chore(deps): update ghcr.io/gchq/cyberchef docker tag to v11

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/gchq/cyberchef	major	10.24.0 → 11.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

gchq/CyberChef (ghcr.io/gchq/cyberchef)

v11.0.0

Compare Source

• Revert sitemap to v8.0.X to fix build/deploy on master [@​GCHQDeveloper581] | [#​2348]
• Node version update from 22 to 24 [@​lzandman] [@​GCHQDeveloper581] | [#​2347]
• Fix XSS in Show Base64 offsets [@​C85297] | [#​2346]
• Make compatible with node >=22 [@​GCHQDeveloper581] | [#​2273]
• Fix(node): enable asynchronous operation support in Node.js API [@​engin0223] [@​GCHQDeveloper581] | [#​2342]
• Feature: Change to nginx-unprivileged image for better kubernetes support [@​hsolberg] | [#​1922]

Breaking changes:

• Minimum supported node version - now v24 (was v16)
• Change of exported port on Docker Container - now 8080 (was 80)
• Node API now exports "bake" and "execute" functions as async.

Click to expand v10 minor versions

[10.24.0] - 2026-04-27

• Update CONTRIBUTING.md [@​GCHQDeveloper581] | [#​2333]
• Fix, and link, Fernet tests [@​GCHQDeveloper581] | [#​2335]
• [#​927] added parity bit operation [@​j83305] | [#​1036]
• Feature md link blanks [@​BjoernAkAManf] [@​GCHQDeveloper581] | [#​660]
• Accessibility - Add support for screenreaders in operations search [@​mattnotmitt] | [#​1862]
• Added metadata extraction for UUID strings. [@​ko80240] | [#​2322]
• chore (deps): bump the patch-updates group with 6 updates | [#​2330]
• chore (deps): bump @​codemirror/search from 6.6.0 to 6.7.0 | [#​2331]
• (Feature) Improve CI [@​GCHQDeveloper581] | [#​2328]
• Update dependabot.yml [@​GCHQDeveloper581] | [#​2326]
• chore (deps): bump lodash, grunt-legacy-log and grunt-legacy-util | [#​2327]
• chore (deps): bump the patch-updates group with 6 updates [@​GCHQDeveloper581] | [#​2323]
• chore (deps): bump autoprefixer from 10.4.27 to 10.5.0 | [#​2324]
• chore (deps): bump dompurify from 3.3.3 to 3.4.0 | [#​2321]
• chore (deps): bump follow-redirects from 1.15.11 to 1.16.0 | [#​2320]
• Regular Expression operation email address regex: Support IPv4 domains [@​C85297] [@​GCHQDeveloper581] | [#​2167]
• Rewriting fixCryptoApiImports and fixSnackbarMarkup to js to make it OS agnostic [@​BigYellowHammer] | [#​2298]
• chore (deps): bump basic-ftp from 5.2.1 to 5.2.2 | [#​2317]
• chore (deps): bump axios from 1.13.6 to 1.15.0 | [#​2316]
• chore (deps): bump webpack from 5.105.4 to 5.106.0 | [#​2315]
• chore (deps): bump basic-ftp from 5.2.0 to 5.2.1 | [#​2313]
• Update vulnerable dependencies [@​GCHQDeveloper581] | [#​2311]

[10.23.0] - 2026-04-06

• Properly escape HTML entities in sampleDelim to avoid XSS issue [@​GCHQDeveloper581] | [#​2307]
• chore (deps): bump lodash from 4.17.23 to 4.18.1 | [#​2304]
• chore (deps): bump @​codemirror/view from 6.40.0 to 6.41.0 | [#​2305]
• chore (deps): bump the patch-updates group with 2 updates | [#​2303]
• chore (deps): bump @​xmldom/xmldom from 0.8.11 to 0.8.12 | [#​2302]
• chore (deps): bump picomatch | [#​2299]
• chore (deps): bump node-forge from 1.3.3 to 1.4.0 | [#​2297]
• chore (deps): bump the patch-updates group with 3 updates | [#​2296]
• chore (deps) bump chromedriver from 130.0.4 to 146.0.6 [@​GCHQDeveloper581] | [#​2292]
• ParseEthernetFrame - Fix vlan calculation [@​Kalkran] | [#​2295]
• Add pull request template with AI usage disclosure [@​C85297] | [#​2279]
• fix: return empty output for zero-length To Modhex input [@​saschabuehrle] | [#​2249]
• Added tab focus to top banner and navigation to About/Support Modal [@​j264415] | [#​1733]
• Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade [@​Kalkran] | [#​1722]
• Selection and Deselection of autobake checkbox using keyboard [@​j264415] | [#​1727]
• chore (deps): bump @​babel/runtime from 7.28.6 to 7.29.2 | [#​2263]
• Add more helpful error for when numerical ingredient is left empty [@​Lamby777] [@​C85297] | [#​1540]
• chore (deps): bump @​codemirror/view from 6.39.17 to 6.40.0 | [#​2262]
• Bump flatted from 3.3.2 to 3.4.2 [@​GCHQDeveloper581] | [#​2266]
• feat: add Raw option for Jq operation [@​rtpt-romankarwacik] | [#​2237]
• chore (deps): bump core-js from 3.48.0 to 3.49.0 | [#​2261]
• chore (deps): bump the patch-updates group with 6 updates | [#​2260]
• Add Extract Audio Metadata operation [@​d0s1nt] [@​GCHQDeveloper581] | [#​2170]
• Fix Jq issue [@​GCHQDeveloper581] | [#​2210]
• Configure dependabot updates [@​GCHQDeveloper581] | [#​2259]
• fix(A1Z26): return empty string instead of empty array for empty input [@​brick-pixel] | [#​2257]
• Fix broken Docker link in README [@​am-periphery] | [#​2250]
• Update some dependencies, including a number causing npm audit warnings [@​GCHQDeveloper581] | [#​2236]
• Bump axios from 1.7.9 to 1.13.6 | [#​2234]
• Bump jws from 3.2.2 to 3.2.3 | [#​2235]
• Bump pbkdf2 from 3.1.2 to 3.1.5 | [#​2229]
• Bump form-data from 4.0.1 to 4.0.5 | [#​2228]
• Bump basic-ftp from 5.0.5 to 5.2.0 | [#​2231]
• feat: add ARM disassembler operation [@​thomasxm] | [#​2156]
• Add Text/Integer Converter operation [@​p-leriche] [@​GCHQDeveloper581] | [#​2213]
• Feat/rc6 add RC6 Encrypt/Decrypt operations [@​thomasxm] | [#​2163]
• [bugfix] Add Bootstrap form style for CodeMirror editor [@​Swonkie] | [#​2161]
• Add Flask Session operations (Decode, Sign, Verify) [@​ThePlayer372-FR] | [#​2208]
• fix: jq-web -> jq-wasm, includes jq version 1.8.1 [@​W-Floyd] [@​GCHQDeveloper581] | [#​2223]
• Bump jsonwebtoken from 8.5.1 to 9.0.0 [@​GCHQDeveloper581] | [#​2219]
• Bump basic-ftp from 5.0.5 to 5.2.0 | [#​2218]
• feat: add random integer generation operation [@​cktgh] | [#​2151]
• Add BigInt utility functions for number theory operations [@​p-leriche] [@​GCHQDeveloper581] | [#​2205]
• Improve SQL Beautify: use sql-formatter and support bind variables [@​aby-jo] [@​GCHQDeveloper581] | [#​2071]
• update tesseract.js to 6.0.1 [@​atsiv1] | [#​2133]
• Fix hint tooltip display issues [@​bartvanandel] | [#​2017]
• Simplify babel dependencies [@​GCHQDeveloper581] | [#​2204]
• Dependency updates [@​GCHQDeveloper581] | [#​2201]
• Fix: Move Magic checks from Escape to Unescape Unicode Characters [@​fjh1997] | [#​2195]
• Paste spreadsheets as text [@​C85297] | [#​2200]
• Fix Roboto Mono font [@​C85297] | [#​2199]
• Fix return of buffer for PNG QR image generation [@​GCHQDeveloper581] [@​C85297] | [#​2125]
• Update JIMP [@​C85297] | [#​2171]
• Overwrite NGINX maintainer label [@​C85297] | [#​2194]
• Bump v10.22.1 [@​GCHQDeveloper581] | [#​2193]
• Fix npm publish - Run "npm ci" and "npm run node" under node 18 then switch to node 24.5 [@​GCHQDeveloper581] | [#​2192]

[10.22.0] - 2026-02-11

• Separate npm publish out into separate job and run with Node 24.5 [@​GCHQDeveloper581] | [#​2188]
• Fixed Percent delimiter for hex encoding [@​beneri] [@​C85297] | [#​2137]
• Added the ability to paste one or more Images from the Clipboard [@​t-martine] [@​a3957273] [@​C85297] | [#​1876]
• Quoted Printable - consistent reference to 'email' [@​wesinator] | [#​2186]
• Fix freeze when output text decoding fails [@​Raka-loah] | [#​1573]
• Update Browserslist DB [@​C85297] | [#​2183]
• Add contents write permission to releases workflow [@​C85297] | [#​2182]
• Fix release workflow permissions [@​C85297] | [#​2181]

[10.21.0] - 2026-02-05

• Fix import operations with special chars in them [@​d98762625] [@​jg42526] | [#​1040]
• Remove custom CodeQL workflow [@​C85297] | [#​2176]
• Fix code scanning warnings in workflows [@​GCHQDeveloper581] | [#​2177]
• Use NPM trusted publishing [@​C85297] [@​GCHQDeveloper581] | [#​2174]
• Fix: Correctly parse xxd odd byte hexdumps [@​ThomasNotTom] [@​GCHQDeveloper581] | [#​2058]
• Update Sitemap URLs to Use Valid Paths in sitemap.mjs [@​rbpi] [@​C85297] | [#​1861]
• Use recommended GitHub Actions to build image [@​AlexGustafsson] [@​C85297] | [#​2055]
• Remove version 10 message from banner [@​C85297] | [#​2169]
• Bump form-data from 4.0.1 to 4.0.5 | [#​2175]
• Bump node-forge from 1.3.1 to 1.3.3 | [#​2173]
• Update crypto browserify [@​C85297] | [#​2172]
• Update kbpgp package (resolves #​2135) [@​GCHQDeveloper581] | [#​2136]
• Fix the processing of ALPNs for JA4 to align with new specification update [@​tuliperis] | [#​2165]
• Add Bech32 and Bech32m encoding/decoding operations [@​thomasxm] | [#​2159]
• Exclude Delete character from hex dump output [@​mikecat] [@​C85297] | [#​2086]
• Tiny typo fix in "To Base85" operation [@​twostraws] | [#​2118]
• Bump jsonpath-plus [@​C85297] | [#​2166]

[10.20.0] - 2026-01-28

• Fixed Optical Character Recognition and added tests [@​n1474335] | [ab37c1e]
• Fixed JA4 version fallback value [@​n1474335] | [7a5225c]
• Updated chromedriver [@​n1474335] | [0e82e4b]
• Fixed RSA Sign and Verify character encodings [@​n1474335] | [895a929]
• Updated chromedriver [@​n1474335] | [d3adfc7]
• Added message format arg to RSA Verify operation [@​n1474335] | [47c85a1]
• Add operation for parsing X.509 CRLs [@​robinsandhu] | [#​1887]
• Fix typo in description of JWT Sign recipe [@​GuilhermoReadonly] | [#​1961]
• Corrected path to generateNodeIndex.mjs [@​simonarnell] | [#​1959]
• Add 'header' ingredient to JWT Sign operation [@​RandomByte] | [#​1957]
• Add Parse TLS record operation [@​c65722] | [#​1936]
• Automatically detect chrome driver version [@​gchq] | [#​1972]
• Add Strip UDP header operation [@​c65722] | [#​1900]
• Add Strip TCP header operation [@​c65722] | [#​1898]
• Webpack compress with gzip and brotli [@​max0x53] | [#​1955]
• add offset field to 'Add Line Numbers' operation [@​Adamkadaban] | [#​1866]
• Disable flakey URL test [@​a3957273] | [#​1973]
• Add Strip IPv4 header operation [@​c65722] | [#​1899]
• IPv6 Transition Operation [@​jb30795] | [#​1780]
• fix: Blowfish - ignore IV length in ECB mode [@​FranciscoPombal] | [#​1902]
• Add 'Drop nth bytes' operation [@​Oshawk] | [#​1914]
• Add 'Take nth bytes' operation [@​Oshawk] | [#​1915]
• Add Leet Speak [@​bartblaze] | [#​1971]
• Fix Generate TOTP & HOPT [@​exactlyaron] | [#​1966]
• Updated luhn checksum operation to work with different bases [@​k3ach] | [#​1933]
• automatically theme mode based on user preference [@​vs4vijay] | [#​1921]
• fix: DES/Triple DES - misleading error messages [@​FranciscoPombal] | [#​1904]
• fix: ROT13 - shifting numbers by negative amounts [@​FranciscoPombal] | [#​1903]
• Introduce Yubico's Modhex for Conversion [@​linuxgemini] | [#​1105]
• Feature: MIME RFC2047 Decoding [@​MShwed] | [#​630]
• CC-1889 add _ option [@​depperm] | [#​1977]
• chore(root): add cspell [@​evenstensberg] | [#​1976]
• Preserve uppercase for Leet Speak [@​bartblaze] | [#​1981]
• Load the user's preferred color scheme if the URL contains an invalid theme [@​0xh3xa] | [#​2007]
• Add SM2 Encrypt and Decrypt Operations [@​flakjacket95] | [#​1909]
• Support jq as an operation. [@​zhzy0077] | [#​1604]
• Add fingerprints to the 'Parse X.509 certificate' operation [@​JSCU-CNI] | [#​1863]
• Added a JSON to YAML and a YAML to JSON operation [@​ccarpo] | [#​1286]
• Add CRC Operation [@​r4mos] | [#​1993]
• Bug Fix: selected theme not loading when refreshing [@​0xh3xa] | [#​2006]
• Fix(RecipeWaiter): sanitize user input in addOperation to prevent XSS [@​0xh3xa] | [#​2014]
• Docker multiplatform build support [@​PathToLife] | [#​1974]
• Add Base32 Hex Extended Alphabet and Base32 Tests. [@​peterc-s] | [#​1991]
• Add ECB/NoPadding and CBC/NoPadding support to AES encryption [@​plvie] | [#​2013]
• Add new operation: PHP Serialize [@​brun0ne] | [#​1548]
• Push input through postmessage [@​kenduguay1] | [#​1992]
• Add jsonata query operation [@​jonking-ajar] | [#​1587]
• Re-enable Npm Release in github workflows [@​PathToLife] | [#​2031]
• Add to ECDSA Verify the message format [@​r4mos] | [#​2027]
• Added alternating caps functionality [@​sw5678] | [#​1897]
• XOR Checksum operation added [@​jg42526] | [#​2035]
• Add GenerateAllChecksums operation * Remove checksums from GenerateAllHashes operation [@​es45411] | [66d445c]
• Update GenerateAllChecksums infoURL [@​es45411] | [#​2037]
• Add toggle "+" character to URLDecode operation [@​es45411] | [#​2040]
• Workaround for Safari load bug [@​GCHQDeveloper94872] | [#​2038]
• Updated Dockerfile to correctly build on ARM64 platforms [@​Sma-Das] | [#​2042]
• Addresses bug report #​2008 Added explicit support for octal IP addresses. Changed approach to IPv4 regex to be string manipulation generated. Added some unit tests for IP address parsing - probably not full coverage. Added lookahead and lookbehind tricks to resolve warned issue that 1.2.3.256 would still be extracted as 1.2.3.25. Now only accepts valid IP addresses. Warning replaced with clause about infinite length dotted decimal forms. [@​gchqdev364] | [#​2041]
• Remove trim from rail fence [@​Odyhibit] | [#​1986]
• Fix email regex [@​ericli-splunk] | [#​2025]
• Add Blake3 hashing [@​xumptex] | [#​2023]
• Use defaultIndex instead of 0 in transformArgs [@​bartvanandel] | [#​2015]
• Add "Generate UUID" and "Analyse UUID" operations [@​bartvanandel] | [#​2011]
• Add new operation: Template [@​kendallgoto] | [#​2021]
• Add more clear build instructions [@​remingtr] | [#​1873]
• Show On Map updated to use leaflet over WikiMedia [@​0xff1ce] | [#​1884]
• Fixed ToDecimal signed logic [@​starplanet] | [#​1545]
• Use BigInt for encoding/decoding VarInt [@​mikecat] | [#​1978]

[10.19.0] - 2024-06-21

• Add support for ECDSA and DSA in 'Parse CSR' [@​robinsandhu] | [#​1828]
• Fix typos in SIGABA.mjs [@​eltociear] | [#​1834]

[10.18.0] - 2024-04-24

• Added 'XXTEA Encrypt' and 'XXTEA Decrypt' operations [@​n1474335] | [0a353ee]

[10.17.0] - 2024-04-13

• Fix unit test 'expectOutput' implementation [@​zb3] | [#​1783]
• Add accessibility labels for icons [@​e218736] | [#​1743]
• Add focus styling for keyboard navigation [@​e218736] | [#​1739]
• Add support for operation option hiding [@​TheZ3ro] | [#​541]
• Improve efficiency of RAKE implementation [@​sw5678] | [#​1751]
• Require (a, 26) to be coprime in 'Affine Encode' [@​EvieHarv] | [#​1788]
• Added 'JWK to PEM' operation [@​cplussharp] | [#​1277]
• Added 'PEM to JWK' operation [@​cplussharp] | [#​1277]
• Added 'Public Key from Certificate' operation [@​cplussharp] | [#​1642]
• Added 'Public Key from Private Key' operation [@​cplussharp] | [#​1642]

[10.16.0] - 2024-04-12

• Added 'JA4Server Fingerprint' operation [@​n1474335] | [#​1789]

[10.15.0] - 2024-04-02

• Fix Ciphersaber2 key concatenation [@​zb3] | [#​1765]
• Fix DeriveEVPKey's array parsing [@​zb3] | [#​1767]
• Fix JWT operations [@​a3957273] | [#​1769]
• Added 'Parse Certificate Signing Request' operation [@​jkataja] | [#​1504]
• Added 'Extract Hash Values' operation [@​MShwed] | [#​512]
• Added 'DateTime Delta' operation [@​tomgond] | [#​1732]

[10.14.0] - 2024-03-31

• Added 'To Float' and 'From Float' operations [@​tcode2k16] | [#​1762]
• Fix ChaCha raw export option [@​joostrijneveld] | [#​1606]
• Update x86 disassembler vendor library [@​evanreichard] | [#​1197]
• Allow variable Blowfish key sizes [@​cbeuw] | [#​933]
• Added 'XXTEA' operation [@​devcydo] | [#​1361]

[10.13.0] - 2024-03-30

• Added 'FangURL' operation [@​breakersall] [@​arnydo] | [#​1591] [#​654]

[10.12.0] - 2024-03-29

• Added 'Salsa20' and 'XSalsa20' operation [@​joostrijneveld] | [#​1750]

[10.11.0] - 2024-03-29

• Add HEIC/HEIF file signatures [@​simonw] | [#​1757]
• Update xmldom to fix medium security vulnerability [@​chriswhite199] | [#​1752]
• Update JSONWebToken to fix medium security vulnerability [@​chriswhite199] | [#​1753]

[10.10.0] - 2024-03-27

• Added 'JA4 Fingerprint' operation [@​n1474335] | [#​1759]

[10.9.0] - 2024-03-26

• Line ending sequences and UTF-8 character encoding are now detected automatically [@​n1474335] | [65ffd8d]

[10.8.0] - 2024-02-13

• Add official Docker images [@​AshCorr] | [#​1699]

[10.7.0] - 2024-02-09

• Added 'File Tree' operation [@​sw5678] | [#​1667]
• Added 'RISON' operation [@​sg5506844] | [#​1555]
• Added 'MurmurHash3' operation [@​AliceGrey] | [#​1694]

[10.6.0] - 2024-02-03

• Updated 'Forensics Wiki' URLs to new domain [@​a3957273] | [#​1703]
• Added 'LZNT1 Decompress' operation [@​0xThiebaut] | [#​1675]
• Updated 'Regex Expression' UUID matcher [@​cnotin] | [#​1678]
• Removed duplicate 'hover' message within baking info [@​KevinSJ] | [#​1541]

[10.5.0] - 2023-07-14

• Added GOST Encrypt, Decrypt, Sign, Verify, Key Wrap, and Key Unwrap operations [@​n1474335] | [#​592]

[10.4.0] - 2023-03-24

• Added 'Generate De Bruijn Sequence' operation [@​gchq77703] | [#​493]

[10.3.0] - 2023-03-24

• Added 'Argon2' and 'Argon2 compare' operations [@​Xenonym] | [#​661]

[10.2.0] - 2023-03-23

• Added 'Derive HKDF key' operation [@​mikecat] | [#​1528]

[10.1.0] - 2023-03-23

• Added 'Levenshtein Distance' operation [@​mikecat] | [#​1498]
• Added 'Swap case' operation [@​mikecat] | [#​1499]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[f2c-ci-robot]

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[f2c-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 11.x releases. But if you manually upgrade to 11.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.