Merge branch 'develop' into merge_develop_15

cli/CHANGELOG.md

@@ -31,6 +31,8 @@ _Released 07/29/2025 (PENDING)_
 
 - Fixed an issue where Create from Component feature might not be able to parse React components from project files. Fixed in [#31457](https://github.com/cypress-io/cypress/pull/31457).
 - Fixed an issue where `isSecureContext` would be `false` on localhost when testing with Cypress. Addresses [#18217](https://github.com/cypress-io/cypress/issues/18217).
+- Fixed an issue where Angular legacy `Output()` decorators were broken when making component instance field references safe. Fixes [#32137](https://github.com/cypress-io/cypress/issues/32137).
+- Upgraded `tmp` from `~0.2.3` to `~0.2.4`. This removes the [CVE-2025-54798](https://github.com/advisories/GHSA-52f5-9888-hmc6) vulnerability being reported in security scans. Addresses [#32176](https://github.com/cypress-io/cypress/issues/32176).
 
 **Misc:**
 
@@ -45,7 +47,7 @@ _Released 07/29/2025 (PENDING)_
 
 ## 14.5.4
 
-_Released 8/12/2025 (PENDING)_
+_Released 8/07/2025_
 
 **Dependency Updates:**
 

cli/package.json

@@ -60,7 +60,7 @@
     "request-progress": "^3.0.0",
     "semver": "^7.7.1",
     "supports-color": "^8.1.1",
-    "tmp": "~0.2.3",
+    "tmp": "~0.2.4",
     "tree-kill": "1.2.2",
     "untildify": "^4.0.0",
     "yauzl": "^2.10.0"

npm/angular/src/mount.ts

@@ -424,7 +424,10 @@ function setupComponent<T> (
     getComponentOutputs(fixture.componentRef.componentType).forEach((key) => {
       const property = component[key]
 
-      if (property instanceof EventEmitter) {
+      // With the introduction of https://github.com/cypress-io/cypress/pull/31993, we want to make sure that component inputs are reference safe inside cy.mount().
+      // However, the exception to this is if the user passes in a Cypress output spy as a property in order to maintain backwards compatibility.
+      // @ts-expect-error
+      if (property instanceof EventEmitter || (config?.componentProperties?.hasOwnProperty(key) && config?.componentProperties[key] instanceof EventEmitter)) {
       // only assign props if they are passed into the component
         if (config?.componentProperties?.hasOwnProperty(key)) {
         // @ts-expect-error

system-tests/projects/angular-signals/src/signals-inputs/signals.input.component.cy.ts

@@ -0,0 +1,18 @@
+import { SignalsInputComponent } from './signals.input.component'
+import { createOutputSpy, mount } from 'cypress/angular'
+
+describe('with output spies', () => {
+  // regression test for https://github.com/cypress-io/cypress/issues/32137
+  it('should emit events on button click', () => {
+    mount(SignalsInputComponent, {
+      componentProperties: {
+        newOutput: createOutputSpy('newOutput'),
+        oldOutput: createOutputSpy('oldOutput'),
+      },
+    })
+
+    cy.get('#test-button').click()
+    cy.get('@oldOutput').should('have.been.called')
+    cy.get('@newOutput').should('have.been.called')
+  })
+})

system-tests/projects/angular-signals/src/signals-inputs/signals.input.component.html

@@ -0,0 +1 @@
+<button id="test-button" (click)="onButtonClick()">Test</button>

system-tests/projects/angular-signals/src/signals-inputs/signals.input.component.ts

@@ -0,0 +1,18 @@
+import { Component, EventEmitter, Output, output } from '@angular/core'
+import { CommonModule } from '@angular/common'
+
+@Component({
+  selector: 'signals-input-component',
+  standalone: true,
+  imports: [CommonModule],
+  templateUrl: './signals.input.component.html',
+})
+export class SignalsInputComponent {
+  newOutput = output()
+  @Output() oldOutput: EventEmitter<void> = new EventEmitter()
+
+  onButtonClick () {
+    this.newOutput.emit()
+    this.oldOutput.emit()
+  }
+}

yarn.lock

@@ -30484,10 +30484,10 @@ tmp@^0.0.33:
   dependencies:
     os-tmpdir "~1.0.2"
 
-tmp@^0.2.0, tmp@^0.2.1, tmp@~0.2.1, tmp@~0.2.3:
-  version "0.2.3"
-  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.3.tgz#eb783cc22bc1e8bebd0671476d46ea4eb32a79ae"
-  integrity sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==
+tmp@^0.2.0, tmp@^0.2.1, tmp@~0.2.1, tmp@~0.2.4:
+  version "0.2.4"
+  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.4.tgz#c6db987a2ccc97f812f17137b36af2b6521b0d13"
+  integrity sha512-UdiSoX6ypifLmrfQ/XfiawN6hkjSBpCjhKxxZcWlUUmoXLaCKQU0bx4HF/tdDK2uzRuchf1txGvrWBzYREssoQ==
 
 to-absolute-glob@^2.0.0:
   version "2.0.2"