEntries: true }, (err, zipFile) => {
             yauzlDoneTime = Date.now();
             if (err) {
                 debug$5('error using yauzl %s', err.message);
@@ -327,6 +477,8 @@ const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFileP
             }
             const total = zipFile.entryCount;
             debug$5('zipFile entries count', total);
+            // Close the count-only handle — the Node fallback re-opens the zip for extraction.
+            zipFile.close();
             const started = new Date();
             let percent = 0;
             let count = 0;
@@ -343,13 +495,8 @@ const unzip = (_a) => xvfb.__awaiter(void 0, [_a], void 0, function* ({ zipFileP
             };
             const unzipWithNode = () => xvfb.__awaiter(void 0, void 0, void 0, function* () {
                 debug$5('unzipping with node.js (slow)');
-                const opts = {
-                    dir: installDir,
-                    onEntry: tick,
-                };
-                debug$5('calling Node extract tool %s %o', zipFilePath, opts);
                 try {
-                    yield unzipTools.extract(zipFilePath, opts);
+                    yield unzipTools.extractWithYauzl(zipFilePath, installDir, tick);
                     debug$5('node unzip finished');
                     return resolve();
                 }
@@ -569,7 +716,7 @@ const start$1 = (...args_1) => xvfb.__awaiter(void 0, [...args_1], void 0, funct
     if (!pkgPath) {
         return xvfb.throwFormErrorText('Could not find package.json for Cypress package to determine build information')();
     }
-    const { buildInfo, version } = JSON.parse(yield promises.readFile(pkgPath, 'utf8'));
+    const { buildInfo, version } = JSON.parse(yield fsp.readFile(pkgPath, 'utf8'));
     _.defaults(options, {
         force: false,
         buildInfo,
@@ -673,9 +820,10 @@ const start$1 = (...args_1) => xvfb.__awaiter(void 0, [...args_1], void 0, funct
     // let the user know what version of cypress we're downloading!
     xvfb.loggerModule.log(`Installing Cypress ${chalk.gray(`(version: ${versionToInstall})`)}`);
     xvfb.loggerModule.log();
-    const taskRunner = new listr2.Listr(tasks, {
-        silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent',
-    });
+    const taskRunner = new listr2.Listr(tasks, Object.assign(Object.assign({ 
+        // In CI we want timestamped, line-per-event output. Locally,
+        // the default in-place spinner is the better experience.
+        renderer: xvfb.util.isCi() ? 'verbose' : 'default' }, (xvfb.util.isCi() && { rendererOptions: { timestamp: listr2.PRESET_TIMESTAMP } })), { silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent' }));
     yield taskRunner.run();
     // delay 1 sec for UX, unless we are testing
     yield timers.setTimeout(1000);
@@ -1083,6 +1231,8 @@ function getSize(path$1) {
 }
 
 dayjs.extend(relativeTime);
+// Subdirs under the cache root that are not binary version dirs.
+const EXTERNAL_CACHE_ENTRIES = new Set(['bundles']);
 // output colors for the table
 const colors = {
     titles: chalk.white,
@@ -1104,6 +1254,8 @@ const prune = () => xvfb.__awaiter(void 0, void 0, void 0, function* () {
     try {
         const versions = yield fs.readdir(cacheDir);
         for (const version of versions) {
+            if (EXTERNAL_CACHE_ENTRIES.has(version))
+                continue;
             if (version !== checkedInBinaryVersion) {
                 deletedBinary = true;
                 const versionDir = path.join(cacheDir, version);

package/dist/cli.js

@@ -2,14 +2,14 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-require('./xvfb-Csr_YzMk.js');
+require('./xvfb-SgoMy1_9.js');
 require('lodash');
 require('commander');
 require('common-tags');
 require('log-symbols');
 require('debug');
-var cli = require('./cli-CQHngRhO.js');
-require('./spawn-D9ARC26J.js');
+var cli = require('./cli-B97CK6L9.js');
+require('./spawn-BZQfzolX.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -42,10 +42,10 @@ require('request-progress');
 require('proxy-from-env');
 require('child_process');
 require('yauzl');
-require('extract-zip');
+require('util');
+require('stream');
 require('readline');
 require('pretty-bytes');
-require('stream');
 require('string_decoder');
 require('node:string_decoder');
 

package/dist/{cypress-BMOTlyGc.js → cypress-DuMyFGfr.js}

@@ -1,9 +1,9 @@
 'use strict';
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-SgoMy1_9.js');
 var tmp = require('tmp');
 var fs = require('fs-extra');
-var cli$1 = require('./cli-CQHngRhO.js');
+var cli$1 = require('./cli-B97CK6L9.js');
 
 /**
  * Opens Cypress GUI

package/dist/cypress.js

@@ -1,10 +1,10 @@
 'use strict';
 
-require('./xvfb-Csr_YzMk.js');
+require('./xvfb-SgoMy1_9.js');
 require('tmp');
 require('fs-extra');
-require('./cli-CQHngRhO.js');
-var cypress = require('./cypress-BMOTlyGc.js');
+require('./cli-B97CK6L9.js');
+var cypress = require('./cypress-DuMyFGfr.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -33,7 +33,7 @@ require('commander');
 require('cli-table3');
 require('dayjs');
 require('dayjs/plugin/relativeTime');
-require('./spawn-D9ARC26J.js');
+require('./spawn-BZQfzolX.js');
 require('child_process');
 require('listr2');
 require('readline');
@@ -46,7 +46,7 @@ require('@cypress/request');
 require('request-progress');
 require('proxy-from-env');
 require('yauzl');
-require('extract-zip');
+require('util');
 require('pretty-bytes');
 
 

package/dist/exec/spawn.js

@@ -1,12 +1,12 @@
 'use strict';
 
-require('../xvfb-Csr_YzMk.js');
+require('../xvfb-SgoMy1_9.js');
 require('lodash');
 require('os');
 require('child_process');
 require('path');
 require('debug');
-var spawn = require('../spawn-D9ARC26J.js');
+var spawn = require('../spawn-BZQfzolX.js');
 require('readline');
 require('process');
 require('stream');

package/dist/exec/xvfb.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var xvfb = require('../xvfb-Csr_YzMk.js');
+var xvfb = require('../xvfb-SgoMy1_9.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');

package/dist/index.js

@@ -2,12 +2,12 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-SgoMy1_9.js');
 var minimist = require('minimist');
 var Debug = require('debug');
-var cli$1 = require('./cli-CQHngRhO.js');
-var spawn = require('./spawn-D9ARC26J.js');
-var cypress = require('./cypress-BMOTlyGc.js');
+var cli$1 = require('./cli-B97CK6L9.js');
+var spawn = require('./spawn-BZQfzolX.js');
+var cypress = require('./cypress-DuMyFGfr.js');
 require('os');
 require('bluebird');
 require('@cypress/xvfb');
@@ -44,10 +44,10 @@ require('request-progress');
 require('proxy-from-env');
 require('child_process');
 require('yauzl');
-require('extract-zip');
+require('util');
+require('stream');
 require('readline');
 require('pretty-bytes');
-require('stream');
 require('string_decoder');
 require('node:string_decoder');
 require('tmp');

package/dist/{spawn-D9ARC26J.js → spawn-BZQfzolX.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var xvfb = require('./xvfb-Csr_YzMk.js');
+var xvfb = require('./xvfb-SgoMy1_9.js');
 var _ = require('lodash');
 var os = require('os');
 var cp = require('child_process');
@@ -171,9 +171,10 @@ function verifyBinary(installedVersion, binaryDir, options) {
                     yield xvfb.stateModule.writeBinaryVerifiedAsync(true, binaryDir);
                     task.title = xvfb.util.titleize(chalk.green('Verified Cypress!'), chalk.gray(binaryDir));
                 }),
-            }], {
-            silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent',
-        });
+            }], Object.assign(Object.assign({ 
+            // In CI we want timestamped, line-per-event output. Locally,
+            // the default in-place spinner is the better experience.
+            renderer: xvfb.util.isCi() ? 'verbose' : 'default' }, (xvfb.util.isCi() && { rendererOptions: { timestamp: listr2.PRESET_TIMESTAMP } })), { silentRendererCondition: () => xvfb.loggerModule.logLevel() === 'silent' }));
         yield verifyTaskRunner.run();
         if (options.welcomeMessage) {
             xvfb.loggerModule.log();
@@ -1127,8 +1128,8 @@ function createSpawnFunction(executable, args, options) {
             }
             if (xvfb.util.isPossibleLinuxWithIncorrectDisplay()) {
                 // make sure we use the latest DISPLAY variable if any
-                debug('passing DISPLAY', process.env.DISPLAY);
-                stdioOptions.env.DISPLAY = process.env.DISPLAY;
+                debug('passing DISPLAY', process$1.env.DISPLAY);
+                stdioOptions.env.DISPLAY = process$1.env.DISPLAY;
             }
             if (stdioOptions.env.ELECTRON_RUN_AS_NODE) {
                 // Since we are running electron as node, we need to add an entry point file.
@@ -1144,8 +1145,8 @@ function createSpawnFunction(executable, args, options) {
             if (startScriptPath) {
                 args.unshift(startScriptPath);
             }
-            if (process.env.CYPRESS_INTERNAL_DEV_DEBUG) {
-                args.unshift(process.env.CYPRESS_INTERNAL_DEV_DEBUG);
+            if (process$1.env.CYPRESS_INTERNAL_DEV_DEBUG) {
+                args.unshift(process$1.env.CYPRESS_INTERNAL_DEV_DEBUG);
             }
             debug('spawn args %o %o', args, _.omit(stdioOptions, 'env'));
             debug('spawning Cypress with executable: %s', executable);
@@ -1156,14 +1157,16 @@ function createSpawnFunction(executable, args, options) {
             function resolveOn(event) {
                 return function (code, signal) {
                     debug('child event fired %o', { event, code, signal });
-                    if (code === null) {
-                        const errorObject = xvfb.errors.childProcessKilled(event, signal);
-                        errorObject.platform = platform;
-                        const err = xvfb.getErrorSync(errorObject, platform);
-                        reject(err);
+                    if (signal) {
+                        if (signal === 'SIGINT') {
+                            resolve(0);
+                        }
+                        else {
+                            resolve(128 + os.constants.signals[signal]);
+                        }
                         return;
                     }
-                    resolve(code);
+                    resolve(code !== null && code !== void 0 ? code : 1);
                 };
             }
             const child = cp.spawn(executable, args, stdioOptions);
@@ -1184,6 +1187,24 @@ function createSpawnFunction(executable, args, options) {
                     });
                 });
             }
+            else {
+                // Adding listeners here prevents immediate process.exit() for these signals.
+                // Exiting when the child process exits instead will allow the child process
+                // to log during the exit process.
+                // Unlike in windows, we do not need to propagate these signals to the child process
+                // tree.
+                for (const signal of ['SIGINT', 'SIGTERM']) {
+                    debug('adding message for signal listener for %s', signal);
+                    process$1.once(signal, function () {
+                        return xvfb.__awaiter(this, void 0, void 0, function* () {
+                            console.log(`\n\n${signal} received; Attempting to exit gracefully. Force exit with ^C again if needed.\n\n`);
+                            if (process$1.stdin.isTTY) {
+                                process$1.stdin.setRawMode(false);
+                            }
+                        });
+                    });
+                }
+            }
             // if stdio options is set to 'pipe', then
             //   we should set up pipes:
             //  process STDIN (read stream) => child STDIN (writeable)
@@ -1214,9 +1235,9 @@ function createSpawnFunction(executable, args, options) {
                         sourceStream.write(data);
                     }
                 });
-                if (((_a = process.env.ELECTRON_ENABLE_LOGGING) !== null && _a !== void 0 ? _a : '') === '1' ||
+                if (((_a = process$1.env.ELECTRON_ENABLE_LOGGING) !== null && _a !== void 0 ? _a : '') === '1' ||
                     debugElectron.enabled ||
-                    ((_b = process.env.CYPRESS_INTERNAL_ENV) !== null && _b !== void 0 ? _b : '') === 'development') {
+                    ((_b = process$1.env.CYPRESS_INTERNAL_ENV) !== null && _b !== void 0 ? _b : '') === 'development') {
                     sourceStream.pipe(process$1.stderr, { end: false });
                 }
                 else {
@@ -1231,6 +1252,7 @@ function createSpawnFunction(executable, args, options) {
             // to have any effect. so we're just catching the
             // error here and not doing anything.
             process$1.stdin.on('error', (err) => {
+                debug('error on stdin', err);
                 if (['EPIPE', 'ENOTCONN'].includes(err.code)) {
                     return;
                 }
@@ -1304,16 +1326,16 @@ function start(args_1) {
         // binary that it was invoked through the NPM module
         const baseArgs = args ? (typeof args === 'string' ? [args] : args) : [];
         const decoratedArgs = baseArgs.concat([
-            '--cwd', process.cwd(),
-            '--userNodePath', process.execPath,
-            '--userNodeVersion', process.versions.node,
+            '--cwd', process$1.cwd(),
+            '--userNodePath', process$1.execPath,
+            '--userNodeVersion', process$1.versions.node,
         ]);
         const needsXvfb = xvfb.xvfb.isNeeded();
         debug('needs to start own Xvfb?', needsXvfb);
         const stdio = (_a = options.stdio) !== null && _a !== void 0 ? _a : getStdioStrategy(needsXvfb);
         const dev = (_b = options.dev) !== null && _b !== void 0 ? _b : false;
         const detached = (_c = options.detached) !== null && _c !== void 0 ? _c : false;
-        const env = (_d = options.env) !== null && _d !== void 0 ? _d : process.env;
+        const env = (_d = options.env) !== null && _d !== void 0 ? _d : process$1.env;
         const spawn = createSpawnFunction(executable, decoratedArgs, { stdio, dev, detached, env });
         if (needsXvfb) {
             debug('starting xvfb');

package/dist/{xvfb-Csr_YzMk.js → xvfb-SgoMy1_9.js}

@@ -593,8 +593,12 @@ const isInstallingFromPostinstallHook = () => {
 };
 const getCacheDir = () => {
     let cache_directory = util.getCacheDir();
-    if (util.getEnv('CYPRESS_CACHE_FOLDER')) {
-        const envVarCacheDir = untildify(util.getEnv('CYPRESS_CACHE_FOLDER'));
+    // Pass trim=true so we strip surrounding double quotes and whitespace.
+    // Windows CMD's `set CYPRESS_CACHE_FOLDER="C:\path"` embeds literal quotes
+    // into the env value; without dequoting, the resolved cache directory ends
+    // up with quote chars in its name (see cypress-io/cypress#4506).
+    if (util.getEnv('CYPRESS_CACHE_FOLDER', true)) {
+        const envVarCacheDir = untildify(util.getEnv('CYPRESS_CACHE_FOLDER', true));
         debug$1('using environment variable CYPRESS_CACHE_FOLDER %s', envVarCacheDir);
         if (!path.isAbsolute(envVarCacheDir) && isInstallingFromPostinstallHook()) {
             const packageRootFolder = path.join('..', '..', envVarCacheDir);
@@ -925,12 +929,6 @@ const CYPRESS_RUN_BINARY = {
         };
     },
 };
-function getErrorSync(errorObject, platform) {
-    const errorMessage = syncFormErrorText(Object.assign(Object.assign({}, errorObject), { platform }));
-    const err = new Error(errorMessage);
-    err.known = true;
-    return err;
-}
 function formErrorText(info, msg, prevMessage) {
     return __awaiter(this, void 0, void 0, function* () {
         const platform = yield util.getPlatformInfo();
@@ -1154,7 +1152,6 @@ exports._xvfb = _xvfb;
 exports._xvfbOptions = _xvfbOptions;
 exports.errors = errors;
 exports.exitWithError = exitWithError;
-exports.getErrorSync = getErrorSync;
 exports.isNeeded = isNeeded;
 exports.loggerModule = loggerModule;
 exports.relativeToRepoRoot = relativeToRepoRoot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cypress",
-  "version": "15.15.0",
+  "version": "15.16.0",
   "main": "dist/index.js",
   "scripts": {
     "postinstall": "node dist/index.js --exec install",
@@ -27,7 +27,6 @@
     "eventemitter2": "6.4.7",
     "execa": "4.1.0",
     "executable": "^4.1.1",
-    "extract-zip": "2.0.1",
     "fs-extra": "^9.1.0",
     "hasha": "5.2.2",
     "is-installed-globally": "~0.4.0",
@@ -46,7 +45,7 @@
     "tslib": "1.14.1",
     "tree-kill": "1.2.2",
     "untildify": "^4.0.0",
-    "yauzl": "^2.10.0"
+    "yauzl": "^3.3.1"
   },
   "files": [
     "bin",
@@ -139,8 +138,8 @@
   },
   "buildInfo": {
     "commitBranch": "develop",
-    "commitSha": "914ad901d9d50e2c744769a445643702ceca774b",
-    "commitDate": "2026-05-12T03:59:53.000Z",
+    "commitSha": "22aaf2371462ec13f138fd96c11e8f9f885ed575",
+    "commitDate": "2026-05-26T16:59:59.000Z",
     "stable": true
   },
   "description": "Cypress is a next generation front end testing tool built for the modern web",

package/types/sinon/index.d.ts

@@ -12,7 +12,9 @@
 //                 Roey Berman <https://github.com/bergundy>
 // Definitions: https://github.com/DefinitelyTyped/DefinitelyTyped
 
-import * as FakeTimers from '@sinonjs/fake-timers';
+// Import via the @types name so TS resolves to the bundled
+// @types/sinonjs__fake-timers (cypress-io/cypress#33829).
+import * as FakeTimers from 'sinonjs__fake-timers';
 
 // sinon uses DOM dependencies which are absent in browser-less environment like node.js
 // to avoid compiler errors this monkey patch is used