What changed in CyberChef from 10 to 11

This release includes a security fix

• Security: patch XSS in Regular expression module [@Ne0re0]
• chore (deps): bump @codemirror/view from 6.43.8 to 6.43.9 in the patch-updates group | [#2731]
• chore (deps): bump @codemirror/commands from 6.10.4 to 6.11.0 in the minor-updates group | [#2732]
• Add XPRESS (MS-XCA) decompression operations [@MP-GOWTHAM] | [#2722]
• Feat/node 26 support [@alleria173] | [#2699]
• chore(root): update allowlist [@evenstensberg] | [#2713]
• chore (deps): bump the patch-updates group across 1 directory with 7 updates | [#2730]
• chore (deps): bump the minor-updates group across 1 directory with 9 updates | [#2729]
• chore (deps): bump docker/login-action from 4.5.2 to 4.6.0 in the actions-dependencies group | [#2716]
• chore (deps): bump node from a0b9bf0 to d32cdf6 in the docker-dependencies group | [#2723]
• docs(root): improve docs a bit [@evenstensberg] | [#2718]
• fix: use js-yaml for both JSON to YAML and YAML to JSON [@bartvanandel] | [#2710]
• chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2712]
• chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2705]
• chore (deps): bump the actions-dependencies group with 2 updates | [#2703]
• fix: replace shasum / sha256sum / sed calls with node built-ins [@bartvanandel] | [#2019]
• chore (deps): bump fast-uri from 3.1.4 to 3.1.5 | [#2709]
• chore (deps): bump ip-address from 10.2.0 to 10.4.0 | [#2708]
• fix: stop Parse QR Code from participating in Magic (#2610) [@Sanjays2402] | [#2613]
• Restrict A1Z26 Magic checks to valid ranges [@vetrovk] | [#2644]
• feat: Extend automated ingredient validation to include argSelector ingredients (#2641) [@mansiverma897993] | [#2643]
• Add Modular Exponentiation operation [@p-leriche] | [#2149]
• Add npm allowScripts policy for npm v12 [@zainnadeem786] | [#2682]
• chore (deps): bump assorted vulnerable dependencies [@GCHQDeveloper581] | [#2689]
• chore (deps): bump shell-quote from 1.8.4 to 1.10.0 | [#2690]
• chore (deps): bump the patch-updates group across 1 directory with 9 updates | [#2686]
• chore (deps): bump the actions-dependencies group across 1 directory with 2 updates | [#2685]
• chore (deps): bump nginxinc/nginx-unprivileged from fd3314e to 44e3633 in the docker-dependencies group | [#2684]

This release includes a security fix ([#2687])

• Security: Fix pretty recipe parser ReDoS [@zainnadeem786] | [#2687]
• feat: add modulo operation [@thomasnemer] [@GCHQDeveloper581] | [#2103]
• Add HMAC regression tests for Decimal key parsing [@alleria173] | [#2680]
• fix: await Node API operations whose run() returns a non-async Promise [@roberson-io] | [#2659]
• chore (deps): bump morgan from 1.10.1 to 1.11.0 | [#2676]
• fix: fromDecimal Auto delimiter now correctly parses multiple numbers [@min23asdw] | [#2270]
• Add Generate Prime Number operation [@p-leriche] | [#2212]
• Add Modular Inverse operation [@p-leriche] | [#2207]
• Consolidate HTML entity tables into a single spec-generated source (#2645) [@roberson-io] | [#2671]
• Add Extended GCD operation [@p-leriche] | [#2206]
• Add COBS encoding/decoding operations [@giesmininkas] | [#2185]
• chore (deps): bump websocket-driver from 0.7.4 to 0.7.5 | [#2673]
• fix: remove stray punctuation from malformed To HTML Entity table values [@roberson-io] | [#2660]
• chore (deps): bump the actions-dependencies group across 1 directory with 6 updates | [#2668]
• chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2669]
• chore (deps): bump the patch-updates group with 5 updates | [#2654]
• feat: add TEA and XTEA block ciphers [@thomasxm] | [#2225]
• feat: add PRESENT and Twofish ciphers [@thomasxm] | [#2157]
• fix: support constructor and proto parameters in Parse URI (#2578) [@mansiverma897993] | [#2581]
• feat: Implement automated option-type ingredient validation [@mansiverma897993] | [#2625]
• Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt [@thomasxm] | [#2155]
• chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2638]
• chore (deps): bump webpack from 5.107.2 to 5.108.3 in the minor-updates group | [#2635]
• chore (deps): bump nginxinc/nginx-unprivileged from 458ecbe to fd3314e in the docker-dependencies group | [#2633]
• Feature: automatically expire PRs if CLA remains unsigned for an extended period [@GCHQDeveloper581] | [#2636]
• fix/2445 HOTP (and 2426 TOTP) type errors [@alleria173] | [#2620]
• Fix base32 unicode alphabet [@loki1205] | [#2380]
• Add a workflow to automatically flag PRs without a signed CLA [@GCHQDeveloper581] | [#2627]
• fix/2444 TOTP input validation for correct otpauth uri generation [@alleria173] | [#2621]
• Validate Wrap line width [@vetrovk] [@GCHQDeveloper581] [@C85297] | [#2606]
• Handle malformed image parser errors in View Bit Plane [@zainnadeem786] | [#2612]
• Fixes #2446 hotp otpauth uri validation [@alleria173] | [#2614]
• Handle invalid bcrypt salt errors in Bcrypt compare [@zainnadeem786] | [#2615]
• Validate empty Show On Map options [@vetrovk] | [#2631]
• Create AGENTS.md file [@C85297] | [#2619]
• Set parameter validation Metadata for GenerateImage operations [@GCHQDeveloper581] | [#2611]
• Update 4 vulnerable dependencies [@GCHQDeveloper581] | [#2616]
• Fix BigNumber deserialisation in Dish, and add tests [@GCHQDeveloper581] | [#2607]
• chore (deps): bump the docker-dependencies group with 2 updates | [#2600]
• chore (deps): bump the patch-updates group with 8 updates | [#2602]
• chore (deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions-dependencies group | [#2601]
• chore (deps): bump the minor-updates group with 2 updates | [#2603]
• Handle empty Generate Image mode [@vetrovk] | [#2598]
• Fix stale presenter after expected operation errors [@zainnadeem786] [@GCHQDeveloper581] | [#2589]
• Clean up/rationalise webpack paths and thereby increase compatibility for Win… [@GCHQDeveloper581] | [#2585]
• Improve parameter validation for a number of operations where exceptions otherwise caused. [@GCHQDeveloper581] | [#2586]
• Fix uncaught TypeError in "Show on map" operation. [@lzandman] | [#2453]
• fix: jsonata $base64decode/$base64encode in Web Worker [@min23asdw] | [#2275]
• fix Dechunk HTTP Response leaks terminating chunk and trailers into output [@williballenthin] | [#2290]
• fix: MIME Decoding corrupts non-ASCII characters in Base64-encoded words [@williballenthin] | [#2291]
• fix: Gzip comment with header checksum produces corrupt streams [@williballenthin] | [#2288]
• fix TLV Parser BER long-form length parsing [@williballenthin] | [#2289]
• fix: Unescape Unicode Characters accepts 4-6 hex digits for U+ prefix [@williballenthin] | [#2287]
• fix Set Difference and Set Intersection preserve duplicates from first sample [@williballenthin] | [#2286]
• fix: From Base operation produces wrong results for fractional inputs [@williballenthin] | [#2285]
• fix Median operation returns incorrect result for unsorted odd-length inputs [@williballenthin] | [#2284]
• Added RenderPDF functionality [@Shailendra1703] [@GCHQDeveloper581] | [#2105]
• Fix URL encoding incorrectly converting input to UTF-8 [@C85297] | [#2340]
• feat: Add automated parameter validation framework [@mansiverma897993] | [#2561]
• Fix: added viewport styles to img tag in RenderImage Dish [@Shailendra1703] [@C85297] | [#2109]
• chore (deps): bump form-data from 4.0.5 to 4.0.6 | [#2572]
• chore (deps): bump the patch-updates group with 5 updates [@GCHQDeveloper581] | [#2580]
• chore (deps): bump the docker-dependencies group with 2 updates | [#2579]
• Fix operation description rendering [@C85297] | [#2577]
• chore (deps): bump launch-editor from 2.13.1 to 2.14.1 | [#2574]
• chore (deps): bump dompurify from 3.4.8 to 3.4.9 | [#2573]

This release includes a security fix ([#2569])

• Security: Chart operation prototype protection [@C85297] | [#2569]
• Update website references [@C85297] | [#2566]
• Fix: Add input validation for XOR Checksum blocksize (#2537) [@dweep-js] | [#2542]
• Fix: Reverse highlights unwind incorrectly [@kendallgoto] [@C85297] | [#2022]
• Fix Uint8Array concat crash in Parse IPv4 header [@Zish19] | [#2409]
• Fix typos and documentation errors (bytes→bits, wrong release link, spelling) [@qa2me] [@GCHQDeveloper581] | [#2404]
• Add integer check for alphabet size [@heapframe] [@GCHQDeveloper581] | [#2458]
• fix: validate hexdump width upper bound [@skyswordw] | [#2514]

This release includes a security fix ([#2557])

• Security: Add fix, and tests, for Lorem Ipsum DoS issue [@GCHQDeveloper581] | [#2557]
• chore (deps): bump the patch-updates group with 4 updates | [#2552]
• chore (deps): bump the actions-dependencies group with 2 updates | [#2551]
• chore (deps): bump the docker-dependencies group with 2 updates | [#2550]
• chore (deps): bump protobufjs from 8.5.0 to 8.6.2 in the minor-updates group | [#2553]
• Security Policy Update [@C85297] | [#2547]
• Fix spurious error messages generated during webpack build [@GCHQDeveloper581] | [#2545]
• chore (deps): bump shell-quote from 1.8.3 to 1.8.4 | [#2543]
• Implementing ROR13 feature [@Fufu-btw] | [#2539]
• New operation improvements [@jl5193] [@GCHQDeveloper581] | [#1431]
• Npm and yarn/major version updates [@GCHQDeveloper581] | [#2527]
• Update README to reflect AES Decrypt changes [@andreasrtv] | [#2502]
• feat: add Escape Smart Characters operation [@HarelKatz] | [#2391]
• feat: Get AES IV from input (QoL) [@andreasrtv] | [#2471]
• fix: validate text encoding options [@SyedIshmumAhnaf] | [#2497]
• chore (deps): bump the minor-updates group with 5 updates [@GCHQDeveloper581] | [#2500]
• chore (deps): bump the patch-updates group with 2 updates | [#2499]
• chore (deps): bump nginxinc/nginx-unprivileged from df0e9ed to 0a1e718 in the docker-dependencies group | [#2498]
• Add remove ANSI escape codes operation [@Louis-Ladd] [@GCHQDeveloper581] | [#2143]
• Fix option ingredients being overwriten [@C85297] | [#2341]
• chore (deps): bump qs and express | [#2478]
• chore (deps): bump tmp from 0.2.5 to 0.2.7 | [#2479]
• chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2463]
• chore (deps): bump the docker-dependencies group across 1 directory with 2 updates | [#2468]
• chore (deps): bump terser from 5.46.2 to 5.48.0 | [#2385]
• Make dependabot quieter [@GCHQDeveloper581] | [#2467]
• update sitemap [@Blank0120] | [#2443]
• Bump webpack-dev-server to 5.2.4 [@GCHQDeveloper581] | [#2417]
• Fix pgp tests [@GCHQDeveloper581] [@C85297] | [#2461]
• chore (deps): bump the patch-updates group across 1 directory with 4 updates | [#2438]
• chore (deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 | [#2439]
• chore (deps): bump docker/login-action from 4.1.0 to 4.2.0 | [#2441]
• chore (deps): bump docker/metadata-action from 6.0.0 to 6.1.0 | [#2442]
• update bson [@Blank0120] [@GCHQDeveloper581] | [#2425]
• chore (deps): bump webpack from 5.106.2 to 5.107.1 | [#2428]
• chore (deps): bump protobufjs from 7.5.8 to 7.6.0 | [#2429]
• chore (deps): bump sql-formatter from 15.7.4 to 15.8.0 | [#2430]
• chore (deps): bump docker/build-push-action from 7.1.0 to 7.2.0 | [#2431]
• Fix flaky npm run testui [@lzandman] | [#2412]
• Include git ref in website download zip name [@C85297] | [#2339]
• Bump nginxinc/nginx-unprivileged from 808f784 to b9f7ba1 | [#2389]
• Series Chart HTML Formatting fix [@C85297] | [#2403]
• Parse Ethernet Frame HTML formatting fix [@C85297] | [#2402]
• Parse IPv4 Header HTML formatting fix [@C85297] | [#2401]
• Update chromedriver, and install corresponding chrome in workflows (fixes build) [@GCHQDeveloper581] | [#2387]
• chore (deps): bump @codemirror/view from 6.41.1 to 6.43.0 | [#2384]
• chore (deps): bump globals from 17.5.0 to 17.6.0 | [#2386]
• chore (deps): bump the patch-updates group across 1 directory with 3 updates | [#2388]
• [StepSecurity] Apply security best practices [@GCHQDeveloper581] StepSecurity Bot bot@stepsecurity.io | [#2378]
• Build docker container for arm v7 as well [@GCHQDeveloper581] | [#2379]
• chore (deps): bump fast-uri from 3.1.0 to 3.1.2 | [#2372]
• update bcryptjs [@C85297] [@GCHQDeveloper581] | [#2368]
• chore (deps): bump picomatch from 2.3.1 to 2.3.2 | [#2370]
• chore (deps): bump ip-address from 10.1.0 to 10.2.0 | [#2371]
• chore (deps): bump axios from 1.15.0 to 1.16.0 | [#2369]
• feat(operation-wrap): add new Wrap operation to format text at specified line width [@0xff1ce] | [#1882]
• chore (deps): bump the patch-updates group across 1 directory with 5 updates | [#2354]
• chore (deps): bump docker/login-action from 3 to 4 | [#2363]
• chore (deps): bump docker/setup-buildx-action from 3 to 4 | [#2364]
• chore (deps): bump crazy-max/ghaction-github-pages from 3 to 5 | [#2365]
• chore (deps): bump docker/metadata-action from 4 to 6 | [#2366]
• chore (deps): bump docker/setup-qemu-action from 3 to 4 | [#2367]
• Update dependabot for Node 24. [@GCHQDeveloper581] | [#2361]
• chore (deps): bump uuid from 13.0.0 to 14.0.0 | [#2332]
• chore (deps): bump webpack-bundle-analyzer from 5.2.0 to 5.3.0 | [#2353]
• Fix all zeros after 16384 bytes with Blake3 [@zachbowden] [@GCHQDeveloper581] | [#2351]

• Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348]
• Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347]
• Fix XSS in Show Base64 offsets [@C85297] | [#2346]
• Make compatible with node >=22 [@GCHQDeveloper581] | [#2273]
• Fix(node): enable asynchronous operation support in Node.js API [@engin0223] [@GCHQDeveloper581] | [#2342]
• Feature: Change to nginx-unprivileged image for better kubernetes support [@hsolberg] | [#1922]

Breaking changes:

• Minimum supported node version - now v24 (was v16)
• Change of exported port on Docker Container - now 8080 (was 80)
• Node API now exports "bake" and "execute" functions as async.