…-18613]

- Replace execSync() with execFileSync() in loadJsFile() to avoid shell
  interpolation of user-controlled cypress_config_filepath values
- Pass NODE_PATH via env option instead of shell command prefix, which
  works cross-platform (Unix and Windows) without shell metacharacters
- Add validateFilePath() defense-in-depth check that rejects paths
  containing shell metacharacters before they reach any exec call
- Update unit tests to verify execFileSync is called with array args
  and to confirm command injection payloads are rejected

Resolves: APS-18613

…X [APS-18613]

Address review feedback on PR #1080:

- Remove backslash (\) from DANGEROUS_PATH_CHARS regex so legitimate Windows
  absolute/relative paths (C:\Users\..., .\subdir\..., \\server\share\...) are
  no longer rejected. Backslash is a path separator on Windows, not a shell
  metacharacter — and the actual security boundary is execFileSync (no shell
  invocation), not the regex.

- Add an fs.existsSync() check inside loadJsFile() that throws a clear
  "Cypress config file not found at: <path>" error before invoking
  execFileSync. This is purely a UX improvement — existsSync alone would NOT
  prevent injection; the metacharacter regex + execFileSync remain the
  security guarantees.

- Update unit tests:
  * Add positive tests for Windows-style absolute, Program-Files (with
    spaces), relative (.\subdir\...) and UNC (\\server\share\...) paths
  * Add a positive test in loadJsFile that exercises the same Windows paths
    end-to-end without throwing
  * Add a test for the new file-not-found path that confirms execFileSync
    is NOT invoked when the file is missing
  * Update existsSync call-count assertion from calledOnce to calledTwice
    (UX check + cleanup unlink)

Resolves: APS-18613

…nd-injection-cypress-config

…nfig

…[APS-18800]

Fixes GHSA-5c6j-r48x-rmvq (RCE) and GHSA-qj8w-gfj5-8c6v (DoS) in the
transitive serialize-javascript dependency pulled in by mocha. Uses npm's
native `overrides` field — no third-party workarounds needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ascript-rce-aps-18800

[APS-18800] fix(security): upgrade serialize-javascript to 7.0.3 to fix RCE

Fix cy logs not appearing in dashboard for failing test

…nfig

…ction-cypress-config

[APS-18613] fix: prevent command injection via cypress_config_file in loadJsFile

…0.3 to fix RCE"

…erialize-javascript-rce-aps-18800

Revert "[APS-18800] fix(security): upgrade serialize-javascript to 7.0.3 to fix RCE"