# CyberChef changelog > The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis - Vendor: gchq - Category: Security & Privacy - Official site: https://gchq.github.io/CyberChef - Tracked by: What's New (https://whatsnew.fyi/product/cyberchef) - Harvested from: GitHub (gchq/CyberChef) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v11.4.0 - Date: 2026-08-18 - Version: v11.4.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.4.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.4.0 - **security** — Patch XSS in Regular expression module - **added** — Add XPRESS (MS-XCA) decompression operations - **added** — Add support for Node 26 - **added** — Add Modular Exponentiation operation - **fixed** — Use js-yaml for both JSON to YAML and YAML to JSON - **fixed** — Replace shasum / sha256sum / sed calls with node built-ins - **fixed** — Stop Parse QR Code from participating in Magic - **fixed** — Restrict A1Z26 Magic checks to valid ranges - **changed** — Extend automated ingredient validation to include argSelector ingredients This release includes a security fix - Security: patch XSS in Regular expression module [@Ne0re0] - chore (deps): bump @codemirror/view from 6.43.8 to 6.43.9 in the patch-updates group | [#2731] - chore (deps): bump @codemirror/commands from 6.10.4 to 6.11.0 in the minor-updates group | [#2732] - Add XPRESS (MS-XCA) decompression operations [@MP-GOWTHAM] | [#2722] - Feat/node 26 support [@alleria173] | [#2699] - chore(root): update allowlist [@evenstensberg] | [#2713] - chore (deps): bump the patch-updates group across 1 directory with 7 updates | [#2730] - chore (deps): bump the minor-updates group across 1 directory with 9 updates | [#2729] - chore (deps): bump docker/login-action from 4.5.2 to 4.6.0 in the actions-dependencies group | [#2716] - chore (deps): bump node from `a0b9bf0` to `d32cdf6` in the docker-dependencies group | [#2723] - docs(root): improve docs a bit [@evenstensberg] | [#2718] - fix: use js-yaml for both JSON to YAML and YAML to JSON [@bartvanandel] | [#2710] - chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2712] - chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2705] - chore (deps): bump the actions-dependencies group with 2 updates | [#2703] - fix: replace `shasum` / `sha256sum` / `sed` calls with node built-ins [@bartvanandel] | [#2019] - chore (deps): bump fast-uri from 3.1.4 to 3.1.5 | [#2709] - chore (deps): bump ip-address from 10.2.0 to 10.4.0 | [#2708] - fix: stop Parse QR Code from participating in Magic (#2610) [@Sanjays2402] | [#2613] - Restrict A1Z26 Magic checks to valid ranges [@vetrovk] | [#2644] - feat: Extend automated ingredient validation to include argSelector ingredients (#2641) [@mansiverma897993] | [#2643] - Add Modular Exponentiation operation [@p-leriche] | [#2149] - Add npm allowScripts policy for npm v12 [@zainnadeem786] | [#2682] - chore (deps): bump assorted vulnerable dependencies [@GCHQDeveloper581] | [#2689] - chore (deps): bump shell-quote from 1.8.4 to 1.10.0 | [#2690] - chore (deps): bump the patch-updates group across 1 directory with 9 updates | [#2686] - chore (deps): bump the actions-dependencies group across 1 directory with 2 updates | [#2685] - chore (deps): bump nginxinc/nginx-unprivileged from `fd3314e` to `44e3633` in the docker-dependencies group | [#2684] ### v11.3.0 - Date: 2026-07-24 - Version: v11.3.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.3.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.3.0 - **security** — Fix pretty recipe parser ReDoS - **added** — Add modulo operation - **added** — Add Generate Prime Number operation - **added** — Add Modular Inverse operation - **added** — Add Extended GCD operation - **added** — Add COBS encoding/decoding operations - **added** — Add TEA and XTEA block ciphers - **added** — Add PRESENT and Twofish ciphers - **added** — Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt - **added** — Add RenderPDF functionality - **added** — Add automated parameter validation framework - **fixed** — Await Node API operations whose run() returns a non-async Promise - **fixed** — fromDecimal Auto delimiter now correctly parses multiple numbers - **fixed** — Remove stray punctuation from malformed To HTML Entity table values - **fixed** — Support constructor and __proto__ parameters in Parse URI - **fixed** — HOTP and TOTP type errors - **fixed** — Fix base32 unicode alphabet - **fixed** — TOTP input validation for correct otpauth uri generation - **fixed** — Validate Wrap line width - **fixed** — Handle malformed image parser errors in View Bit Plane This release includes a security fix ([#2687]) - Security: Fix pretty recipe parser ReDoS [@zainnadeem786] | [#2687] - feat: add modulo operation [@thomasnemer] [@GCHQDeveloper581] | [#2103] - Add HMAC regression tests for Decimal key parsing [@alleria173] | [#2680] - fix: await Node API operations whose run() returns a non-async Promise [@roberson-io] | [#2659] - chore (deps): bump morgan from 1.10.1 to 1.11.0 | [#2676] - fix: fromDecimal Auto delimiter now correctly parses multiple numbers [@min23asdw] | [#2270] - Add Generate Prime Number operation [@p-leriche] | [#2212] - Add Modular Inverse operation [@p-leriche] | [#2207] - Consolidate HTML entity tables into a single spec-generated source (#2645) [@roberson-io] | [#2671] - Add Extended GCD operation [@p-leriche] | [#2206] - Add COBS encoding/decoding operations [@giesmininkas] | [#2185] - chore (deps): bump websocket-driver from 0.7.4 to 0.7.5 | [#2673] - fix: remove stray punctuation from malformed To HTML Entity table values [@roberson-io] | [#2660] - chore (deps): bump the actions-dependencies group across 1 directory with 6 updates | [#2668] - chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2669] - chore (deps): bump the patch-updates group with 5 updates | [#2654] - feat: add TEA and XTEA block ciphers [@thomasxm] | [#2225] - feat: add PRESENT and Twofish ciphers [@thomasxm] | [#2157] - fix: support constructor and __proto__ parameters in Parse URI (#2578) [@mansiverma897993] | [#2581] - feat: Implement automated option-type ingredient validation [@mansiverma897993] | [#2625] - Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt [@thomasxm] | [#2155] - chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2638] - chore (deps): bump webpack from 5.107.2 to 5.108.3 in the minor-updates group | [#2635] - chore (deps): bump nginxinc/nginx-unprivileged from `458ecbe` to `fd3314e` in the docker-dependencies group | [#2633] - Feature: automatically expire PRs if CLA remains unsigned for an extended period [@GCHQDeveloper581] | [#2636] - fix/2445 HOTP (and 2426 TOTP) type errors [@alleria173] | [#2620] - Fix base32 unicode alphabet [@loki1205] | [#2380] - Add a workflow to automatically flag PRs without a signed CLA [@GCHQDeveloper581] | [#2627] - fix/2444 TOTP input validation for correct otpauth uri generation [@alleria173] | [#2621] - Validate Wrap line width [@vetrovk] [@GCHQDeveloper581] [@C85297] | [#2606] - Handle malformed image parser errors in View Bit Plane [@zainnadeem786] | [#2612] - Fixes #2446 hotp otpauth uri validation [@alleria173] | [#2614] - Handle invalid bcrypt salt errors in Bcrypt compare [@zainnadeem786] | [#2615] - Validate empty Show On Map options [@vetrovk] | [#2631] - Create AGENTS.md file [@C85297] | [#2619] - Set parameter validation Metadata for GenerateImage operations [@GCHQDeveloper581] | [#2611] - Update 4 vulnerable dependencies [@GCHQDeveloper581] | [#2616] - Fix BigNumber deserialisation in Dish, and add tests [@GCHQDeveloper581] | [#2607] - chore (deps): bump the docker-dependencies group with 2 updates | [#2600] - chore (deps): bump the patch-updates group with 8 updates | [#2602] - chore (deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions-dependencies group | [#2601] - chore (deps): bump the minor-updates group with 2 updates | [#2603] - Handle empty Generate Image mode [@vetrovk] | [#2598] - Fix stale presenter after expected operation errors [@zainnadeem786] [@GCHQDeveloper581] | [#2589] - Clean up/rationalise webpack paths and thereby increase compatibility for Win… [@GCHQDeveloper581] | [#2585] - Improve parameter validation for a number of operations where exceptions otherwise caused. [@GCHQDeveloper581] | [#2586] - Fix uncaught TypeError in "Show on map" operation. [@lzandman] | [#2453] - fix: jsonata $base64decode/$base64encode in Web Worker [@min23asdw] | [#2275] - fix Dechunk HTTP Response leaks terminating chunk and trail _[Truncated at 4000 characters — full notes: https://github.com/gchq/CyberChef/releases/tag/v11.3.0]_ ### v11.2.0 - Date: 2026-06-17 - Version: v11.2.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.2.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.2.0 - **security** — Add prototype protection to Chart operation - **changed** — Update website references - **fixed** — Add input validation for XOR Checksum blocksize - **fixed** — Fix Reverse highlights unwinding incorrectly - **fixed** — Fix Uint8Array concat crash in Parse IPv4 header - **fixed** — Fix typos and documentation errors - **added** — Add integer check for alphabet size - **fixed** — Validate hexdump width upper bound This release includes a security fix ([#2569]) - Security: Chart operation prototype protection [@C85297] | [#2569] - Update website references [@C85297] | [#2566] - Fix: Add input validation for XOR Checksum blocksize (#2537) [@dweep-js] | [#2542] - Fix: Reverse highlights unwind incorrectly [@kendallgoto] [@C85297] | [#2022] - Fix Uint8Array concat crash in Parse IPv4 header [@Zish19] | [#2409] - Fix typos and documentation errors (bytes→bits, wrong release link, spelling) [@qa2me] [@GCHQDeveloper581] | [#2404] - Add integer check for alphabet size [@heapframe] [@GCHQDeveloper581] | [#2458] - fix: validate hexdump width upper bound [@skyswordw] | [#2514] ### v11.1.0 - Date: 2026-06-13 - Version: v11.1.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.1.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.1.0 - **security** — Add fix and tests for Lorem Ipsum DoS issue - **fixed** — Fix spurious error messages generated during webpack build - **added** — Implement ROR13 feature - **added** — Add Escape Smart Characters operation - **added** — Get AES IV from input - **fixed** — Validate text encoding options - **added** — Add remove ANSI escape codes operation - **fixed** — Fix option ingredients being overwritten - **fixed** — Fix pgp tests - **fixed** — Fix flaky npm run testui - **changed** — Include git ref in website download zip name - **fixed** — Series Chart HTML Formatting fix - **fixed** — Parse Ethernet Frame HTML formatting fix - **fixed** — Parse IPv4 Header HTML formatting fix - **changed** — Build docker container for arm v7 as well - **added** — Add new Wrap operation to format text at specified line width - **fixed** — Fix all zeros after 16384 bytes with Blake3 This release includes a security fix ([#2557]) - Security: Add fix, and tests, for Lorem Ipsum DoS issue [@GCHQDeveloper581] | [#2557] - chore (deps): bump the patch-updates group with 4 updates | [#2552] - chore (deps): bump the actions-dependencies group with 2 updates | [#2551] - chore (deps): bump the docker-dependencies group with 2 updates | [#2550] - chore (deps): bump protobufjs from 8.5.0 to 8.6.2 in the minor-updates group | [#2553] - Security Policy Update [@C85297] | [#2547] - Fix spurious error messages generated during webpack build [@GCHQDeveloper581] | [#2545] - chore (deps): bump shell-quote from 1.8.3 to 1.8.4 | [#2543] - Implementing ROR13 feature [@Fufu-btw] | [#2539] - New operation improvements [@jl5193] [@GCHQDeveloper581] | [#1431] - Npm and yarn/major version updates [@GCHQDeveloper581] | [#2527] - Update README to reflect AES Decrypt changes [@andreasrtv] | [#2502] - feat: add Escape Smart Characters operation [@HarelKatz] | [#2391] - feat: Get AES IV from input (QoL) [@andreasrtv] | [#2471] - fix: validate text encoding options [@SyedIshmumAhnaf] | [#2497] - chore (deps): bump the minor-updates group with 5 updates [@GCHQDeveloper581] | [#2500] - chore (deps): bump the patch-updates group with 2 updates | [#2499] - chore (deps): bump nginxinc/nginx-unprivileged from `df0e9ed` to `0a1e718` in the docker-dependencies group | [#2498] - Add remove ANSI escape codes operation [@Louis-Ladd] [@GCHQDeveloper581] | [#2143] - Fix option ingredients being overwriten [@C85297] | [#2341] - chore (deps): bump qs and express | [#2478] - chore (deps): bump tmp from 0.2.5 to 0.2.7 | [#2479] - chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2463] - chore (deps): bump the docker-dependencies group across 1 directory with 2 updates | [#2468] - chore (deps): bump terser from 5.46.2 to 5.48.0 | [#2385] - Make dependabot quieter [@GCHQDeveloper581] | [#2467] - update sitemap [@Blank0120] | [#2443] - Bump webpack-dev-server to 5.2.4 [@GCHQDeveloper581] | [#2417] - Fix pgp tests [@GCHQDeveloper581] [@C85297] | [#2461] - chore (deps): bump the patch-updates group across 1 directory with 4 updates | [#2438] - chore (deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 | [#2439] - chore (deps): bump docker/login-action from 4.1.0 to 4.2.0 | [#2441] - chore (deps): bump docker/metadata-action from 6.0.0 to 6.1.0 | [#2442] - update bson [@Blank0120] [@GCHQDeveloper581] | [#2425] - chore (deps): bump webpack from 5.106.2 to 5.107.1 | [#2428] - chore (deps): bump protobufjs from 7.5.8 to 7.6.0 | [#2429] - chore (deps): bump sql-formatter from 15.7.4 to 15.8.0 | [#2430] - chore (deps): bump docker/build-push-action from 7.1.0 to 7.2.0 | [#2431] - Fix flaky `npm run testui` [@lzandman] | [#2412] - Include git ref in website download zip name [@C85297] | [#2339] - Bump nginxinc/nginx-unprivileged from `808f784` to `b9f7ba1` | [#2389] - Series Chart HTML Formatting fix [@C85297] | [#2403] - Parse Ethernet Frame HTML formatting fix [@C85297] | [#2402] - Parse IPv4 Header HTML formatting fix [@C85297] | [#2401] - Update chromedriver, and install corresponding chrome in workflows (fixes build) [@GCHQDeveloper581] | [#2387] - chore (deps): bump @codemirror/view from 6.41.1 to 6.43.0 | [#2384] - chore (deps): bump globals from 17.5.0 to 17.6.0 | [#2386] - chore (deps): bump the patch-updates group across 1 directory with 3 updates | [#2388] - [StepSecurity] Apply security best practices [@GCHQDeveloper581] StepSecurity Bot | [#2378] - Build docker container for arm v7 as well [@GCHQDeveloper581] | [#2379] - chore (deps): bump fast-uri from 3.1.0 to 3.1.2 | [#2372] - update bcryptjs [@C85297] [@GCHQDeveloper581] | [#2368] - chore (deps): bump picomatch from 2.3.1 to 2.3.2 | [#2370] - chore (deps): bump ip-address from 10.1.0 to 10.2.0 | [#2371] - chore (deps): bump axios from 1.15.0 to 1.16.0 | [#2369] - feat(operation-wrap): add new Wrap operation to fo _[Truncated at 4000 characters — full notes: https://github.com/gchq/CyberChef/releases/tag/v11.1.0]_ ### v11.0.0 - Date: 2026-04-28 - Version: v11.0.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v11.0.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v11.0.0 - **security** — Fix XSS vulnerability in Show Base64 offsets - **changed** — Update Node version from 22 to 24 - **changed** — Make compatible with Node >=22 - **fixed** — Enable asynchronous operation support in Node.js API - **changed** — Change to nginx-unprivileged image for better Kubernetes support - **changed** — Minimum supported Node version is now v24 (was v16) - **changed** — Exported port on Docker Container is now 8080 (was 80) - **changed** — Node API now exports bake and execute functions as async - Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348] - Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347] - Fix XSS in Show Base64 offsets [@C85297] | [#2346] - Make compatible with node >=22 [@GCHQDeveloper581] | [#2273] - Fix(node): enable asynchronous operation support in Node.js API [@engin0223] [@GCHQDeveloper581] | [#2342] - Feature: Change to nginx-unprivileged image for better kubernetes support [@hsolberg] | [#1922] Breaking changes: - Minimum supported node version - now v24 (was v16) - Change of exported port on Docker Container - now 8080 (was 80) - Node API now exports "bake" and "execute" functions as async.
Click to expand v10 minor versions ### v10.24.0 - Date: 2026-04-27 - Version: v10.24.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v10.24.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v10.24.0 - **added** — Add parity bit operation - **added** — Add metadata extraction for UUID strings - **added** — Add support for screenreaders in operations search - **changed** — Improve markdown link handling to open in blank tabs - **changed** — Support IPv4 domains in Regular Expression operation email address regex - **changed** — Rewrite fixCryptoApiImports and fixSnackbarMarkup to JavaScript to make it OS agnostic - **fixed** — Fix and link Fernet tests - Update CONTRIBUTING.md [@GCHQDeveloper581] | [#2333] - Fix, and link, Fernet tests [@GCHQDeveloper581] | [#2335] - [#927] added parity bit operation [@j83305] | [#1036] - Feature md link blanks [@BjoernAkAManf] [@GCHQDeveloper581] | [#660] - Accessibility - Add support for screenreaders in operations search [@mattnotmitt] | [#1862] - Added metadata extraction for UUID strings. [@ko80240] | [#2322] - chore (deps): bump the patch-updates group with 6 updates | [#2330] - chore (deps): bump @codemirror/search from 6.6.0 to 6.7.0 | [#2331] - (Feature) Improve CI [@GCHQDeveloper581] | [#2328] - Update dependabot.yml [@GCHQDeveloper581] | [#2326] - chore (deps): bump lodash, grunt-legacy-log and grunt-legacy-util | [#2327] - chore (deps): bump the patch-updates group with 6 updates [@GCHQDeveloper581] | [#2323] - chore (deps): bump autoprefixer from 10.4.27 to 10.5.0 | [#2324] - chore (deps): bump dompurify from 3.3.3 to 3.4.0 | [#2321] - chore (deps): bump follow-redirects from 1.15.11 to 1.16.0 | [#2320] - Regular Expression operation email address regex: Support IPv4 domains [@C85297] [@GCHQDeveloper581] | [#2167] - Rewriting fixCryptoApiImports and fixSnackbarMarkup to js to make it OS agnostic [@BigYellowHammer] | [#2298] - chore (deps): bump basic-ftp from 5.2.1 to 5.2.2 | [#2317] - chore (deps): bump axios from 1.13.6 to 1.15.0 | [#2316] - chore (deps): bump webpack from 5.105.4 to 5.106.0 | [#2315] - chore (deps): bump basic-ftp from 5.2.0 to 5.2.1 | [#2313] - Update vulnerable dependencies [@GCHQDeveloper581] | [#2311] ### v10.23.0 - Date: 2026-04-07 - Version: v10.23.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v10.23.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v10.23.0 - **security** — Properly escape HTML entities in sampleDelim to avoid XSS issue - **fixed** — ParseEthernetFrame - Fix vlan calculation - **fixed** — Return empty output for zero-length To Modhex input - **added** — Add tab focus to top banner and navigation to About/Support Modal - **added** — Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade - **added** — Selection and Deselection of autobake checkbox using keyboard - **added** — Add more helpful error for when numerical ingredient is left empty - **added** — Add Raw option for Jq operation - **added** — Add Extract Audio Metadata operation - **fixed** — Fix Jq issue - **fixed** — Return empty string instead of empty array for empty input in A1Z26 - **added** — Add ARM disassembler operation - **added** — Add Text/Integer Converter operation - **added** — Add RC6 Encrypt/Decrypt operations - **fixed** — Add Bootstrap form style for CodeMirror editor - **added** — Add Flask Session operations (Decode, Sign, Verify) - **changed** — Update jq-web to jq-wasm with jq version 1.8.1 - **added** — Add random integer generation operation - **added** — Add BigInt utility functions for number theory operations - **changed** — Improve SQL Beautify: use sql-formatter and support bind variables - Properly escape HTML entities in sampleDelim to avoid XSS issue [@GCHQDeveloper581] | [#2307] - chore (deps): bump lodash from 4.17.23 to 4.18.1 | [#2304] - chore (deps): bump @codemirror/view from 6.40.0 to 6.41.0 | [#2305] - chore (deps): bump the patch-updates group with 2 updates | [#2303] - chore (deps): bump @xmldom/xmldom from 0.8.11 to 0.8.12 | [#2302] - chore (deps): bump picomatch | [#2299] - chore (deps): bump node-forge from 1.3.3 to 1.4.0 | [#2297] - chore (deps): bump the patch-updates group with 3 updates | [#2296] - chore (deps) bump chromedriver from 130.0.4 to 146.0.6 [@GCHQDeveloper581] | [#2292] - ParseEthernetFrame - Fix vlan calculation [@Kalkran] | [#2295] - Add pull request template with AI usage disclosure [@C85297] | [#2279] - fix: return empty output for zero-length To Modhex input [@saschabuehrle] | [#2249] - Added tab focus to top banner and navigation to About/Support Modal [@j264415] | [#1733] - Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade [@Kalkran] | [#1722] - Selection and Deselection of autobake checkbox using keyboard [@j264415] | [#1727] - chore (deps): bump @babel/runtime from 7.28.6 to 7.29.2 | [#2263] - Add more helpful error for when numerical ingredient is left empty [@Lamby777] [@C85297] | [#1540] - chore (deps): bump @codemirror/view from 6.39.17 to 6.40.0 | [#2262] - Bump flatted from 3.3.2 to 3.4.2 [@GCHQDeveloper581] | [#2266] - feat: add Raw option for Jq operation [@rtpt-romankarwacik] | [#2237] - chore (deps): bump core-js from 3.48.0 to 3.49.0 | [#2261] - chore (deps): bump the patch-updates group with 6 updates | [#2260] - Add Extract Audio Metadata operation [@d0s1nt] [@GCHQDeveloper581] | [#2170] - Fix Jq issue [@GCHQDeveloper581] | [#2210] - Configure dependabot updates [@GCHQDeveloper581] | [#2259] - fix(A1Z26): return empty string instead of empty array for empty input [@brick-pixel] | [#2257] - Fix broken Docker link in README [@am-periphery] | [#2250] - Update some dependencies, including a number causing npm audit warnings [@GCHQDeveloper581] | [#2236] - Bump axios from 1.7.9 to 1.13.6 | [#2234] - Bump jws from 3.2.2 to 3.2.3 | [#2235] - Bump pbkdf2 from 3.1.2 to 3.1.5 | [#2229] - Bump form-data from 4.0.1 to 4.0.5 | [#2228] - Bump basic-ftp from 5.0.5 to 5.2.0 | [#2231] - feat: add ARM disassembler operation [@thomasxm] | [#2156] - Add Text/Integer Converter operation [@p-leriche] [@GCHQDeveloper581] | [#2213] - Feat/rc6 add RC6 Encrypt/Decrypt operations [@thomasxm] | [#2163] - [bugfix] Add Bootstrap form style for CodeMirror editor [@Swonkie] | [#2161] - Add Flask Session operations (Decode, Sign, Verify) [@ThePlayer372-FR] | [#2208] - fix: `jq-web` -> `jq-wasm`, includes `jq` version `1.8.1` [@W-Floyd] [@GCHQDeveloper581] | [#2223] - Bump jsonwebtoken from 8.5.1 to 9.0.0 [@GCHQDeveloper581] | [#2219] - Bump basic-ftp from 5.0.5 to 5.2.0 | [#2218] - feat: add random integer generation operation [@cktgh] | [#2151] - Add BigInt utility functions for number theory operations [@p-leriche] [@GCHQDeveloper581] | [#2205] - Improve SQL Beautify: use sql-formatter and support bind variables [@aby-jo] [@GCHQDeveloper581] | [#2071] - update tesseract.js to 6.0.1 [@atsiv1] | [#2133] - Fix hint tooltip display issues [@bartvanandel] | [#2017] - Simplify babel dependencies [@GCHQDeveloper581] | [#2204] - Dependency updates [@GCHQDeveloper581] | [#2201] - Fix: Move Magic checks from Escape to Unescape Unicode Characters [@fjh1997] | [#2195] - Paste spreadsheets as text [@C85297] | [#2200] - Fix Roboto Mono font [@C85297] | [#2199] - Fix return of buffer for PNG QR image generation [@GCHQDeveloper581] [@C85297] | [#2125] - Update JIMP [@C85297] | [#2171] - Overwrite NGINX maintainer label [@C85297] | [#2194] - Bump v10.22.1 [@GCHQDeveloper581] | [#2193] - Fix npm publish - Run "npm ci" and "npm run node" under node 18 then switch to node 24.5 [@GCHQDeveloper581] | [#2192] ### v10.22.1 - Date: 2026-02-12 - Version: v10.22.1 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v10.22.1 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v10.22.1 See the [CHANGELOG](https://github.com/gchq/CyberChef/blob/master/CHANGELOG.md) and [commit messages](https://github.com/gchq/CyberChef/commits/master) for details. ### v10.22.0 - Date: 2026-02-11 - Version: v10.22.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v10.22.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v10.22.0 - **fixed** — Percent delimiter for hex encoding - **added** — Ability to paste one or more images from the clipboard - **changed** — Quoted Printable to use consistent reference to 'email' - **fixed** — Freeze when output text decoding fails - **changed** — Update Browserslist DB - Separate npm publish out into separate job and run with Node 24.5 [@GCHQDeveloper581] | [#2188] - Fixed Percent delimiter for hex encoding [@beneri] [@C85297] | [#2137] - Added the ability to paste one or more Images from the Clipboard [@t-martine] [@a3957273] [@C85297] | [#1876] - Quoted Printable - consistent reference to 'email' [@wesinator] | [#2186] - Fix freeze when output text decoding fails [@Raka-loah] | [#1573] - Update Browserslist DB [@C85297] | [#2183] - Add contents write permission to releases workflow [@C85297] | [#2182] - Fix release workflow permissions [@C85297] | [#2181] ### v10.21.0 - Date: 2026-02-06 - Version: v10.21.0 - Original notes: https://github.com/gchq/CyberChef/releases/tag/v10.21.0 - Permalink: https://whatsnew.fyi/product/cyberchef/releases/v10.21.0 - **fixed** — Fix import operations with special chars in them - **fixed** — Correctly parse xxd odd byte hexdumps - **changed** — Update Sitemap URLs to Use Valid Paths in sitemap.mjs - **removed** — Remove version 10 message from banner - **changed** — Update crypto browserify - **changed** — Update kbpgp package - **fixed** — Fix the processing of ALPNs for JA4 to align with new specification update - **added** — Add Bech32 and Bech32m encoding/decoding operations - **fixed** — Exclude Delete character from hex dump output - **fixed** — Tiny typo fix in To Base85 operation - Fix import operations with special chars in them [@d98762625] [@jg42526] | [#1040] - Remove custom CodeQL workflow [@C85297] | [#2176] - Fix code scanning warnings in workflows [@GCHQDeveloper581] | [#2177] - Use NPM trusted publishing [@C85297] [@GCHQDeveloper581] | [#2174] - Fix: Correctly parse xxd odd byte hexdumps [@ThomasNotTom] [@GCHQDeveloper581] | [#2058] - Update Sitemap URLs to Use Valid Paths in sitemap.mjs [@rbpi] [@C85297] | [#1861] - Use recommended GitHub Actions to build image [@AlexGustafsson] [@C85297] | [#2055] - Remove version 10 message from banner [@C85297] | [#2169] - Bump form-data from 4.0.1 to 4.0.5 | [#2175] - Bump node-forge from 1.3.1 to 1.3.3 | [#2173] - Update crypto browserify [@C85297] | [#2172] - Update kbpgp package (resolves #2135) [@GCHQDeveloper581] | [#2136] - Fix the processing of ALPNs for JA4 to align with new specification update [@tuliperis] | [#2165] - Add Bech32 and Bech32m encoding/decoding operations [@thomasxm] | [#2159] - Exclude Delete character from hex dump output [@mikecat] [@C85297] | [#2086] - Tiny typo fix in "To Base85" operation [@twostraws] | [#2118] - Bump jsonpath-plus [@C85297] | [#2166]