dependency: bump cypress-request packages, loosen semver rules to ^

[jennifer-shehane]

• Addresses https://github.com/cypress-io/cypress-internal/issues/609

Additional details

Bumping @cypress/request packages to address CVE-2022-24999 within qs sub-dependency. This qs dependency was updated months ago in the @cypress/request package in this PR: cypress-io/request#23, which was subsequently released in @cypress/request 2.88.11. This update also includes some other changes, see commits.

This PR additionally loosens the semver rules for this npm package. We have control over this package completely, so if we release fixes or features, those should be used as latest.

Steps to test

Tests should pass!

How has the user experience changed?

No changes for users

PR Tasks

• [NA] Have tests been added/updated?
• [NA] Has a PR for user-facing changes been opened in cypress-documentation?
• [NA] Have API changes been updated in the type definitions?

[cypress]

1 failed and 30 flaky tests on run #47671 ↗︎

1

27314

1308

0

30

Details:

Merge branch 'develop' into bump-cy-request-package
Project: cypress	Commit: 21aff77886
Status: Failed	Duration: 20:37 💡
Started: Jun 14, 2023 7:40 PM	Ended: Jun 14, 2023 8:00 PM

  cypress/e2e/scaffold-project.cy.ts • 1 failed test • launchpad-e2e

View Output Video

Test		Artifacts
scaffolding new projects > generates valid config file for pristine project without cypress installed		Output Screenshots Video

  create-from-component.cy.ts • 1 flaky test • app-e2e

View Output Video

Test		Artifacts
... > runs generated spec		Output Screenshots Video

  specs_list_latest_runs.cy.ts • 2 flaky tests • app-e2e

View Output Video

Test		Artifacts
App/Cloud Integration - Latest runs and Average duration > when no runs are recorded > shows placeholders for all visible specs		Output Screenshots Video
App/Cloud Integration - Latest runs and Average duration > when runs are recorded > lazily loads data for off-screen specs		Output Screenshots Video

  cypress-origin-communicator.cy.ts • 1 flaky test • app-e2e

View Output Video

Test		Artifacts
Cypress In Cypress Origin Communicator > cy.origin passivity with app interactions > passes upon test reload mid test execution		Output Screenshots Video

  commands/net_stubbing.cy.ts • 1 flaky test • 5x-driver-electron

View Output Video

Test		Artifacts
network stubbing > intercepting request > can delay and throttle a StaticResponse		Output Video

  cypress/cypress.cy.js • 3 flaky tests • 5x-driver-electron

View Output Video

Test		Artifacts
... > correctly returns currentRetry		Output Video
... > correctly returns currentRetry		Output Video
... > correctly returns currentRetry		Output Video

The first 5 flaky specs are shown, see all 17 specs in Cypress Cloud.

_{This comment has been generated by cypress-bot as a result of this project's GitHub integration settings.}

[emilyrohrbough]

We still have a few bad versions of qs being pulled in somewhere 😢

The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

[cypress-bot]

Released in 12.17.1.

This comment thread has been locked. If you are still experiencing this issue after upgrading to
Cypress v12.17.1, please open a new issue.