15.10.0

Released Released on February 2, 2026

Deprecations:

Cypress.env() is now deprecated and will be removed in a future major release of Cypress. To understand why, and how to migrate, please read our Migration Guide. Addressed in #33181.

Features:

  • Introduced a new cy.env() command that can be used to asynchronously and securely access Cypress environment variables. Addressed in #33181.

  • Added a allowCypressEnv configuration option that disallows use of the deprecated Cypress.env() API. Addressed in #33181.

  • Introduced the new Cypress.expose() API, intended for use of public configuration of non-sensitive values. Addressed in #33238.

  • Displays the resolved expose values in the App's resolved configuration user interface. Addressed in #33322.

Bugfixes:

  • Fixed an issue where the user did not always have the ability to create a new test in Studio. Also, fixed an issue where creating a new test from an empty spec would display the welcome to studio screen instead of the form to name the new test. Addressed in #33236.

Misc:

  • The icon in the 'Open in IDE' button in the command log is now the correct size. Addresses #32779. Addressed in #33217.

Dependency Updates:

  • Upgraded express to 4.22.0 and body-parser to 1.20.4. This removes the CVE-2025-15284 vulnerability being reported in security scans. Addressed in #33305.

  • Upgraded lodash to 4.17.23. This removes the CVE-2025-13465 vulnerability being reported in security scans. Addresses #33269.

  • Upgraded shell-env to 4.0.1 and @cypress/commit-info to 2.2.2. This removes the GMS-2020-2 vulnerability being reported in security scans. Addressed in #33226 and #33263.