<p><strong>TLDR:</strong> Cypress quietly enabled canvas capture for all Cloud projects this week, removing a long-standing gap in test replay. A nasty WebSocket vulnerability in Storybook’s dev server can escalate to RCE through your CI pipeline and needs immediate patching. The PHP testing ecosystem had a busy week with PHPUnit 12.3, Laravel 13.3, and a new framework called Testo entering beta. And the conversation around AI-generated code and what it means for testing keeps getting louder.</p>
<hr>
<h2>Cypress Test Replay now captures canvas by default</h2>
<p>Cypress flipped canvas capture from opt-in to on-by-default for all Cypress Cloud projects. No config changes needed, no version bump required — it just works now. Two gaps remain: canvas inside Shadow DOM still isn’t captured, and you need Cypress 15.5.0 or later for the feature to function at all. A project-level toggle exists in Cloud settings if the performance hit matters to your suite.</p>
<hr>
<h2>Storybook WebSocket RCE (CVE-2026-27148)</h2>
<p>This one’s worth stopping what you’re doing for. Storybook’s dev server exposes a WebSocket endpoint at <code>/storybook-server-channel</code> with zero authentication or origin validation. An attacker can send crafted messages that inject arbitrary JavaScript into story source files on disk. Those files can get committed to version control, and when Vitest or another test runner executes them in Node.js, you’ve got RCE — with access to credentials, the filesystem, and your CI/CD pipeline. Publicly exposed dev servers require no user interaction to exploit. Patched versions are 7.6.23, 8.6.17, 9.1.19, and 10.2.10.</p>
<hr>
<h2>PHPUnit 12.3 and the PHP testing ecosystem</h2>
<p>PHPUnit 12.3 shipped two features that came directly out of Sebastian Bergmann’s training courses: per-test-suite bootstrap scripts (long requested, finally done) and a <code>#[TestDoxFormatter]</code> attribute for fully custom TestDox output. Separately, Laravel 13.3.0 added a <code>#[UnitTest]</code> attribute that skips full framework boot for individual test methods — useful when you want faster pure unit tests inside an integration test class without splitting files. There’s also a new PHP testing framework called Testo in beta, built from scratch with a plugin-based architecture, inline tests, and typed assertion chains. It’s not ready for production yet but worth watching.</p>
<hr>
<h2>AI agents and the testing feedback loop</h2>
<p>A few threads this week converged on the same idea: AI coding agents produce better output when they have fast, reliable test feedback. One post described using mirrord to let agents run E2E tests against real Kubernetes cluster dependencies locally, cutting iteration from twenty rounds to one or two. Another made the case that higher test coverage directly determines how much autonomy you can safely hand to an agent. SmartBear also announced AI additions across its testing suite, citing their own survey data that 70% of QA decision-makers are worried AI-accelerated code creation is outpacing testing capacity. That number feels about right.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>git_bayesect:</strong> A Python tool that extends <code>git bisect</code> with Bayesian inference for flaky or probabilistic test failures, using Beta-Bernoulli conjugacy and greedy entropy minimization to pick the most informative commit to test next.</li>
<li><strong>PAO for PHP:</strong> Nuno Maduro’s tool detects when tests run inside AI agent environments (Claude Code, Cursor, Devin) and replaces verbose output with compact JSON, cutting token usage by up to 99.8% for Pest.</li>
<li><strong>Qodo AntiSlop Scanner:</strong> Scanned the open-interpreter project and found 46 issues across 10 PRs including at least one security flaw; Qodo’s free scanner reports an average of ~2 issues per merged PR.</li>
<li><strong>Toxiproxy for TypeScript SDKs:</strong> A practical guide to injecting real network failures (latency, timeouts, resets) via Toxiproxy and Docker Compose to verify SDK retry logic actually works, automated in Vitest.</li>
<li><strong>Mesa 26.1 GPU reset simulation:</strong> Setting <code>LP_CONTEXT_RESET_FILE</code> lets you trigger an emulated GPU reset via LLVMpipe without real hardware, useful for testing how Wayland compositors handle reset scenarios.</li>
<li><strong>Vitest migration for Angular:</strong> A conference talk covering progressive migration from Jest/Karma to Vitest, real-browser test execution via Vitest browser mode with Playwright, and a preview of Testronaut for mounting Angular components directly in Playwright.</li>
<li><strong>Porcupine linearizability checker:</strong> A Go tool for testing distributed systems against linearizability, described as thousands of times faster than the existing Knossos tool, handling histories with thousands of events in seconds.</li>
<li><strong>CI trust tax framework:</strong> Three metrics flagged as danger zones — re-run rate above 30%, time to confidence over 10 minutes, override rate above 5% — with automatic quarantine recommended for tests passing 60–90% of the time.</li>
<li><strong>gengo Go library:</strong> Zero-dependency random test data generation for Go, sub-5ns for most operations, requires Go 1.26.</li>
<li><strong>Xdebug vs PCOV:</strong> Bergmann is switching back to Xdebug 3 after five years preferring PCOV, citing PCOV’s uncertain maintenance future (last released 2021, broken on PHP 8.4) and Xdebug 3’s <code>xdebug.mode</code> making it practical for daily use.</li>
</ul>


Testing strategies, CI/CD pipelines, code quality, and test automation.

Testing Digest

A roundup of notable testing ecosystem news: Cypress now captures canvas by default in Cloud projects (requires v15.5.0+). A critical Storybook WebSocket vulnerability (CVE-2026-27148) allows RCE through unauthenticated WebSocket messages that can inject JS into story files — patched versions are available across all major branches. PHPUnit 12.3 adds per-suite bootstrap scripts and custom TestDox formatters; Laravel 13.3 adds a #[UnitTest] attribute for faster unit tests; a new PHP framework called Testo enters beta. AI coding agents are shown to produce better output with fast test feedback loops, with tools like mirrord enabling local E2E tests against real Kubernetes clusters. Also covered: git_bayesect for flaky test bisection, PAO for compact test output in AI agent environments, Toxiproxy for TypeScript SDK resilience testing, Vitest migration for Angular, and a CI trust framework with concrete danger-zone metrics.

Cypress canvas capture goes default, Storybook WebSocket RCE needs patching now