Environment Variable Access in Cypress v15.10.0+: Migrating to cy.env() and Cypress.expose()
Blog post from Cypress
Starting with Cypress version 15.10.0, the function Cypress.env() has been deprecated due to its potential to unintentionally expose environment values in the browser context, with plans for its removal in version 16.0.0. This change is a proactive measure to enhance security by ensuring more explicit control over how configuration values are exposed during test execution, despite no reported exploitations of the current method. Users are advised to migrate to using cy.env() for sensitive values and Cypress.expose() for those safe to expose, while also reviewing and upgrading plugins that rely on the deprecated function. Additionally, setting 'allowCypressEnv: false' in configurations will enforce the migration by causing failures with guidance messages. For users unable to upgrade immediately, a temporary mitigation involves moving sensitive value handling to cy.task() in Cypress versions 12.5.0 and later. The migration process is supported by detailed guides and collaboration with the community to ensure a smooth transition.