Update dependency codeceptjs to v3.7.5 [SECURITY]#1053
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Update dependency codeceptjs to v3.7.5 [SECURITY]#1053renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.5.11→3.7.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-57285
CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands.
Release Notes
Codeception/codeceptjs (codeceptjs)
v3.7.5Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
v3.7.4Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
Test Suite Shuffling: Randomize test execution order to discover test dependencies and improve test isolation (#5051) - by @NivYarmus
Enhanced Interactive Debugging: Better logging for
I.grab*methods in live interactive mode for clearer debugging output (#4986) - by @owenizedd🐛 Bug Fixes
Playwright Session Traces: Fixed trace file naming convention and improved error handling for multi-session test scenarios (#5073) - by @julien-ft-64 @kobenguyent
Trace files use UUID prefixes with
sessionName_testTitle.status.zipformatWorker Data Injection: Resolved proxy object serialization preventing data sharing between parallel test workers (#5072) - by @kobenguyent
Hook Exit Codes: Fixed improper exit codes when test hooks fail, ensuring CI/CD pipelines properly detect failures (#5058) - by @kobenguyent
TypeScript Effects Support: Added complete TypeScript definitions for effects functionality (#5027) - by @kobenguyent
Note: Replaces deprecated global plugins - import from 'codeceptjs/effects' module
Mochawesome Screenshot Uniqueness: Fixed screenshot naming to prevent test failures from being overwritten when multiple tests run at the same time (#4959) - by @Lando1n
Ensures every failed test keeps its own screenshot for easier debugging
📖 Documentation
v3.7.3Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
🐛 Bug Fixes
v3.7.2Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
🐛 Bug Fixes
📖 Documentation
v3.7.1Compare Source
reading charAterror inasyncWrapper.jsv3.7.0Compare Source
This release introduces major new features and internal refactoring. It is an important step toward the 4.0 release planned soon, which will remove all deprecations introduced in 3.7.
🛩️ Features
🔥 Native Element Functions
A new Els API for direct element interactions has been introduced. This API provides low-level element manipulation functions for more granular control over element interactions and assertions:
element()- perform custom operations on first matching elementeachElement()- iterate and perform operations on each matching elementexpectElement()- assert condition on first matching elementexpectAnyElement()- assert condition matches at least one elementexpectAllElements()- assert condition matches all elementsExample using all element functions:
Els functions expose the native API of Playwright, WebDriver, and Puppeteer helpers. The actual
elAPI will differ depending on which helper is used, which affects test code interoperability.🔮 Effects introduced
Effects is a new concept that encompasses all functions that can modify scenario flow. These functions are now part of a single module. Previously, they were used via plugins like
tryToandretryTo. Now, it is recommended to import them directly:Previously
tryToandretryTowere available globally via plugins. This behavior is deprecated as of 3.7 and will be removed in 4.0. Import these functions via effects instead. Similarly,withinwill be moved toeffectsin 4.0.✅
checkcommand addedThis command can be executed locally or in CI environments to verify that tests can be executed correctly.
It checks:
And will attempt to open and close a browser if a corresponding helper is enabled. If something goes wrong, the command will fail with a message. Run
npx codeceptjs checkon CI before actual tests to ensure everything is set up correctly and all services and browsers are accessible.For GitHub Actions, add this command:
👨🔬 analyze plugin introduced
This AI plugin analyzes failures in test runs and provides brief summaries. For more than 5 failures, it performs cluster analysis and aggregates failures into groups, attempting to find common causes. It is recommended to use Deepseek R1 model or OpenAI o3 for better reasoning on clustering:
For fewer than 5 failures, they are analyzed individually. If a visual recognition model is connected, AI will also scan screenshots to suggest potential failure causes (missing button, missing text, etc).
This plugin should be paired with the newly added
pageInfoplugin which stores important information like URL, console logs, and error classes for further analysis.👨💼 autoLogin plugin renamed to auth plugin
authis the new name for the autoLogin plugin and aims to solve common authorization issues. In 3.7 it can use Playwright's storage state to load authorization cookies in a browser on start. So if a user is already authorized, a browser session starts with cookies already loaded for this user. If you use Playwright, you can enable this behavior using theloginAsmethod inside aBeforeSuitehook:The previous behavior where
loginAswas called from aBeforehook also works. However, cookie loading and authorization checking is performed after the browser starts.Metadata introduced
Meta information in key-value format can be attached to Scenarios to provide more context when reporting tests:
By default, Playwright helpers add browser and window size as meta information to tests.
👢 Custom Steps API
Custom Steps or Sections API introduced to group steps into sections:
To hide steps inside a section from output use
Section().hidden()call:Alternative syntax for closing section:
EndSection:Also available BDD-style pre-defined sections:
🥾 Step Options
Better syntax to set general step options for specific tests.
Use it to set timeout or retries for specific steps:
Alternative syntax:
This change deprecates previous syntax:
I.limitTime().act(...)=> replaced withI.act(..., stepTimeout())I.retry().act(...)=> replaced withI.act(..., stepRetry())Step options should be passed as the very last argument to
I.action()call.Step options can be used to pass additional options to currently existing methods:
Currently this works only on
seeand only withignoreCaseparam.However, this syntax will be extended in next versions.
Test object can be injected into Scenario
API for direct access to test object inside Scenario or hooks to add metadata or artifacts:
Object for
suiteis also injected for all Scenario and hooks.Notable changes
NLtranslation introduced by @ebo-zig in #4784:codeceptjs runfails on CI if no tests were executed. This helps to avoid false positive checks. UseDONT_FAIL_ON_EMPTY_RUNenv variable to disable this behaviorhealplugin (which heals failing tests on the fly) shown inrun-workerscommandplugin/standatdActingHelpersreplaced withContainer.STANDARD_ACTING_HELPERS🐛 Bug Fixes
BeforeSuiteandAfterSuite🎇 Internal Refactoring
This section is listed briefly. A new dedicated page for internal API concepts will be added to documentation
lib/mochalib/stepHelperStep,MetaStep,FuncStep,CommentStepstep.addToRecorder()to schedule test execution as part of global promise chainevent.all.resultnow sends Result object with all failures and stats includedrun-workersrefactored to useResultto send results from workers to main processlistener/timeout=>globalTimeoutstoreto share data on current state between different parts of systemeventsAPI improvedevent.hook.passed,event.hook.finishedevent.test.failed,event.test.finishedalways sends Test. If test has failed inBeforeorBeforeSuitehook, event for all failed test in this suite will be sentevent.test.failedv3.6.10Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🐛 Bug Fixes
fix(cli): missing failure counts when there is failedHooks (#4633) - by @kobenguyent
v3.6.9Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🐛 Hot Fixes
fix: could not run tests due to missing
invisi-datalib - by @kobenguyentv3.6.8Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
🐛 Bug Fixes
Locator.buildcomplains the empty locator (#4543) - by @kobenguyentI.seeEmailAttachmenttreats parameter as regular expression (#4629) - by @ngraf📖 Documentation
v3.6.7Compare Source
v3.6.6Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
Zero-configuration when paired with other helpers like REST, Playwright:
run command

run workers command

🐛 Bug Fixes
I.executeScriptcommand is used withrun-workers(#4483) - by @code4muktesh📖 Documentation
v3.6.5Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
🐛 Bug Fixes
📖 Documentation
v3.6.4Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
askForPageObjectmethod to generate PageObjects on the fly🐛 Bug Fixes
📖 Documentation
v3.6.3Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
🐛 Bug Fixes
📖 Documentation
v3.6.2Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
Support the httpAgent conf to create the TSL connection via REST helper
Currently only screenshot of the active session is saved, this PR aims to save the screenshot of every session for easy debugging
Find an element with class attribute
You could now set the recording video resolution
🐛 Bug Fixes
📖 Documentation
v3.6.1Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🐛 Bug Fixes
fix(cli): missing failure counts when there is failedHooks (#4633) - by @kobenguyent
v3.6.0Compare Source
🛩️ Features
Breaking Change AI features refactored. Read updated AI guide:
openai--aioption added to explicitly enable AI featuresOpenAIhelper renamed toAIfeat(puppeteer): network traffic manipulation. See #4263 by @KobeNguyenT
startRecordingTrafficgrabRecordedNetworkTrafficsflushNetworkTrafficsstopRecordingTrafficseeTrafficdontSeeTrafficfeat(Puppeteer): recording WS messages. See #4264 by @KobeNguyenT
Recording WS messages:
flushing WS messages:
Examples:
_react,_vue,data-testidattribute. See #4255 by @KobeNguyenTNetwork requests & responses can be mocked and modified. Use
mockRoutewhich strictly follows Puppeteer's setRequestInterception API.To master request intercepting use HTTPRequest object passed into mock request handler.
🐛 Bug Fixes
v3.5.15Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
We revamp the coverage plugin to make it easier to use
Once all the tests are completed,
codeceptwill create and store coverage inoutput/coveragefolder, as shown below.Open
index.htmlin your browser to view the full interactive coverage report.🐛 Bug Fixes
dry-run command now supports test level grep.
v3.5.14Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🐛 Bug Fixes
joipackage - by @KobeNguyenTv3.5.13Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
[Webdriver] Added commands to check network traffics - supported only with devtoolsProtocol
startRecordingTrafficgrabRecordedNetworkTrafficsflushNetworkTrafficsstopRecordingTrafficseeTrafficdontSeeTrafficExamples:
Waits for the specified cookie in the cookies.
🐛 Bug Fixes
Adding of
':nth-child'into the arrayconst limitation = [':nth-of-type', ':first-of-type', ':last-of-type', ':nth-last-child', ':nth-last-of-type', ':checked', ':disabled', ':enabled', ':required', ':lang'];fixes the issue. Then an old conversion way overcss-to-xpathis used.📖 Documentation
🛩️ Several bugfixes and improvements for Codecept-UI
v3.5.12Compare Source
❤️ Thanks all to those who contributed to make this release! ❤️
🛩️ Features
feat: upgrade wdio (#4123) - by @KobeNguyenT
🛩️ With the release of WebdriverIO version
v8.14.0, and onwards, all driver management hassles are now a thing of the past 🙌. Read more here.One of the significant advantages of this update is that you can now get rid of any driver services you previously had to manage, such as
wdio-chromedriver-service,wdio-geckodriver-service,wdio-edgedriver-service,wdio-safaridriver-service, and even@wdio/selenium-standalone-service.For those who require custom driver options, fear not; WebDriver Helper allows you to pass in driver options through custom WebDriver configuration.
If you have a custom grid, use a cloud service, or prefer to run your own driver, there's no need to worry since WebDriver Helper will only start a driver when there are no other connection information settings like hostname or port specified.
Example:
Testing Chrome locally is now more convenient than ever. You can define a browser channel, and WebDriver Helper will take care of downloading the specified browser version for you.
For example:
Running with devtools protocol
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.