fix(cypress-image): resolve critical security vulnerabilities

README.md

@@ -341,3 +341,17 @@ Legacy unit tests can be run with `yarn unit-tests-legacy`. Many are outdated/br
 To run end-to-end tests against production (https://ffiec.cfpb.gov), use `yarn test`. See our [Cypress documentation](https://github.com/cfpb/hmda-frontend/blob/master/cypress/README.md) to learn about running and maintaining the tests.
 
 ![Cypress automated filing test](./readme-files/filing-2020-q1-cypress.gif)
+
+#### Having issues running Cypress locally?
+
+If you encounter issues running cypress, because it can be a little finicky sometimes, I'd recommend the following:
+
+_clear the cypress cache and reinstall_
+
+```sh
+yarn install
+yarn yarn cypress cache clear
+yarn cypress install
+```
+
+Still getting a weird `Cannot find module '@ffprobe-installer/darwin-x64/ffprobe'` error when on a Mac? Make sure the env var `npm_config_arch` is unset before you run the commands above.

cypress.config.js

@@ -30,8 +30,6 @@ module.exports = defineConfig({
     openMode: 0,
   },
 
-  experimentalStudio: true,
-
   e2e: {
     experimentalRunAllSpecs: true,
     testIsolation: true,

cypress/Dockerfile

@@ -1,6 +1,5 @@
-# Install Cypress v14.3.0
-FROM cypress/included:14.3.0
-
+# Install Cypress v15.12.0
+FROM cypress/included:15.12.0
 # Set working directory
 WORKDIR /hmda-frontend
 
@@ -12,7 +11,24 @@ COPY cypress/package.json ./
 # Add Zscaler Root CA certificate
 ADD https://raw.githubusercontent.com/cfpb/zscaler-cert/refs/heads/main/zscaler_root_ca.pem /usr/local/share/ca-certificates/zscaler-root-public.cert
 ARG NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/zscaler-root-public.cert
-RUN npm install cypress@14.3.0 --save-dev --force --loglevel verbose
+
+# Install packages (--legacy-peer-deps added because of incompatibility with cypress-keycloak v2.0.2)
+RUN npm install --loglevel verbose --legacy-peer-deps
+
+# Manually install and replace cypress' version of esbuild to fix CVE-2025-68121/GO-2026-4337, a
+# critical vulnerability in the crypto/tls library, see the issue at: https://pkg.go.dev/vuln/GO-2026-4337
+# TODO: Remove the following RUN statement after Cypress patches it, see GHE #2711
+RUN npm install @esbuild/linux-x64@0.27.4 --save-optional --legacy-peer-deps --loglevel verbose && \
+    rm /root/.cache/Cypress/15.12.0/Cypress/resources/app/node_modules/@esbuild/linux-x64/bin/esbuild && \
+    cp node_modules/@esbuild/linux-x64/bin/esbuild /root/.cache/Cypress/15.12.0/Cypress/resources/app/node_modules/@esbuild/linux-x64/bin/esbuild
+
+# Manually install and replace cypress' version of undici to fix CVE-2026-1525, see the issue
+# at: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
+# TODO: Remove the following RUN statement after Cypress patches it, see GHE #2711
+RUN npm install undici@6.24.0 --save-optional --legacy-peer-deps --loglevel verbose && \
+    rm -rf /root/.cache/Cypress/15.12.0/Cypress/resources/app/node_modules/undici && \
+    cp -r node_modules/undici /root/.cache/Cypress/15.12.0/Cypress/resources/app/node_modules/undici
+
 RUN npx cypress verify
 
 # Prepare working directory

cypress/package.json

@@ -2,8 +2,8 @@
   "dependencies": {
     "@cypress/grep": "^5.0.0",
     "@cypress/skip-test": "2.6.1",
-    "@testing-library/cypress": "10.0.2",
-    "cypress": "14.3.0",
+    "@testing-library/cypress": "10.1.0",
+    "cypress": "15.12.0",
     "cypress-file-upload": "5.0.8",
     "cypress-keycloak": "2.0.2"
   },

package.json

@@ -88,12 +88,12 @@
     "@babel/preset-react": "^7.23.3",
     "@cfaester/enzyme-adapter-react-18": "^0.8.0",
     "@cypress/grep": "^5.0.0",
-    "@cypress/skip-test": "2.6.0",
+    "@cypress/skip-test": "2.6.1",
     "@esbuild-plugins/node-globals-polyfill": "^0.2.3",
-    "@testing-library/cypress": "10.0.2",
+    "@testing-library/cypress": "10.1.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@vitejs/plugin-react": "^4.1.0",
-    "cypress": "^14.0",
+    "cypress": "^15.12.0",
     "cypress-file-upload": "5.0.8",
     "cypress-keycloak": "2.0.2",
     "dotenv": "^16.3.1",

yarn.lock

@@ -1701,9 +1701,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@cypress/request@npm:^3.0.9":
-  version: 3.0.9
-  resolution: "@cypress/request@npm:3.0.9"
+"@cypress/request@npm:^3.0.10":
+  version: 3.0.10
+  resolution: "@cypress/request@npm:3.0.10"
   dependencies:
     aws-sign2: "npm:~0.7.0"
     aws4: "npm:^1.8.0"
@@ -1718,19 +1718,19 @@ __metadata:
     json-stringify-safe: "npm:~5.0.1"
     mime-types: "npm:~2.1.19"
     performance-now: "npm:^2.1.0"
-    qs: "npm:6.14.0"
+    qs: "npm:~6.14.1"
     safe-buffer: "npm:^5.1.2"
     tough-cookie: "npm:^5.0.0"
     tunnel-agent: "npm:^0.6.0"
     uuid: "npm:^8.3.2"
-  checksum: 10c0/9ebcd3f3d49706e730671bcb0bb86488fe23a2079f12d44b6c762777118fc0286b5ce5c73fb6cacf0ae291fa89a7562ca8a2b43a2486e26906fd84a386ed6967
+  checksum: 10c0/93da9754315261474deeefff235ed0397811d49f03f2dfcebd01aff12b75fd58e104b0c7fd3d720e1ebc51d73059e1f540db68c58bbda4612493610227ade710
   languageName: node
   linkType: hard
 
-"@cypress/skip-test@npm:2.6.0":
-  version: 2.6.0
-  resolution: "@cypress/skip-test@npm:2.6.0"
-  checksum: 10c0/772594570d81acdb1b134167637becb3107da98cb6b44c877079b4fccf58cc5454d57cd3b48e049c91eacc06bc1481f016c5252e8e21acf4389e2a6ae0ebca27
+"@cypress/skip-test@npm:2.6.1":
+  version: 2.6.1
+  resolution: "@cypress/skip-test@npm:2.6.1"
+  checksum: 10c0/1d0d2cb4b3094c6dee2d2339b75d60f85e5fb17b4e281cbee854e6cd4a124fad61cc65db8335b9a169ccc24b490df5b29c3385f09fa590124dc4d5b57e110019
   languageName: node
   linkType: hard
 
@@ -3244,15 +3244,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@testing-library/cypress@npm:10.0.2":
-  version: 10.0.2
-  resolution: "@testing-library/cypress@npm:10.0.2"
+"@testing-library/cypress@npm:10.1.0":
+  version: 10.1.0
+  resolution: "@testing-library/cypress@npm:10.1.0"
   dependencies:
     "@babel/runtime": "npm:^7.14.6"
     "@testing-library/dom": "npm:^10.1.0"
   peerDependencies:
-    cypress: ^12.0.0 || ^13.0.0
-  checksum: 10c0/c8305bcdceb1b0a8b6abcb23374ba670f6ddacd6416144a422efd7bdee901af39497f2e0f773b546db5e317776c786fbe4776607da3cbe1d1f42433bce240ca9
+    cypress: ^12.0.0 || ^13.0.0 || ^14.0.0 || ^15.0.0
+  checksum: 10c0/9829f6fed1ff1fe852e7b84b74fc3a30ecee1071ced66c70eee3fd506ad2fca3bccae1f475a22cb8293d9cfc261c2d6551551cdc784fdcabe0ba1fd0e70c0dfb
   languageName: node
   linkType: hard
 
@@ -3558,6 +3558,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/tmp@npm:^0.2.3":
+  version: 0.2.6
+  resolution: "@types/tmp@npm:0.2.6"
+  checksum: 10c0/a11bfa2cd8eaa6c5d62f62a3569192d7a2c28efdc5c17af0b0551db85816b2afc8156f3ca15ac76f0b142ae1403f04f44279871424233a1f3390b2e5fc828cd0
+  languageName: node
+  linkType: hard
+
 "@types/tough-cookie@npm:*":
   version: 4.0.5
   resolution: "@types/tough-cookie@npm:4.0.5"
@@ -4254,7 +4261,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"async@npm:^3.2.0, async@npm:^3.2.6":
+"async@npm:^3.2.6":
   version: 3.2.6
   resolution: "async@npm:3.2.6"
   checksum: 10c0/36484bb15ceddf07078688d95e27076379cc2f87b10c03b6dd8a83e89475a3c8df5848859dd06a4c95af1e4c16fc973de0171a77f18ea00be899aca2a4f85e70
@@ -5000,13 +5007,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"check-more-types@npm:^2.24.0":
-  version: 2.24.0
-  resolution: "check-more-types@npm:2.24.0"
-  checksum: 10c0/93fda2c32eb5f6cd1161a84a2f4107c0e00b40a851748516791dd9a0992b91bdf504e3bf6bf7673ce603ae620042e11ed4084d16d6d92b36818abc9c2e725520
-  languageName: node
-  linkType: hard
-
 "cheerio-select@npm:^1.5.0":
   version: 1.6.0
   resolution: "cheerio-select@npm:1.6.0"
@@ -5621,21 +5621,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cypress@npm:^14.0":
-  version: 14.5.4
-  resolution: "cypress@npm:14.5.4"
+"cypress@npm:^15.12.0":
+  version: 15.12.0
+  resolution: "cypress@npm:15.12.0"
   dependencies:
-    "@cypress/request": "npm:^3.0.9"
+    "@cypress/request": "npm:^3.0.10"
     "@cypress/xvfb": "npm:^1.2.4"
     "@types/sinonjs__fake-timers": "npm:8.1.1"
     "@types/sizzle": "npm:^2.3.2"
+    "@types/tmp": "npm:^0.2.3"
     arch: "npm:^2.2.0"
     blob-util: "npm:^2.0.2"
     bluebird: "npm:^3.7.2"
     buffer: "npm:^5.7.1"
     cachedir: "npm:^2.3.0"
     chalk: "npm:^4.1.0"
-    check-more-types: "npm:^2.24.0"
     ci-info: "npm:^4.1.0"
     cli-cursor: "npm:^3.1.0"
     cli-table3: "npm:0.6.1"
@@ -5650,28 +5650,27 @@ __metadata:
     extract-zip: "npm:2.0.1"
     figures: "npm:^3.2.0"
     fs-extra: "npm:^9.1.0"
-    getos: "npm:^3.2.1"
     hasha: "npm:5.2.2"
     is-installed-globally: "npm:~0.4.0"
-    lazy-ass: "npm:^1.6.0"
     listr2: "npm:^3.8.3"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:^4.17.23"
     log-symbols: "npm:^4.0.0"
     minimist: "npm:^1.2.8"
     ospath: "npm:^1.2.2"
     pretty-bytes: "npm:^5.6.0"
     process: "npm:^0.11.10"
     proxy-from-env: "npm:1.0.0"
     request-progress: "npm:^3.0.0"
-    semver: "npm:^7.7.1"
     supports-color: "npm:^8.1.1"
-    tmp: "npm:~0.2.3"
+    systeminformation: "npm:^5.31.1"
+    tmp: "npm:~0.2.4"
     tree-kill: "npm:1.2.2"
+    tslib: "npm:1.14.1"
     untildify: "npm:^4.0.0"
     yauzl: "npm:^2.10.0"
   bin:
     cypress: bin/cypress
-  checksum: 10c0/e4ded8f0ae8a6c56ac9ee615fc62d4b5c6543634035edaa5d5cbd67d6cd45457eef02a67ac90d0aa6f4fbfe25663513f782a6351f9305fd572e89a3ef587d3ab
+  checksum: 10c0/aa11220a2da53689de9334975b6c8cbe3d5aa586542ac755c8581c80186b1a12394932d77c44fbeaf4d5f442afb357b1ccb9e66f0e8e6f778ed386131787e6fb
   languageName: node
   linkType: hard
 
@@ -7608,15 +7607,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"getos@npm:^3.2.1":
-  version: 3.2.1
-  resolution: "getos@npm:3.2.1"
-  dependencies:
-    async: "npm:^3.2.0"
-  checksum: 10c0/21556fca1da4dfc8f1707261b4f9ff19b9e9bfefa76478249d2abddba3cd014bd6c5360634add1590b27e0b27d422e8f997dddaa0234aae1fa4c54f33f82e841
-  languageName: node
-  linkType: hard
-
 "getpass@npm:^0.1.1":
   version: 0.1.7
   resolution: "getpass@npm:0.1.7"
@@ -8091,20 +8081,20 @@ __metadata:
     "@cfaester/enzyme-adapter-react-18": "npm:^0.8.0"
     "@cfpb/cfpb-analytics": "npm:^0.3.2"
     "@cypress/grep": "npm:^5.0.0"
-    "@cypress/skip-test": "npm:2.6.0"
+    "@cypress/skip-test": "npm:2.6.1"
     "@docsearch/react": "npm:3.6.0"
     "@esbuild-plugins/node-globals-polyfill": "npm:^0.2.3"
     "@redux-devtools/extension": "npm:^3.3.0"
     "@reduxjs/toolkit": "npm:^1.9.7"
     "@tanstack/react-table": "npm:8.20.5"
-    "@testing-library/cypress": "npm:10.0.2"
+    "@testing-library/cypress": "npm:10.1.0"
     "@testing-library/jest-dom": "npm:^6.9.1"
     "@uswds/compile": "npm:^1.3.1"
     "@uswds/uswds": "npm:3.9.0"
     "@vitejs/plugin-react": "npm:^4.1.0"
     ansi-html: "npm:0.0.9"
     csv-parse: "npm:4.16.3"
-    cypress: "npm:^14.0"
+    cypress: "npm:^15.12.0"
     cypress-file-upload: "npm:5.0.8"
     cypress-keycloak: "npm:2.0.2"
     date-fns: "npm:^4.1.0"
@@ -9907,13 +9897,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lazy-ass@npm:^1.6.0":
-  version: 1.6.0
-  resolution: "lazy-ass@npm:1.6.0"
-  checksum: 10c0/4af6cb9a333fbc811268c745f9173fba0f99ecb817cc9c0fae5dbf986b797b730ff525504128f6623b91aba32b02124553a34b0d14de3762b637b74d7233f3bd
-  languageName: node
-  linkType: hard
-
 "lead@npm:^4.0.0":
   version: 4.0.0
   resolution: "lead@npm:4.0.0"
@@ -10062,6 +10045,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash@npm:^4.17.23":
+  version: 4.17.23
+  resolution: "lodash@npm:4.17.23"
+  checksum: 10c0/1264a90469f5bb95d4739c43eb6277d15b6d9e186df4ac68c3620443160fc669e2f14c11e7d8b2ccf078b81d06147c01a8ccced9aab9f9f63d50dcf8cace6bf6
+  languageName: node
+  linkType: hard
+
 "log-symbols@npm:^4.0.0":
   version: 4.1.0
   resolution: "log-symbols@npm:4.1.0"
@@ -13996,6 +13986,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"systeminformation@npm:^5.31.1":
+  version: 5.31.5
+  resolution: "systeminformation@npm:5.31.5"
+  bin:
+    systeminformation: lib/cli.js
+  checksum: 10c0/d536dfb01529fd99e6c7c0f4239e309b0f5102b4816d9b14287b81033dd86b882fe238fee5a212d09ff8f368cc5eee618cc96bd196ce705af22f5acae9a5e773
+  conditions: (os=darwin | os=linux | os=win32 | os=freebsd | os=openbsd | os=netbsd | os=sunos | os=android)
+  languageName: node
+  linkType: hard
+
 "tar@npm:^7.4.3":
   version: 7.5.9
   resolution: "tar@npm:7.5.9"
@@ -14185,7 +14185,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tmp@npm:~0.2.3":
+"tmp@npm:~0.2.4":
   version: 0.2.5
   resolution: "tmp@npm:0.2.5"
   checksum: 10c0/cee5bb7d674bb4ba3ab3f3841c2ca7e46daeb2109eec395c1ec7329a91d52fcb21032b79ac25161a37b2565c4858fefab927af9735926a113ef7bac9091a6e0e
@@ -14281,6 +14281,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tslib@npm:1.14.1":
+  version: 1.14.1
+  resolution: "tslib@npm:1.14.1"
+  checksum: 10c0/69ae09c49eea644bc5ebe1bca4fa4cc2c82b7b3e02f43b84bd891504edf66dbc6b2ec0eef31a957042de2269139e4acff911e6d186a258fb14069cd7f6febce2
+  languageName: node
+  linkType: hard
+
 "tslib@npm:^2.0.1, tslib@npm:^2.0.3, tslib@npm:^2.1.0, tslib@npm:^2.2.0":
   version: 2.8.1
   resolution: "tslib@npm:2.8.1"