diff --git a/package.json b/package.json
index 1cc3fa8002a3..273f353b88bb 100644
--- a/package.json
+++ b/package.json
@@ -158,7 +158,7 @@
     "lerna": "3.20.2",
     "lint-staged": "9.4.1",
     "listr": "0.14.3",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "make-empty-github-commit": "1.2.0",
     "minimist": "1.2.5",
     "mocha": "3.5.3",
diff --git a/packages/desktop-gui/package.json b/packages/desktop-gui/package.json
index 0b3786f69018..aea7829edea3 100644
--- a/packages/desktop-gui/package.json
+++ b/packages/desktop-gui/package.json
@@ -35,7 +35,7 @@
     "fira": "cypress-io/fira#fb63362742eea8cdce0d90825ab9264d77719e3d",
     "gravatar": "1.8.0",
     "human-interval": "1.0.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "markdown-it": "11.0.0",
     "mobx": "5.15.4",
     "mobx-react": "6.1.8",
diff --git a/packages/driver/cypress/fixtures/issue-1244.html b/packages/driver/cypress/fixtures/issue-1244.html
new file mode 100644
index 000000000000..3f89ed263104
--- /dev/null
+++ b/packages/driver/cypress/fixtures/issue-1244.html
@@ -0,0 +1,72 @@
+<script>
+  let setCounter = 0
+  let getCounter = 0
+  const { getAttribute, setAttribute } = HTMLElement.prototype
+  HTMLElement.prototype.getAttribute = function() {
+    if (this.tagName === 'FORM' || this.tagName === 'A') {
+      getCounter++
+    }
+    return getAttribute.apply(this, arguments)
+  }
+  HTMLElement.prototype.setAttribute = function(name) {
+    if (this.tagName === 'FORM' || this.tagName === 'A' && !name.startsWith('data-cypress')) {
+      setCounter++
+    }
+    return setAttribute.apply(this, arguments)
+  }
+  function handleEventTarget(e) {
+    if (e.target.target !== '_top') {
+      e.target.target = '_top'
+    }
+    if (e.target.target !== '_top') {
+      throw new Error('target property must be top')
+    }
+  }  
+  function handleEventAttribute(e) {
+    if (e.target.getAttribute('target') !== '_top') {
+      e.target.setAttribute('target', '_top')
+    }
+    if (e.target.getAttribute('target') !== '_top') {
+      throw new Error('Get Attribute must have top')
+    }
+  }
+  window.getCounters = () => {
+    return {
+      getCounter,
+      setCounter
+    }
+  }
+</script>
+<div>
+  <form method="GET" action="/fixtures/dom.html" onsubmit="handleEventTarget(event)">
+    <button class="setTarget" type="submit">Submit setTarget</button>
+  </form>
+  <form method="GET" action="/fixtures/dom.html" onsubmit="handleEventAttribute(event)">
+    <button class="setAttr" type="submit">Submit setAttribute</button>
+  </form>
+  <form target="_top" method="GET" action="/fixtures/dom.html">
+    <button class="inline_top" type="submit">Submit inline top</button>
+  </form>
+  <form target="_parent" method="GET" action="/fixtures/dom.html">
+    <button class="inline_parent" type="submit">Submit inline parent</button>
+  </form>
+  <form target="_self" method="GET" action="/fixtures/dom.html">
+    <button class="inline_self" type="submit">Submit inline self</button>
+  </form>
+  <form target="_blank" method="GET" action="/fixtures/dom.html">
+    <button class="inline_blank" type="submit">Submit blank</button>
+  </form>
+  <form target="invalid" method="GET" action="/fixtures/dom.html">
+    <button class="inline_invalid" type="submit">Submit invalid</button>
+  </form>
+  <div>
+    <a class="setTarget" href="/fixtures/dom.html" onclick="handleEventTarget(event)">Link setTarget</a>
+    <a class="setAttr" href="/fixtures/dom.html" onclick="handleEventAttribute(event)">Link setAttribute</a>
+    <a class="inline_top" href="/fixtures/dom.html" target="_top">Link top</a>
+    <a class="inline_parent" href="/fixtures/dom.html" target="_parent">Link parent</a>
+    <a class="inline_self" href="/fixtures/dom.html" target="_self">Link self</a>
+    <a class="inline_blank" href="/fixtures/dom.html" target="_blank">Link _blank</a>
+    <a class="inline_invalid" href="/fixtures/dom.html" target="invalid">Link invalid</a>
+  </div>
+  <iframe src="issue-1244.html">
+</div>
\ No newline at end of file
diff --git a/packages/driver/cypress/integration/commands/net_stubbing_spec.ts b/packages/driver/cypress/integration/commands/net_stubbing_spec.ts
index 9ae97e89046e..4fe69b71dfe8 100644
--- a/packages/driver/cypress/integration/commands/net_stubbing_spec.ts
+++ b/packages/driver/cypress/integration/commands/net_stubbing_spec.ts
@@ -681,6 +681,16 @@ describe('network stubbing', { retries: { runMode: 2, openMode: 0 } }, function
           // @ts-ignore
           cy.intercept({ wrong: true })
         })
+
+        it('times must be a positive integer', function (done) {
+          cy.on('fail', function (err) {
+            expect(err.message).to.include('`times` must be a positive integer.')
+            done()
+          })
+
+          cy
+          .intercept({ times: 9.75 })
+        })
       })
 
       context('with invalid handler', function () {
@@ -919,6 +929,101 @@ describe('network stubbing', { retries: { runMode: 2, openMode: 0 } }, function
         })
       })
     })
+
+    // https://github.com/cypress-io/cypress/issues/15050
+    describe('cors expose header', () => {
+      // a different domain from the page own domain
+      const corsUrl = 'http://diff.foobar.com:3501/cors'
+
+      before(() => {
+        cy.visit('http://127.0.0.1:3500/fixtures/dom.html')
+      })
+
+      it('headers option is not set => no expose-header', () => {
+        cy
+        .intercept('/cors*', {})
+        .as('corsRequest')
+        .then(() => {
+          return $.get(corsUrl)
+        })
+
+        cy.wait('@corsRequest').then((res) => {
+          let headers = res.response?.headers
+
+          expect(headers).to.not.have.property('access-control-expose-headers')
+        })
+      })
+
+      it('headers option only has the accessible headers from the cors request => no expose-header', () => {
+        cy
+        .intercept('/cors*', {
+          body: { success: true },
+          headers: {
+            'cache-control': 'no-cache',
+            'content-language': 'en-US',
+            'content-type': 'text/html',
+            'Expires': 'Wed, 21 Oct 2015 07:28:00 GMT',
+            'Last-Modified': 'Wed, 21 Oct 2015 07:28:00 GMT',
+            'Pragma': 'no-cache',
+          },
+        })
+        .as('corsRequest')
+        .then(() => {
+          return $.get(corsUrl)
+        })
+
+        cy.wait('@corsRequest').then((res) => {
+          let headers = res.response?.headers
+
+          expect(headers).to.not.have.property('access-control-expose-headers')
+        })
+      })
+
+      it('headers option does not have the accessible header => include expose-header', () => {
+        cy
+        .intercept('/cors*', {
+          body: { success: true },
+          headers: {
+            'cache-control': 'no-cache',
+            'content-language': 'en-US',
+            'x-token': 'token',
+          },
+        })
+        .as('corsRequest')
+        .then(() => {
+          return $.get(corsUrl)
+        })
+
+        cy.wait('@corsRequest').then((res) => {
+          let headers = res.response?.headers
+
+          expect(headers!['access-control-expose-headers']).to.eq('*')
+          expect(headers!['x-token']).to.eq('token')
+        })
+      })
+
+      it('headers option has access-control-expose-headers => does not override', () => {
+        cy
+        .intercept('/cors*', {
+          body: { success: true },
+          headers: {
+            'access-control-expose-headers': 'x-token',
+            'x-token': 'token',
+          },
+        })
+        .as('corsRequest')
+        .then(() => {
+          return $.get(corsUrl)
+        })
+
+        cy.wait('@corsRequest').then((res) => {
+          let headers = res.response?.headers
+
+          expect(headers!['access-control-expose-headers']).to.eq('x-token')
+          expect(headers!['x-token']).to.eq('token')
+        })
+      })
+    })
   })
 
   context('stubbing with static responses', function () {
@@ -1588,6 +1693,43 @@ describe('network stubbing', { retries: { runMode: 2, openMode: 0 } }, function
           })
         })
       })
+
+      context('with `times`', function () {
+        it('only uses each handler N times', function () {
+          const third = sinon.stub()
+
+          cy
+          .intercept({ url: '/foo*', times: 3 }, 'fourth').as('4')
+          .intercept({ url: '/foo*', times: 2 }, third).as('3')
+          .intercept({ url: '/foo*', times: 2 }, 'second').as('2')
+          .intercept({ url: '/foo*', times: 1 }, 'first').as('1')
+          .then(async () => {
+            const expectGet = (expected) => $.get('/foo').then((res) => expect(res).to.eq(expected))
+
+            await Promise.mapSeries([
+              'first',
+              'second',
+              'second',
+              'fourth',
+              'fourth',
+              'fourth',
+            ], expectGet)
+
+            expect(third).to.be.calledTwice
+
+            // now that matches are exhausted, it should fall through
+            await $.get('/foo').catch((xhr) => {
+              expect(xhr).to.include({
+                status: 404,
+              })
+            })
+          })
+          .get('@1.all').should('have.length', 1)
+          .get('@2.all').should('have.length', 2)
+          .get('@3.all').should('have.length', 2)
+          .get('@4.all').should('have.length', 3)
+        })
+      })
     })
 
     context('with StaticResponse shorthand', function () {
diff --git a/packages/driver/cypress/integration/issues/1244_spec.js b/packages/driver/cypress/integration/issues/1244_spec.js
new file mode 100644
index 000000000000..c712d8804e7b
--- /dev/null
+++ b/packages/driver/cypress/integration/issues/1244_spec.js
@@ -0,0 +1,82 @@
+describe('issue 1244', () => {
+  beforeEach(() => {
+    cy.visit('/fixtures/issue-1244.html').then(() => {
+      cy.on('window:before:unload', (e) => {
+        const win = cy.state('window')
+
+        expect(win.getCounters()).to.deep.equal({ getCounter: 0, setCounter: 0 })
+      })
+    })
+  })
+
+  for (const [el, target, action] of [['button', 'form', 'submit'], ['a', 'a', 'click']]) {
+    // <form> submit, <a> click
+    describe(`<${target}> ${action}`, () => {
+      it('correctly redirects when target=_top with target.target =', () => {
+        cy.get(`${el}.setTarget`).click()
+        cy.get('#dom').should('contain', 'DOM')
+        cy.url().should('include', 'dom.html')
+      })
+
+      it('correctly redirects when target=_top with setAttribute', () => {
+        cy.get(`${el}.setAttr`).click()
+        cy.get('#dom').should('contain', 'DOM')
+        cy.url().should('include', 'dom.html')
+      })
+
+      it('correctly redirects when target=_top inline in dom', () => {
+        cy.get(`${el}.inline_top`).click()
+        cy.get('#dom').should('contain', 'DOM')
+        cy.url().should('include', 'dom.html')
+      })
+
+      it('correctly redirects when target=_parent inline in dom', () => {
+        cy.get(`${el}.inline_parent`).click()
+        cy.get('#dom').should('contain', 'DOM')
+        cy.url().should('include', 'dom.html')
+      })
+
+      it('maintains behavior when target=_self', () => {
+        cy.get(`${el}.inline_self`).click()
+        cy.get('#dom').should('contain', 'DOM')
+        cy.url().should('include', 'dom.html')
+      })
+
+      it('maintains behavior when target=_blank,invalid', () => {
+        cy.get(`${el}.inline_blank`).click().then(() => {
+          cy.url().should('not.include', 'dom.html')
+        })
+
+        cy.get(`${el}.inline_invalid`).click().then(() => {
+          cy.url().should('not.include', 'dom.html')
+        })
+      })
+    })
+  }
+
+  describe('nested frame', () => {
+    it('does not strip form _parent', () => {
+      cy.get('iframe').then(($iframe) => {
+        const $el = $iframe.contents().find('button.inline_parent')
+
+        expect($el.closest('form')).to.have.attr('target', '_parent')
+
+        $el.trigger('click')
+      })
+
+      cy.get('#dom').should('contain', 'DOM')
+      cy.url().should('include', 'dom.html')
+    })
+
+    it('does not strip link _parent', () => {
+      cy.get('iframe').then(($iframe) => {
+        const $el = $iframe.contents().find('a.inline_parent')
+
+        $el[0].click()
+      })
+
+      cy.get('#dom').should('contain', 'DOM')
+      cy.url().should('include', 'dom.html')
+    })
+  })
+})
diff --git a/packages/driver/package.json b/packages/driver/package.json
index 5cd8d58ba96d..8e7431c37b80 100644
--- a/packages/driver/package.json
+++ b/packages/driver/package.json
@@ -51,7 +51,7 @@
     "jquery.scrollto": "2.1.2",
     "js-cookie": "2.2.1",
     "jsdom": "14.1.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "md5": "2.3.0",
     "method-override": "3.0.0",
     "methods": "1.1.2",
diff --git a/packages/driver/src/cy/listeners.js b/packages/driver/src/cy/listeners.js
index 66681ea5c699..6760cd240853 100644
--- a/packages/driver/src/cy/listeners.js
+++ b/packages/driver/src/cy/listeners.js
@@ -1,4 +1,5 @@
 const _ = require('lodash')
+const { handleInvalidEventTarget, handleInvalidAnchorTarget } = require('./top_attr_guards')
 
 const HISTORY_ATTRS = 'pushState replaceState'.split(' ')
 
@@ -9,9 +10,9 @@ const removeAllListeners = () => {
   listenersAdded = false
 
   for (let e of events) {
-    const [win, event, cb] = e
+    const [win, event, cb, capture] = e
 
-    win.removeEventListener(event, cb)
+    win.removeEventListener(event, cb, capture)
   }
 
   // reset all the events
@@ -20,10 +21,10 @@ const removeAllListeners = () => {
   return null
 }
 
-const addListener = (win, event, fn) => {
-  events.push([win, event, fn])
+const addListener = (win, event, fn, capture) => {
+  events.push([win, event, fn, capture])
 
-  win.addEventListener(event, fn)
+  win.addEventListener(event, fn, capture)
 }
 
 const eventHasReturnValue = (e) => {
@@ -101,6 +102,11 @@ module.exports = {
       return callbacks.onSubmit(e)
     })
 
+    // Handling the situation where "_top" is set on the <form> / <a> element, either in
+    // html or dynamically, by tapping in at the capture phase of the events
+    addListener(contentWindow, 'submit', handleInvalidEventTarget, true)
+    addListener(contentWindow, 'click', handleInvalidAnchorTarget, true)
+
     contentWindow.alert = callbacks.onAlert
     contentWindow.confirm = callbacks.onConfirm
   },
diff --git a/packages/driver/src/cy/net-stubbing/add-command.ts b/packages/driver/src/cy/net-stubbing/add-command.ts
index 85a055105d8b..91eb77692aea 100644
--- a/packages/driver/src/cy/net-stubbing/add-command.ts
+++ b/packages/driver/src/cy/net-stubbing/add-command.ts
@@ -130,6 +130,10 @@ function validateRouteMatcherOptions (routeMatcher: RouteMatcherOptions): { isVa
     return err('`port` must be a number or a list of numbers.')
   }
 
+  if (_.has(routeMatcher, 'times') && (!_.isInteger(routeMatcher.times) || Number(routeMatcher.times) <= 0)) {
+    return err('`times` must be a positive integer.')
+  }
+
   if (_.has(routeMatcher, 'headers')) {
     const knownFieldNames: string[] = []
 
diff --git a/packages/driver/src/cy/top_attr_guards.ts b/packages/driver/src/cy/top_attr_guards.ts
new file mode 100644
index 000000000000..f187ee142800
--- /dev/null
+++ b/packages/driver/src/cy/top_attr_guards.ts
@@ -0,0 +1,61 @@
+import * as $elements from '../dom/elements'
+
+const invalidTargets = new Set(['_parent', '_top'])
+
+/**
+ * Guard against target beting set to something other than blank or self, while trying
+ * to preserve the appearance of having the correct target value.
+ */
+export function handleInvalidEventTarget (e: Event & {target: HTMLFormElement | HTMLAnchorElement}) {
+  let targetValue = e.target.target
+
+  if (invalidTargets.has(e.target.target)) {
+    e.target.target = ''
+  }
+
+  const { getAttribute, setAttribute } = e.target
+  const targetDescriptor = Object.getOwnPropertyDescriptor(e.target, 'target')
+
+  e.target.getAttribute = function (k) {
+    if (k === 'target') {
+      return targetValue
+    }
+
+    return getAttribute.call(this, k)
+  }
+
+  e.target.setAttribute = function (k, v) {
+    if (k === 'target') {
+      targetValue = v
+
+      return $elements.callNativeMethod(this, 'setAttribute', 'cyTarget', v)
+    }
+
+    return setAttribute.call(this, k, v)
+  }
+
+  if (!targetDescriptor) {
+    Object.defineProperty(e.target, 'target', {
+      configurable: false,
+      set (value) {
+        return targetValue = value
+      },
+      get () {
+        return targetValue
+      },
+    })
+  }
+}
+
+/**
+ * We need to listen to all click events on the window, but only handle anchor elements,
+ * as those might be the ones where we have an incorrect "target" attr, or could have one
+ * dynamically set in subsequent event bubbling.
+ *
+ * @param e
+ */
+export function handleInvalidAnchorTarget (e: Event & {target: HTMLAnchorElement}) {
+  if (e.target.tagName === 'A') {
+    handleInvalidEventTarget(e)
+  }
+}
diff --git a/packages/driver/src/dom/elements.ts b/packages/driver/src/dom/elements.ts
index caa908c4c305..465632c72571 100644
--- a/packages/driver/src/dom/elements.ts
+++ b/packages/driver/src/dom/elements.ts
@@ -256,6 +256,7 @@ const nativeMethods = {
   addRange: window.Selection.prototype.addRange,
   execCommand: window.document.execCommand,
   getAttribute: window.Element.prototype.getAttribute,
+  setAttribute: window.Element.prototype.setAttribute,
   setSelectionRange: _nativeSetSelectionRange,
   modify: window.Selection.prototype.modify,
   focus: _nativeFocus,
diff --git a/packages/electron/package.json b/packages/electron/package.json
index dc2bd6328e73..393751786549 100644
--- a/packages/electron/package.json
+++ b/packages/electron/package.json
@@ -20,7 +20,7 @@
     "debug": "4.3.2",
     "electron-packager": "14.1.1",
     "fs-extra": "8.1.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "minimist": "1.2.5"
   },
   "devDependencies": {
diff --git a/packages/extension/package.json b/packages/extension/package.json
index 5b91d69ad91c..41b50e8fb6ef 100644
--- a/packages/extension/package.json
+++ b/packages/extension/package.json
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "bluebird": "3.5.3",
-    "lodash": "4.17.19"
+    "lodash": "4.17.21"
   },
   "devDependencies": {
     "@cypress/icons": "0.7.0",
diff --git a/packages/https-proxy/package.json b/packages/https-proxy/package.json
index d3ccc474698e..7c26d7709bb5 100644
--- a/packages/https-proxy/package.json
+++ b/packages/https-proxy/package.json
@@ -17,7 +17,7 @@
     "bluebird": "3.5.3",
     "debug": "4.3.2",
     "fs-extra": "8.1.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "node-forge": "0.10.0",
     "semaphore": "1.1.0"
   },
diff --git a/packages/launcher/package.json b/packages/launcher/package.json
index 12c474cc18c0..ea74e906adda 100644
--- a/packages/launcher/package.json
+++ b/packages/launcher/package.json
@@ -17,7 +17,7 @@
     "debug": "4.3.2",
     "execa": "4.0.0",
     "fs-extra": "8.1.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "plist": "3.0.1",
     "ramda": "0.27.1"
   },
diff --git a/packages/net-stubbing/lib/external-types.ts b/packages/net-stubbing/lib/external-types.ts
index 5b45c3d22847..3f65d49d2770 100644
--- a/packages/net-stubbing/lib/external-types.ts
+++ b/packages/net-stubbing/lib/external-types.ts
@@ -364,6 +364,10 @@ export interface RouteMatcherOptionsGeneric<S> {
    * Match on parsed querystring parameters.
    */
   query?: DictMatcher<S>
+  /**
+   * If set, this `RouteMatcher` will only match the first `times` requests.
+   */
+  times?: number
   /**
    * Match against the full request URL.
    * If a string is passed, it will be used as a substring match,
diff --git a/packages/net-stubbing/lib/internal-types.ts b/packages/net-stubbing/lib/internal-types.ts
index 108d6a07e7e1..a47db7d183c9 100644
--- a/packages/net-stubbing/lib/internal-types.ts
+++ b/packages/net-stubbing/lib/internal-types.ts
@@ -31,7 +31,7 @@ export const SERIALIZABLE_RES_PROPS = _.concat(
   'throttleKbps',
 )
 
-export const PLAIN_FIELDS: (keyof RouteMatcherOptionsGeneric<any>)[] = ['https', 'port', 'middleware']
+export const PLAIN_FIELDS: (keyof RouteMatcherOptionsGeneric<any>)[] = ['https', 'port', 'middleware', 'times']
 
 export const DICT_STRING_MATCHER_FIELDS: (keyof RouteMatcherOptionsGeneric<any>)[] = ['headers', 'query']
 
diff --git a/packages/net-stubbing/lib/server/driver-events.ts b/packages/net-stubbing/lib/server/driver-events.ts
index 86abcc6761d5..4bfb7f8d89ef 100644
--- a/packages/net-stubbing/lib/server/driver-events.ts
+++ b/packages/net-stubbing/lib/server/driver-events.ts
@@ -35,6 +35,7 @@ async function onRouteAdded (state: NetStubbingState, getFixture: GetFixtureFn,
     staticResponse: options.staticResponse,
     routeMatcher,
     getFixture,
+    matches: 0,
   }
 
   state.routes.push(route)
diff --git a/packages/net-stubbing/lib/server/intercepted-request.ts b/packages/net-stubbing/lib/server/intercepted-request.ts
index b948a730a5ba..54093642cba2 100644
--- a/packages/net-stubbing/lib/server/intercepted-request.ts
+++ b/packages/net-stubbing/lib/server/intercepted-request.ts
@@ -175,7 +175,7 @@ export class InterceptedRequest {
         }
       }
 
-      for (const { subscriptions, immediateStaticResponse } of this.subscriptionsByRoute) {
+      for (const { routeId, subscriptions, immediateStaticResponse } of this.subscriptionsByRoute) {
         for (const subscription of subscriptions) {
           await handleSubscription(subscription)
 
@@ -184,10 +184,20 @@ export class InterceptedRequest {
           }
         }
 
-        if (eventName === 'before:request' && immediateStaticResponse) {
-          sendStaticResponse(this, immediateStaticResponse)
+        if (eventName === 'before:request') {
+          const route = this.matchingRoutes.find(({ id }) => id === routeId) as BackendRoute
 
-          return data
+          route.matches++
+
+          if (route.routeMatcher.times && route.matches >= route.routeMatcher.times) {
+            route.disabled = true
+          }
+
+          if (immediateStaticResponse) {
+            sendStaticResponse(this, immediateStaticResponse)
+
+            return data
+          }
         }
       }
     }
diff --git a/packages/net-stubbing/lib/server/route-matching.ts b/packages/net-stubbing/lib/server/route-matching.ts
index 1e9b09f43bd8..8a6fd655e1ca 100644
--- a/packages/net-stubbing/lib/server/route-matching.ts
+++ b/packages/net-stubbing/lib/server/route-matching.ts
@@ -133,7 +133,7 @@ export function getRouteForRequest (routes: BackendRoute[], req: CypressIncoming
   const possibleRoutes = prevRoute ? orderedRoutes.slice(_.findIndex(orderedRoutes, prevRoute) + 1) : orderedRoutes
 
   for (const route of possibleRoutes) {
-    if (_doesRouteMatch(route.routeMatcher, req)) {
+    if (!route.disabled && _doesRouteMatch(route.routeMatcher, req)) {
       return route
     }
   }
diff --git a/packages/net-stubbing/lib/server/types.ts b/packages/net-stubbing/lib/server/types.ts
index 97f0b64327de..92f39d7ec638 100644
--- a/packages/net-stubbing/lib/server/types.ts
+++ b/packages/net-stubbing/lib/server/types.ts
@@ -14,6 +14,8 @@ export interface BackendRoute {
   hasInterceptor: boolean
   staticResponse?: BackendStaticResponse
   getFixture: GetFixtureFn
+  matches: number
+  disabled?: boolean
 }
 
 export interface NetStubbingState {
diff --git a/packages/net-stubbing/lib/server/util.ts b/packages/net-stubbing/lib/server/util.ts
index dd523333cd17..c5b54810f6d8 100644
--- a/packages/net-stubbing/lib/server/util.ts
+++ b/packages/net-stubbing/lib/server/util.ts
@@ -104,6 +104,28 @@ export function setDefaultHeaders (req: CypressIncomingRequest, res: IncomingMes
     }
   }
 
+  // https://github.com/cypress-io/cypress/issues/15050
+  // Check if res.headers has a custom header.
+  // If so, set access-control-expose-headers to '*'.
+  const hasCustomHeader = Object.keys(res.headers).some((header) => {
+    // The list of header items that can be accessed from cors request
+    // without access-control-expose-headers
+    // @see https://stackoverflow.com/a/37931084/1038927
+    return ![
+      'cache-control',
+      'content-language',
+      'content-type',
+      'expires',
+      'last-modified',
+      'pragma',
+    ].includes(header.toLowerCase())
+  })
+
+  // We should not override the user's access-control-expose-headers setting.
+  if (hasCustomHeader && !res.headers['access-control-expose-headers']) {
+    setDefaultHeader('access-control-expose-headers', _.constant('*'))
+  }
+
   setDefaultHeader('access-control-allow-origin', () => caseInsensitiveGet(req.headers, 'origin') || '*')
   setDefaultHeader('access-control-allow-credentials', _.constant('true'))
 }
diff --git a/packages/net-stubbing/test/unit/intercepted-request-spec.ts b/packages/net-stubbing/test/unit/intercepted-request-spec.ts
index fc5bbb007393..9070920dc53f 100644
--- a/packages/net-stubbing/test/unit/intercepted-request-spec.ts
+++ b/packages/net-stubbing/test/unit/intercepted-request-spec.ts
@@ -19,11 +19,13 @@ describe('InterceptedRequest', () => {
           {
             id: '1',
             hasInterceptor: true,
+            routeMatcher: {},
           },
           // @ts-ignore
           {
             id: '2',
             hasInterceptor: true,
+            routeMatcher: {},
           },
         ],
       })
diff --git a/packages/network/package.json b/packages/network/package.json
index 3fb798f674ca..e22fc2ac74d7 100644
--- a/packages/network/package.json
+++ b/packages/network/package.json
@@ -17,7 +17,7 @@
     "bluebird": "3.5.3",
     "concat-stream": "1.6.2",
     "debug": "4.3.2",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "proxy-from-env": "1.0.0"
   },
   "devDependencies": {
diff --git a/packages/reporter/package.json b/packages/reporter/package.json
index df5e97a6b005..832bdf0371f0 100644
--- a/packages/reporter/package.json
+++ b/packages/reporter/package.json
@@ -22,7 +22,7 @@
     "css-element-queries": "1.2.3",
     "cypress-multi-reporters": "1.4.0",
     "cypress-real-events": "1.4.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "markdown-it": "11.0.0",
     "mobx": "5.15.4",
     "mobx-react": "6.1.8",
diff --git a/packages/runner-ct/cypress/component/SpecList.spec.tsx b/packages/runner-ct/cypress/component/SpecList.spec.tsx
index 5c5fffcde4d2..f1cd096e3d11 100644
--- a/packages/runner-ct/cypress/component/SpecList.spec.tsx
+++ b/packages/runner-ct/cypress/component/SpecList.spec.tsx
@@ -74,7 +74,10 @@ describe('SpecList', () => {
 
     mount(<Subject />, { styles })
 
-    cy.get('div').contains('dog.spec.tsx').click().then(() => {
+    cy.get('div')
+    .contains('dog.spec.tsx')
+    .click()
+    .then(() => {
       expect(selectStub).to.have.been.calledWith('qux/dog.spec.tsx')
     })
   })
@@ -87,7 +90,10 @@ describe('SpecList', () => {
     cy.get('div').contains('dog.spec.tsx').should('exist')
 
     // qux folder contains dog.spec.tsx. If we close it, it should not exist anymore.
-    cy.get('div').contains('qux').click().then(() => {
+    cy.get('div')
+    .contains('qux')
+    .click()
+    .then(() => {
       cy.get('div').contains('dog.spec.tsx').should('not.exist')
     })
   })
@@ -139,7 +145,7 @@ describe('SpecList', () => {
 
     mount(<Subject />, { styles })
 
-    cy.get('[placeholder="Find spec..."').click()
+    cy.get('[placeholder="Find spec..."]').click()
 
     // all specs visible initially.
     cy.get('div').contains('foo.spec.js').should('exist')
@@ -152,16 +158,15 @@ describe('SpecList', () => {
     cy.get('div').contains('dog.spec.tsx').should('not.exist')
     cy.get('div').contains('cat.spec.ts').should('exist')
 
-    // Wait to ensure typing has completed and React has rerendered
-    cy.wait(10).then(() => {
+    cy.then(() => {
       // the found folder characters, rp
       ['r', 'p'].forEach((char) => {
-        cy.get('[title="merp"] > div > span span').contains(char)
+        cy.get('[title="merp"] > div > span span').should('contain', char)
       })
 
       // the found file characters, ct.ts, should be bold via <span>
       ;['c', 'a', 't', '.', 't', 's'].forEach((char) => {
-        cy.get('[title="merp/cat.spec.ts"] > span span').contains(char)
+        cy.get('[title="merp/cat.spec.ts"] > span span').should('contain', char)
       })
     })
   })
diff --git a/packages/runner/package.json b/packages/runner/package.json
index d9c56134ac85..82bc1daa81ba 100644
--- a/packages/runner/package.json
+++ b/packages/runner/package.json
@@ -43,7 +43,7 @@
     "enzyme-adapter-react-16": "1.15.2",
     "jquery": "3.1.1",
     "jsdom": "14.1.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "mobx": "5.15.4",
     "mobx-react": "6.1.8",
     "mocha": "7.0.1",
diff --git a/packages/server/lib/util/env-editors.ts b/packages/server/lib/util/env-editors.ts
index 2be0efb681d3..ab29b264f002 100644
--- a/packages/server/lib/util/env-editors.ts
+++ b/packages/server/lib/util/env-editors.ts
@@ -129,7 +129,7 @@ const windowsEditors = [
     name: 'Brackets',
   }, {
     id: 'code',
-    binary: 'Code.exe',
+    binary: 'code',
     name: 'Visual Studio Code',
   }, {
     id: 'atom',
diff --git a/packages/server/package.json b/packages/server/package.json
index 82d48ca21e4d..0c7423d65dd4 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -78,7 +78,7 @@
     "launch-editor": "2.2.1",
     "lazy-ass": "1.6.0",
     "lockfile": "1.0.4",
-    "lodash": "4.17.19",
+    "lodash": "4.17.21",
     "log-symbols": "2.2.0",
     "marionette-client": "cypress-io/marionette-client#2cddf7d791cca7be5191d7fe103d58be7283957d",
     "md5": "2.3.0",
diff --git a/yarn.lock b/yarn.lock
index c0f069f49746..cb0261705627 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -24273,16 +24273,16 @@ lodash@4.17.20:
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.20.tgz#b44a9b6297bcb698f1c51a3545a2b3b368d59c52"
   integrity sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==
 
+lodash@4.17.21, "lodash@>=3.5 <5", lodash@^4.13.1, lodash@^4.14.0, lodash@^4.16.2, lodash@^4.16.4, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.13, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.3, lodash@^4.17.4, lodash@^4.17.5, lodash@^4.2.1, lodash@^4.3.0, lodash@~4.17.2:
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
+  integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
+
 lodash@4.17.4:
   version "4.17.4"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.4.tgz#78203a4d1c328ae1d86dca6460e369b57f4055ae"
   integrity sha1-eCA6TRwyiuHYbcpkYONptX9AVa4=
 
-"lodash@>=3.5 <5", lodash@^4.13.1, lodash@^4.14.0, lodash@^4.16.2, lodash@^4.16.4, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.13, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.3, lodash@^4.17.4, lodash@^4.17.5, lodash@^4.2.1, lodash@^4.3.0, lodash@~4.17.2:
-  version "4.17.21"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
-  integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
-
 lodash@^3.1.0, lodash@^3.10.0, lodash@^3.5.0, lodash@^3.7.0, lodash@^3.9.3:
   version "3.10.1"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-3.10.1.tgz#5bf45e8e49ba4189e17d482789dfd15bd140b7b6"