From 4a70dff3f2c6aacd8a8bbca42c440082efe88069 Mon Sep 17 00:00:00 2001
From: GCHQ Developer 85297 <95289555+C85297@users.noreply.github.com>
Date: Fri, 19 Jun 2026 14:01:19 +0100
Subject: [PATCH 01/14] Fix URL encoding incorrectly converting input to UTF-8
 (#2340)

---
 src/core/operations/URLEncode.mjs          | 40 ++++++++++++----------
 tests/operations/tests/URLEncodeDecode.mjs | 26 ++++++++++++++
 2 files changed, 48 insertions(+), 18 deletions(-)

diff --git a/src/core/operations/URLEncode.mjs b/src/core/operations/URLEncode.mjs
index a5efd213..99eec91d 100644
--- a/src/core/operations/URLEncode.mjs
+++ b/src/core/operations/URLEncode.mjs
@@ -21,7 +21,7 @@ class URLEncode extends Operation {
         this.module = "URL";
         this.description = "Encodes problematic characters into percent-encoding, a format supported by URIs/URLs.<br><br>e.g. <code>=</code> becomes <code>%3d</code>";
         this.infoURL = "https://wikipedia.org/wiki/Percent-encoding";
-        this.inputType = "string";
+        this.inputType = "byteArray";
         this.outputType = "string";
         this.args = [
             {
@@ -33,34 +33,38 @@ class URLEncode extends Operation {
     }
 
     /**
-     * @param {string} input
+     * @param {byteArray} input
      * @param {Object[]} args
      * @returns {string}
      */
     run(input, args) {
         const encodeAll = args[0];
-        return encodeAll ? this.encodeAllChars(input) : encodeURI(input);
+        return this.encodeBytes(input, encodeAll);
     }
 
     /**
-     * Encode characters in URL outside of encodeURI() function spec
+     * Encode bytes in URL using percent encoding.
      *
-     * @param {string} str
+     * @param {byteArray} bytes
+     * @param {boolean} encodeAll
      * @returns {string}
      */
-    encodeAllChars (str) {
-        // TODO Do this programmatically
-        return encodeURIComponent(str)
-            .replace(/!/g, "%21")
-            .replace(/#/g, "%23")
-            .replace(/'/g, "%27")
-            .replace(/\(/g, "%28")
-            .replace(/\)/g, "%29")
-            .replace(/\*/g, "%2A")
-            .replace(/-/g, "%2D")
-            .replace(/\./g, "%2E")
-            .replace(/_/g, "%5F")
-            .replace(/~/g, "%7E");
+    encodeBytes(bytes, encodeAll) {
+        const safeChars = encodeAll ?
+            /^[A-Za-z0-9]$/ :
+            /^[A-Za-z0-9:/?#[\]@!$&'()*+,;=%]$/;
+
+        let output = "";
+
+        for (const byte of bytes) {
+            const char = String.fromCharCode(byte);
+
+            output += safeChars.test(char) ?
+                char :
+                "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+        }
+
+        return output;
     }
 
 }
diff --git a/tests/operations/tests/URLEncodeDecode.mjs b/tests/operations/tests/URLEncodeDecode.mjs
index 444f76d3..8d9d09db 100644
--- a/tests/operations/tests/URLEncodeDecode.mjs
+++ b/tests/operations/tests/URLEncodeDecode.mjs
@@ -89,4 +89,30 @@ TestRegister.addTests([
             },
         ],
     },
+    {
+        name: "URLEncode: encodes UTF-8 text as UTF-8 bytes",
+        input: "你好",
+        expectedOutput: "%E4%BD%A0%E5%A5%BD",
+        recipeConfig: [
+            {
+                op: "URL Encode",
+                args: [false],
+            },
+        ],
+    },
+    {
+        name: "URLEncode: preserves raw bytes from From Hex",
+        input: "6c6567697466696c6580000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090746869737761737375706f736564746f6265616e6578706c6f6974",
+        expectedOutput: "legitfile%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%90thiswassuposedtobeanexploit",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: ["None"],
+            },
+            {
+                op: "URL Encode",
+                args: [false],
+            },
+        ],
+    },
 ]);

From ddbe9141322baf88b575ac1615b8e68d3c53b412 Mon Sep 17 00:00:00 2001
From: Shailendra Singh <84718204+Shailendra1703@users.noreply.github.com>
Date: Fri, 19 Jun 2026 23:59:40 +0530
Subject: [PATCH 02/14] Added RenderPDF functionality (#2105)

Co-authored-by: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> very basic unit testing
---
 src/core/config/Categories.json      |   4 +-
 src/core/operations/RenderPDF.mjs    | 100 +++++++++++++++++++++++++++
 tests/node/tests/nodeApi.mjs         |   2 +-
 tests/operations/tests/RenderPDF.mjs |  37 ++++++++++
 4 files changed, 140 insertions(+), 3 deletions(-)
 create mode 100644 src/core/operations/RenderPDF.mjs
 create mode 100644 tests/operations/tests/RenderPDF.mjs

diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json
index bce89d4c..2879a13a 100644
--- a/src/core/config/Categories.json
+++ b/src/core/config/Categories.json
@@ -558,7 +558,7 @@
             "Scatter chart",
             "Series chart",
             "Heatmap chart",
-            "Extract Audio Metadata"
+            "Render PDF"
         ]
     },
     {
@@ -603,4 +603,4 @@
             "Comment"
         ]
     }
-]
+]
\ No newline at end of file
diff --git a/src/core/operations/RenderPDF.mjs b/src/core/operations/RenderPDF.mjs
new file mode 100644
index 00000000..c1b6cfb5
--- /dev/null
+++ b/src/core/operations/RenderPDF.mjs
@@ -0,0 +1,100 @@
+/**
+ * @author Shailendra [singhshailendra.in]
+ * @copyright Crown Copyright 2017
+ * @license Apache-2.0
+ */
+
+import { fromBase64, toBase64 } from "../lib/Base64.mjs";
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import Utils from "../Utils.mjs";
+
+/**
+ * Render PDF operation
+ */
+class RenderPDF extends Operation {
+
+    /**
+     * RenderPDF constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Render PDF";
+        this.module = "File";
+        this.description = "Displays the input as a PDF preview. Supports Raw and Base64 input formats.";
+        this.inputType = "string";
+        this.outputType = "byteArray";
+        this.presentType = "html";
+        this.args = [
+            {
+                "name": "Input format",
+                "type": "option",
+                "value": ["Base64", "Raw"],
+            }
+        ];
+        this.checks = [
+            {
+                pattern: "^%PDF-",
+                flags: "",
+                args: ["Raw"],
+                useful: true,
+                output: {
+                    mime: "application/pdf"
+                }
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {byteArray}
+     */
+    run(input, args) {
+        const inputFormat = args[0];
+
+        if (!input.length) return [];
+
+        // Convert input to raw bytes
+        switch (inputFormat) {
+            case "Base64":
+                input = fromBase64(input, undefined, "byteArray");
+                break;
+            case "Raw":
+            default:
+                input = Utils.strToByteArray(input);
+                break;
+        }
+
+        // Check PDF signature
+        if (
+            input[0] !== 0x25 || // %
+            input[1] !== 0x50 || // P
+            input[2] !== 0x44 || // D
+            input[3] !== 0x46    // F
+        ) {
+            throw new OperationError("Input does not appear to be a PDF file.");
+        }
+
+        return input;
+    }
+
+    /**
+     * Displays the PDF using HTML for web apps.
+     *
+     * @param {byteArray} data
+     * @returns {html}
+     */
+    async present(data) {
+        if (!data.length) return "";
+
+        const base64 = toBase64(data);
+        const dataURI = "data:application/pdf;base64," + base64;
+
+        return `<iframe src="${dataURI}" style="width:100%;height:100%;border:1px solid #ccc;"></iframe>`;
+    }
+
+}
+
+export default RenderPDF;
diff --git a/tests/node/tests/nodeApi.mjs b/tests/node/tests/nodeApi.mjs
index 2510ef17..5f2476ee 100644
--- a/tests/node/tests/nodeApi.mjs
+++ b/tests/node/tests/nodeApi.mjs
@@ -136,7 +136,7 @@ TestRegister.addApiTests([
 
     it("chef.help: returns multiple results", () => {
         const result = chef.help("base 64");
-        assert.strictEqual(result.length, 13);
+        assert.strictEqual(result.length, 14);
     }),
 
     it("chef.help: looks in description for matches too", () => {
diff --git a/tests/operations/tests/RenderPDF.mjs b/tests/operations/tests/RenderPDF.mjs
new file mode 100644
index 00000000..f359aa20
--- /dev/null
+++ b/tests/operations/tests/RenderPDF.mjs
@@ -0,0 +1,37 @@
+/**
+ * RenderPDF tests.
+ *
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+
+TestRegister.addTests([
+    {
+        name: "RenderPDF",
+        input: "Not a PDF",
+        expectedOutput: "Input does not appear to be a PDF file.",
+        recipeConfig: [
+            {
+                op: "Render PDF",
+                args: ["Raw"]
+            },
+        ],
+    },
+    {
+        name: "RenderPDF",
+        input: "",
+        expectedMatch: /^<iframe src="data:application\/pdf;base64,JVBERi0xLjAKCjEgMCBvYmogPDwg/,
+        recipeConfig: [
+            {
+                "op": "Generate QR Code",
+                "args": ["PDF", 1, 1, "Low"]
+            },
+            {
+                "op": "Render PDF",
+                "args": ["Raw"]
+            }
+        ],
+    },
+]);

From f0468d391d974b046e4b2757f09d2c9a79667107 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 09:21:07 +0200
Subject: [PATCH 03/14] fix Median operation returns incorrect result for
 unsorted odd-length inputs (#2284)

---
 src/core/lib/Arithmetic.mjs       | 13 +++++++-----
 tests/operations/tests/Median.mjs | 33 +++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 5 deletions(-)
 create mode 100644 tests/operations/tests/Median.mjs

diff --git a/src/core/lib/Arithmetic.mjs b/src/core/lib/Arithmetic.mjs
index 7c10855f..5fbc5771 100644
--- a/src/core/lib/Arithmetic.mjs
+++ b/src/core/lib/Arithmetic.mjs
@@ -108,14 +108,17 @@ export function mean(data) {
  * @returns {BigNumber}
  */
 export function median(data) {
-    if ((data.length % 2) === 0 && data.length > 0) {
+    if (data.length > 0) {
         data.sort(function(a, b) {
             return a.minus(b);
         });
-        const first = data[Math.floor(data.length / 2)];
-        const second = data[Math.floor(data.length / 2) - 1];
-        return mean([first, second]);
-    } else {
+
+        if ((data.length % 2) === 0) {
+            const first = data[Math.floor(data.length / 2)];
+            const second = data[Math.floor(data.length / 2) - 1];
+            return mean([first, second]);
+        }
+
         return data[Math.floor(data.length / 2)];
     }
 }
diff --git a/tests/operations/tests/Median.mjs b/tests/operations/tests/Median.mjs
new file mode 100644
index 00000000..555f2edd
--- /dev/null
+++ b/tests/operations/tests/Median.mjs
@@ -0,0 +1,33 @@
+/**
+ * Median operation tests.
+ *
+ * @author copilot-swe-agent[bot]
+ * @copyright Crown Copyright 2018
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Median: odd-length input",
+        input: "10 1 2",
+        expectedOutput: "2",
+        recipeConfig: [
+            {
+                op: "Median",
+                args: ["Space"],
+            },
+        ],
+    },
+    {
+        name: "Median: even-length input",
+        input: "10 1 2 5",
+        expectedOutput: "3.5",
+        recipeConfig: [
+            {
+                op: "Median",
+                args: ["Space"],
+            },
+        ],
+    },
+]);

From 0fd6190b4676142f56e0c11a05a14e1a95af1e4f Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 09:48:49 +0200
Subject: [PATCH 04/14] fix: From Base operation produces wrong results for
 fractional inputs (#2285)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/core/operations/FromBase.mjs    |  3 +-
 tests/operations/tests/FromBase.mjs | 66 +++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 tests/operations/tests/FromBase.mjs

diff --git a/src/core/operations/FromBase.mjs b/src/core/operations/FromBase.mjs
index 4abd5c44..8e69153b 100644
--- a/src/core/operations/FromBase.mjs
+++ b/src/core/operations/FromBase.mjs
@@ -51,9 +51,10 @@ class FromBase extends Operation {
         if (number.length === 1) return result;
 
         // Fractional part
+        const radixBN = new BigNumber(radix);
         for (let i = 0; i < number[1].length; i++) {
             const digit = new BigNumber(number[1][i], radix);
-            result += digit.div(Math.pow(radix, i+1));
+            result = result.plus(digit.div(radixBN.pow(i + 1)));
         }
 
         return result;
diff --git a/tests/operations/tests/FromBase.mjs b/tests/operations/tests/FromBase.mjs
new file mode 100644
index 00000000..9f89a1f9
--- /dev/null
+++ b/tests/operations/tests/FromBase.mjs
@@ -0,0 +1,66 @@
+/**
+ * From Base operation tests.
+ *
+ * @author Willi Ballenthin
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "From Base: binary integer",
+        input: "1010",
+        expectedOutput: "10",
+        recipeConfig: [
+            {
+                op: "From Base",
+                args: [2],
+            },
+        ],
+    },
+    {
+        name: "From Base: binary fraction",
+        input: "10.1",
+        expectedOutput: "2.5",
+        recipeConfig: [
+            {
+                op: "From Base",
+                args: [2],
+            },
+        ],
+    },
+    {
+        name: "From Base: hex fraction",
+        input: "a.8",
+        expectedOutput: "10.5",
+        recipeConfig: [
+            {
+                op: "From Base",
+                args: [16],
+            },
+        ],
+    },
+    {
+        name: "From Base: octal integer",
+        input: "77",
+        expectedOutput: "63",
+        recipeConfig: [
+            {
+                op: "From Base",
+                args: [8],
+            },
+        ],
+    },
+    {
+        name: "From Base: octal fraction",
+        input: "7.4",
+        expectedOutput: "7.5",
+        recipeConfig: [
+            {
+                op: "From Base",
+                args: [8],
+            },
+        ],
+    },
+]);

From 5a2eeed06680080e0a29c31ce3740740b840f0fe Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 09:52:56 +0200
Subject: [PATCH 05/14] fix Set Difference and Set Intersection preserve
 duplicates from first sample (#2286)

---
 src/core/operations/SetDifference.mjs      |  9 +++++++-
 src/core/operations/SetIntersection.mjs    |  9 +++++++-
 tests/operations/tests/SetDifference.mjs   | 22 ++++++++++++++++++++
 tests/operations/tests/SetIntersection.mjs | 24 +++++++++++++++++++++-
 4 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/src/core/operations/SetDifference.mjs b/src/core/operations/SetDifference.mjs
index dc46c079..d5ab92d3 100644
--- a/src/core/operations/SetDifference.mjs
+++ b/src/core/operations/SetDifference.mjs
@@ -75,9 +75,16 @@ class SetDifference extends Operation {
      * @returns {Object[]}
      */
     runSetDifference(a, b) {
+        const excluded = new Set(b);
+        const seen = new Set();
+
         return a
             .filter((item) => {
-                return b.indexOf(item) === -1;
+                if (excluded.has(item) || seen.has(item)) {
+                    return false;
+                }
+                seen.add(item);
+                return true;
             })
             .join(this.itemDelimiter);
     }
diff --git a/src/core/operations/SetIntersection.mjs b/src/core/operations/SetIntersection.mjs
index 7e6dbe10..423fcd4f 100644
--- a/src/core/operations/SetIntersection.mjs
+++ b/src/core/operations/SetIntersection.mjs
@@ -75,9 +75,16 @@ class SetIntersection extends Operation {
      * @returns {Object[]}
      */
     runIntersect(a, b) {
+        const included = new Set(b);
+        const seen = new Set();
+
         return a
             .filter((item) => {
-                return b.indexOf(item) > -1;
+                if (!included.has(item) || seen.has(item)) {
+                    return false;
+                }
+                seen.add(item);
+                return true;
             })
             .join(this.itemDelimiter);
     }
diff --git a/tests/operations/tests/SetDifference.mjs b/tests/operations/tests/SetDifference.mjs
index 40fac524..5836cb36 100644
--- a/tests/operations/tests/SetDifference.mjs
+++ b/tests/operations/tests/SetDifference.mjs
@@ -53,4 +53,26 @@ TestRegister.addTests([
             },
         ],
     },
+    {
+        name: "Set Difference: duplicates in first set are removed",
+        input: "red,red,blue\n\nblue",
+        expectedOutput: "red",
+        recipeConfig: [
+            {
+                op: "Set Difference",
+                args: ["\n\n", ","],
+            },
+        ],
+    },
+    {
+        name: "Set Difference: duplicates in both sets",
+        input: "1 1 2 2 3\n\n2 2 3 3",
+        expectedOutput: "1",
+        recipeConfig: [
+            {
+                op: "Set Difference",
+                args: ["\n\n", " "],
+            },
+        ],
+    },
 ]);
diff --git a/tests/operations/tests/SetIntersection.mjs b/tests/operations/tests/SetIntersection.mjs
index c9146c01..a638db4a 100644
--- a/tests/operations/tests/SetIntersection.mjs
+++ b/tests/operations/tests/SetIntersection.mjs
@@ -52,5 +52,27 @@ TestRegister.addTests([
                 args: ["z", "-"],
             },
         ],
-    }
+    },
+    {
+        name: "Set Intersection: duplicates in first set are removed",
+        input: "red,red,blue\n\nred,blue",
+        expectedOutput: "red,blue",
+        recipeConfig: [
+            {
+                op: "Set Intersection",
+                args: ["\n\n", ","],
+            },
+        ],
+    },
+    {
+        name: "Set Intersection: duplicates in both sets",
+        input: "1 1 2 2 3\n\n2 2 3 3 4",
+        expectedOutput: "2 3",
+        recipeConfig: [
+            {
+                op: "Set Intersection",
+                args: ["\n\n", " "],
+            },
+        ],
+    },
 ]);

From 9a8a279b826f066916a3673c78cb39c79f13175f Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 09:56:09 +0200
Subject: [PATCH 06/14] fix: Unescape Unicode Characters accepts 4-6 hex digits
 for U+ prefix (#2287)

---
 .../operations/UnescapeUnicodeCharacters.mjs  |  3 +-
 .../tests/UnescapeUnicodeCharacters.mjs       | 88 +++++++++++++++++++
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 tests/operations/tests/UnescapeUnicodeCharacters.mjs

diff --git a/src/core/operations/UnescapeUnicodeCharacters.mjs b/src/core/operations/UnescapeUnicodeCharacters.mjs
index 02d16662..f7759c78 100644
--- a/src/core/operations/UnescapeUnicodeCharacters.mjs
+++ b/src/core/operations/UnescapeUnicodeCharacters.mjs
@@ -56,7 +56,8 @@ class UnescapeUnicodeCharacters extends Operation {
      */
     run(input, args) {
         const prefix = prefixToRegex[args[0]],
-            regex = new RegExp(prefix+"([a-f\\d]{4})", "ig");
+            quantifier = args[0] === "U+" ? "{4,6}" : "{4}",
+            regex = new RegExp(prefix+"([a-f\\d]"+quantifier+")", "ig");
         let output = "",
             m,
             i = 0;
diff --git a/tests/operations/tests/UnescapeUnicodeCharacters.mjs b/tests/operations/tests/UnescapeUnicodeCharacters.mjs
new file mode 100644
index 00000000..99955e04
--- /dev/null
+++ b/tests/operations/tests/UnescapeUnicodeCharacters.mjs
@@ -0,0 +1,88 @@
+/**
+ * Unescape Unicode Characters operation tests.
+ *
+ * @author williballenthin
+ * @copyright Crown Copyright 2024
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Unescape Unicode Characters: \\u 4-digit BMP",
+        input: "\\u03c3\\u03bf\\u03c5",
+        expectedOutput: "σου",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["\\u"],
+            },
+        ],
+    },
+    {
+        name: "Unescape Unicode Characters: %u 4-digit BMP",
+        input: "%u03c3%u03bf%u03c5",
+        expectedOutput: "σου",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["%u"],
+            },
+        ],
+    },
+    {
+        name: "Unescape Unicode Characters: U+ 4-digit BMP",
+        input: "U+0041",
+        expectedOutput: "A",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["U+"],
+            },
+        ],
+    },
+    {
+        name: "Unescape Unicode Characters: U+ 5-digit astral plane emoji",
+        input: "U+1F600",
+        expectedOutput: "\u{1F600}",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["U+"],
+            },
+        ],
+    },
+    {
+        name: "Unescape Unicode Characters: U+ 6-digit zero-padded",
+        input: "U+000041",
+        expectedOutput: "A",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["U+"],
+            },
+        ],
+    },
+    {
+        name: "Unescape Unicode Characters: U+ mixed lengths",
+        input: "U+0041 U+1F600 U+000042",
+        expectedOutput: "A \u{1F600} B",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["U+"],
+            },
+        ],
+    },
+    {
+        name: "Unescape Unicode Characters: passthrough with no matches",
+        input: "hello world",
+        expectedOutput: "hello world",
+        recipeConfig: [
+            {
+                op: "Unescape Unicode Characters",
+                args: ["\\u"],
+            },
+        ],
+    },
+]);

From 0a0d95bcbd7fece2004b77b540f2d3089f171b46 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 09:59:30 +0200
Subject: [PATCH 07/14] fix TLV Parser BER long-form length parsing (#2289)

---
 src/core/lib/TLVParser.mjs          | 23 +++++++++++-----
 tests/operations/tests/ParseTLV.mjs | 41 +++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/src/core/lib/TLVParser.mjs b/src/core/lib/TLVParser.mjs
index cb8432c1..1afd052e 100644
--- a/src/core/lib/TLVParser.mjs
+++ b/src/core/lib/TLVParser.mjs
@@ -33,20 +33,29 @@ export default class TLVParser {
      * @returns {number}
      */
     getLength() {
+        let bytesInLength = this.bytesInLength;
+        let bigEndian = false;
+
         if (this.basicEncodingRules) {
-            const bit = this.input[this.location];
-            if (bit & 0x80) {
-                this.bytesInLength = bit & ~0x80;
+            const firstLengthByte = this.input[this.location];
+            this.location++;
+
+            if (firstLengthByte & 0x80) {
+                bytesInLength = firstLengthByte & ~0x80;
+                bigEndian = true;
             } else {
-                this.location++;
-                return bit & ~0x80;
+                return firstLengthByte & ~0x80;
             }
         }
 
         let length = 0;
 
-        for (let i = 0; i < this.bytesInLength; i++) {
-            length += this.input[this.location] * Math.pow(Math.pow(2, 8), i);
+        for (let i = 0; i < bytesInLength; i++) {
+            if (bigEndian) {
+                length = (length << 8) + this.input[this.location];
+            } else {
+                length += this.input[this.location] * Math.pow(Math.pow(2, 8), i);
+            }
             this.location++;
         }
 
diff --git a/tests/operations/tests/ParseTLV.mjs b/tests/operations/tests/ParseTLV.mjs
index 5c99eee2..9033848d 100644
--- a/tests/operations/tests/ParseTLV.mjs
+++ b/tests/operations/tests/ParseTLV.mjs
@@ -52,5 +52,46 @@ TestRegister.addTests([
                 "args": [1, 4, true] // length value is patently wrong, should be ignored by BER.
             }
         ]
+    },
+    {
+        name: "Parse TLV: BER long-form length (two-byte length encoding)",
+        input: "\x01\x82\x01\x00" + "A".repeat(256) + "\x02\x03\x41\x42\x43",
+        expectedOutput: JSON.stringify([
+            {"key": [1], "length": 256, "value": Array(256).fill(65)},
+            {"key": [2], "length": 3, "value": [65, 66, 67]}
+        ], null, 4),
+        recipeConfig: [
+            {
+                "op": "Parse TLV",
+                "args": [1, 1, true]
+            }
+        ]
+    },
+    {
+        name: "Parse TLV: BER long-form length (one-byte length encoding)",
+        input: "\x01\x81\x80" + "B".repeat(128),
+        expectedOutput: JSON.stringify([
+            {"key": [1], "length": 128, "value": Array(128).fill(66)}
+        ], null, 4),
+        recipeConfig: [
+            {
+                "op": "Parse TLV",
+                "args": [1, 1, true]
+            }
+        ]
+    },
+    {
+        name: "Parse TLV: BER multiple entries with mixed short and long-form lengths",
+        input: "\x01\x05\x48\x65\x6c\x6c\x6f\x02\x81\x05\x57\x6f\x72\x6c\x64",
+        expectedOutput: JSON.stringify([
+            {"key": [1], "length": 5, "value": [72, 101, 108, 108, 111]},
+            {"key": [2], "length": 5, "value": [87, 111, 114, 108, 100]}
+        ], null, 4),
+        recipeConfig: [
+            {
+                "op": "Parse TLV",
+                "args": [1, 1, true]
+            }
+        ]
     }
 ]);

From 8105e3eb070aedac8b10aaa895ecbeb14279b147 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 10:03:12 +0200
Subject: [PATCH 08/14] fix: Gzip comment with header checksum produces corrupt
 streams (#2288)

---
 src/core/operations/Gzip.mjs    |  4 +--
 tests/operations/tests/Gzip.mjs | 60 +++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/src/core/operations/Gzip.mjs b/src/core/operations/Gzip.mjs
index 093ae6a4..43eaf091 100644
--- a/src/core/operations/Gzip.mjs
+++ b/src/core/operations/Gzip.mjs
@@ -74,13 +74,11 @@ class Gzip extends Operation {
         }
         if (comment.length) {
             options.flags.comment = true;
+            options.flags.fcomment = true;
             options.comment = comment;
         }
         const gzipObj = new Zlib.Gzip(new Uint8Array(input), options);
         const compressed = new Uint8Array(gzipObj.compress());
-        if (options.flags.comment && !(compressed[3] & 0x10)) {
-            compressed[3] |= 0x10;
-        }
         return compressed.buffer;
     }
 
diff --git a/tests/operations/tests/Gzip.mjs b/tests/operations/tests/Gzip.mjs
index c9b2b8ca..a936f5d0 100644
--- a/tests/operations/tests/Gzip.mjs
+++ b/tests/operations/tests/Gzip.mjs
@@ -86,4 +86,64 @@ TestRegister.addTests([
             }
         ]
     },
+    {
+        name: "Gzip: Comment with checksum round-trips through Gunzip",
+        input: "hello hello hello",
+        expectedOutput: "hello hello hello",
+        recipeConfig: [
+            {
+                op: "Gzip",
+                args: ["Dynamic Huffman Coding", "", "test", true]
+            },
+            {
+                op: "Gunzip",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "Gzip: Filename and comment with checksum round-trips through Gunzip",
+        input: "The quick brown fox jumped over the slow dog",
+        expectedOutput: "The quick brown fox jumped over the slow dog",
+        recipeConfig: [
+            {
+                op: "Gzip",
+                args: ["Dynamic Huffman Coding", "file.txt", "a comment", true]
+            },
+            {
+                op: "Gunzip",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "Gzip: No comment, with checksum round-trips through Gunzip",
+        input: "The quick brown fox jumped over the slow dog",
+        expectedOutput: "The quick brown fox jumped over the slow dog",
+        recipeConfig: [
+            {
+                op: "Gzip",
+                args: ["Dynamic Huffman Coding", "", "", true]
+            },
+            {
+                op: "Gunzip",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "Gzip: No options round-trips through Gunzip",
+        input: "The quick brown fox jumped over the slow dog",
+        expectedOutput: "The quick brown fox jumped over the slow dog",
+        recipeConfig: [
+            {
+                op: "Gzip",
+                args: ["Dynamic Huffman Coding", "", "", false]
+            },
+            {
+                op: "Gunzip",
+                args: []
+            }
+        ]
+    },
 ]);

From 64fc664479bb03f3f026832141d4af2e34ef9091 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 11:41:53 +0200
Subject: [PATCH 09/14] fix: MIME Decoding corrupts non-ASCII characters in
 Base64-encoded words (#2291)

---
 src/core/operations/MIMEDecoding.mjs    |  2 +-
 tests/operations/tests/MIMEDecoding.mjs | 33 +++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/src/core/operations/MIMEDecoding.mjs b/src/core/operations/MIMEDecoding.mjs
index 7b52fbdd..4ba04c18 100644
--- a/src/core/operations/MIMEDecoding.mjs
+++ b/src/core/operations/MIMEDecoding.mjs
@@ -87,7 +87,7 @@ class MIMEDecoding extends Operation {
             end = cur + j + "?=".length;
 
             if (encoding.toLowerCase() === "b") {
-                text = fromBase64(text);
+                text = fromBase64(text, undefined, "byteArray");
             } else if (encoding.toLowerCase() === "q") {
                 text = this.parseQEncodedWord(text);
             } else {
diff --git a/tests/operations/tests/MIMEDecoding.mjs b/tests/operations/tests/MIMEDecoding.mjs
index b99fc489..2c362542 100644
--- a/tests/operations/tests/MIMEDecoding.mjs
+++ b/tests/operations/tests/MIMEDecoding.mjs
@@ -75,6 +75,39 @@ TestRegister.addTests([
             }
         ]
     },
+    {
+        name: "UTF-8 Base64 non-ASCII",
+        input: "Subject: =?UTF-8?B?Y2Fmw6k=?=",
+        expectedOutput: "Subject: café",
+        recipeConfig: [
+            {
+                "op": "MIME Decoding",
+                "args": []
+            }
+        ]
+    },
+    {
+        name: "UTF-8 Base64 multibyte CJK",
+        input: "Subject: =?UTF-8?B?5pel5pys6Kqe?=",
+        expectedOutput: "Subject: 日本語",
+        recipeConfig: [
+            {
+                "op": "MIME Decoding",
+                "args": []
+            }
+        ]
+    },
+    {
+        name: "UTF-8 Base64 ASCII-only",
+        input: "Subject: =?UTF-8?B?aGVsbG8=?=",
+        expectedOutput: "Subject: hello",
+        recipeConfig: [
+            {
+                "op": "MIME Decoding",
+                "args": []
+            }
+        ]
+    },
     {
         name: "ISO Decoding",
         input: "From: =?US-ASCII?Q?Keith_Moore?= <moore@cs.utk.edu>\nTo: =?ISO-8859-1?Q?Keld_J=F8rn_Simonsen?= <keld@dkuug.dk>\nCC: =?ISO-8859-1?Q?Andr=E9?= Pirard <PIRARD@vm1.ulg.ac.be>\nSubject: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?=\n=?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=",

From 08e5c13da4b2404e824a8e358f1093393ee41780 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 11:49:47 +0200
Subject: [PATCH 10/14] fix Dechunk HTTP Response leaks terminating chunk and
 trailers into output (#2290)

---
 src/core/operations/DechunkHTTPResponse.mjs   |  5 +-
 .../operations/tests/DechunkHTTPResponse.mjs  | 66 +++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 tests/operations/tests/DechunkHTTPResponse.mjs

diff --git a/src/core/operations/DechunkHTTPResponse.mjs b/src/core/operations/DechunkHTTPResponse.mjs
index da2eb437..40b97c7a 100644
--- a/src/core/operations/DechunkHTTPResponse.mjs
+++ b/src/core/operations/DechunkHTTPResponse.mjs
@@ -45,12 +45,15 @@ class DechunkHTTPResponse extends Operation {
         const lineEndingsLength = lineEndings.length;
         let chunkSize = parseInt(input.slice(0, chunkSizeEnd), 16);
         while (!isNaN(chunkSize)) {
+            if (chunkSize === 0) {
+                break;
+            }
             chunks.push(input.slice(chunkSizeEnd, chunkSize + chunkSizeEnd));
             input = input.slice(chunkSizeEnd + chunkSize + lineEndingsLength);
             chunkSizeEnd = input.indexOf(lineEndings) + lineEndingsLength;
             chunkSize = parseInt(input.slice(0, chunkSizeEnd), 16);
         }
-        return chunks.join("") + input;
+        return chunks.join("");
     }
 
 }
diff --git a/tests/operations/tests/DechunkHTTPResponse.mjs b/tests/operations/tests/DechunkHTTPResponse.mjs
new file mode 100644
index 00000000..2a678c89
--- /dev/null
+++ b/tests/operations/tests/DechunkHTTPResponse.mjs
@@ -0,0 +1,66 @@
+/**
+ * DechunkHTTPResponse operation tests.
+ *
+ * @author Willi Ballenthin
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Dechunk HTTP response: CRLF line endings",
+        input: "7\r\nMozilla\r\n9\r\nDeveloper\r\n7\r\nNetwork\r\n0\r\n\r\n",
+        expectedOutput: "MozillaDeveloperNetwork",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: LF line endings",
+        input: "7\nMozilla\n9\nDeveloper\n7\nNetwork\n0\n\n",
+        expectedOutput: "MozillaDeveloperNetwork",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: single chunk",
+        input: "5\r\nHello\r\n0\r\n\r\n",
+        expectedOutput: "Hello",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: trailing headers discarded",
+        input: "7\nMozilla\n9\nDeveloper\n7\nNetwork\n0\nExpires: Wed, 21 Oct 2015 07:28:00 GMT\n",
+        expectedOutput: "MozillaDeveloperNetwork",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: hex chunk sizes",
+        input: "a\r\n0123456789\r\n0\r\n\r\n",
+        expectedOutput: "0123456789",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+]);

From 0d2af8ce003ce444c9fb00a07aa3eb972653baa2 Mon Sep 17 00:00:00 2001
From: min23asdw <76154445+min23asdw@users.noreply.github.com>
Date: Sat, 20 Jun 2026 17:40:37 +0700
Subject: [PATCH 11/14] fix: jsonata $base64decode/$base64encode in Web Worker
 (#2275)

---
 src/core/operations/Jsonata.mjs    | 12 ++++++++++++
 tests/browser/02_ops.js            |  1 +
 tests/operations/tests/Jsonata.mjs | 23 +++++++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/src/core/operations/Jsonata.mjs b/src/core/operations/Jsonata.mjs
index 82cc4d39..04259343 100644
--- a/src/core/operations/Jsonata.mjs
+++ b/src/core/operations/Jsonata.mjs
@@ -51,6 +51,18 @@ class JsonataQuery extends Operation {
 
         try {
             const expression = jsonata(query);
+            // Override built-in base64 functions which fail in Web Worker
+            // context where `window` is undefined. The jsonata library falls
+            // back to `global.Buffer` which also does not exist in workers.
+            // `atob`/`btoa` are available in both browser and worker scopes.
+            expression.registerFunction("base64decode", (str) => {
+                if (typeof str === "undefined") return undefined;
+                return atob(str);
+            }, "<s-:s>");
+            expression.registerFunction("base64encode", (str) => {
+                if (typeof str === "undefined") return undefined;
+                return btoa(str);
+            }, "<s-:s>");
             result = await expression.evaluate(jsonObj);
         } catch (err) {
             throw new OperationError(
diff --git a/tests/browser/02_ops.js b/tests/browser/02_ops.js
index 9139a53a..bb1a5e78 100644
--- a/tests/browser/02_ops.js
+++ b/tests/browser/02_ops.js
@@ -218,6 +218,7 @@ module.exports = {
         testOpHtml(browser, "JSON Beautify", "{a:1}", ".json-dict .json-literal", "1");
         // testOp(browser, "JSON Minify", "test input", "test_output");
     // testOp(browser, "JSON to CSV", "test input", "test_output");
+        testOp(browser, "Jsonata Query", '{"a": "SGVsbG8gV29ybGQh"}', '"Hello World!"', ["$base64decode($.a)"]);
     // testOp(browser, "JWT Decode", "test input", "test_output");
     // testOp(browser, "JWT Sign", "test input", "test_output");
     // testOp(browser, "JWT Verify", "test input", "test_output");
diff --git a/tests/operations/tests/Jsonata.mjs b/tests/operations/tests/Jsonata.mjs
index fb46a961..54ecf34c 100644
--- a/tests/operations/tests/Jsonata.mjs
+++ b/tests/operations/tests/Jsonata.mjs
@@ -548,4 +548,27 @@ TestRegister.addTests([
             },
         ],
     },
+    // Base64 functions (issue #2063)
+    {
+        name: "Jsonata: $base64decode",
+        input: "{}",
+        expectedOutput: '"Hello World!"',
+        recipeConfig: [
+            {
+                op: "Jsonata Query",
+                args: ['$base64decode("SGVsbG8gV29ybGQh")'],
+            },
+        ],
+    },
+    {
+        name: "Jsonata: $base64encode",
+        input: "{}",
+        expectedOutput: '"SGVsbG8gV29ybGQh"',
+        recipeConfig: [
+            {
+                op: "Jsonata Query",
+                args: ['$base64encode("Hello World!")'],
+            },
+        ],
+    },
 ]);

From a0a369a7efa9ace61b8114afcd5184f653a05e48 Mon Sep 17 00:00:00 2001
From: Leon Zandman <leon@wirwar.com>
Date: Sat, 20 Jun 2026 13:01:14 +0200
Subject: [PATCH 12/14] Fix uncaught TypeError in "Show on map" operation.
 (#2453)

---
 src/core/operations/ShowOnMap.mjs    | 10 +++++++
 tests/operations/tests/ShowOnMap.mjs | 39 ++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 tests/operations/tests/ShowOnMap.mjs

diff --git a/src/core/operations/ShowOnMap.mjs b/src/core/operations/ShowOnMap.mjs
index d75c2aa6..2eab5140 100644
--- a/src/core/operations/ShowOnMap.mjs
+++ b/src/core/operations/ShowOnMap.mjs
@@ -71,6 +71,16 @@ class ShowOnMap extends Operation {
             }
             latLong = latLong.replace(/[,]$/, "");
             latLong = latLong.replace(/°/g, "");
+
+            // The map requires a latitude and longitude pair. If the conversion only produced a
+            // single value (e.g. because the chosen input delimiter didn't match the input), bail
+            // out with a helpful message rather than passing it on to the map, which would throw an
+            // uncaught TypeError in the browser.
+            const coords = latLong.split(",").map(v => v.trim());
+            if (coords.length !== 2 || coords.some(v => v === "" || isNaN(Number(v)))) {
+                throw new OperationError(`Could not show coordinates '${latLong}' on the map. Expected a latitude and longitude pair - check that the input format and delimiter are correct.`);
+            }
+
             return latLong;
         }
         return input;
diff --git a/tests/operations/tests/ShowOnMap.mjs b/tests/operations/tests/ShowOnMap.mjs
new file mode 100644
index 00000000..8605ae70
--- /dev/null
+++ b/tests/operations/tests/ShowOnMap.mjs
@@ -0,0 +1,39 @@
+/**
+ * Show on map tests
+ *
+ * @author Leon Zandman [leon@wirwar.com]
+ *
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Show on map: valid coordinate pair",
+        input: "51.5007, -0.1246",
+        // The presented output is the Leaflet map HTML; just check the coordinates made it through.
+        expectedMatch: /51\.5007,-0\.1246/,
+        recipeConfig: [
+            {
+                op: "Show on map",
+                args: [13, "Auto", "Auto"]
+            },
+        ],
+    },
+    {
+        // Regression test: a comma-separated input with the delimiter set to "\n" used to be
+        // mis-detected as a single Degrees Decimal Minutes value (1° 24' = 1.4°), producing a single
+        // coordinate. That single value was then passed to Leaflet's setView([1.4], ...), throwing
+        // an uncaught "Cannot read properties of null (reading 'lat')" TypeError in the browser.
+        name: "Show on map: single value is rejected with a helpful error",
+        input: "1, 24",
+        expectedOutput: "Could not show coordinates '1.4' on the map. Expected a latitude and longitude pair - check that the input format and delimiter are correct.",
+        recipeConfig: [
+            {
+                op: "Show on map",
+                args: [13, "Auto", "\\n"]
+            },
+        ],
+    },
+]);

From 080357a4f5738931b220a702537c1e4fe0d33fba Mon Sep 17 00:00:00 2001
From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com>
Date: Mon, 22 Jun 2026 11:51:12 +0100
Subject: [PATCH 13/14] Improve parameter validation for a number of operations
 where exceptions otherwise caused. (#2586)

---
 src/core/operations/BLAKE3.mjs                |  6 ++-
 src/core/operations/BitShiftLeft.mjs          |  5 ++-
 .../PseudoRandomNumberGenerator.mjs           |  3 +-
 src/core/operations/ToBase.mjs                |  8 ++--
 src/core/operations/ToBinary.mjs              |  5 ++-
 src/core/operations/XORBruteForce.mjs         |  5 ++-
 src/core/operations/XORChecksum.mjs           |  4 +-
 tests/operations/tests/BLAKE3.mjs             | 40 ++++++++++++++++++-
 8 files changed, 64 insertions(+), 12 deletions(-)

diff --git a/src/core/operations/BLAKE3.mjs b/src/core/operations/BLAKE3.mjs
index 53f7fdd6..a22eb0b8 100644
--- a/src/core/operations/BLAKE3.mjs
+++ b/src/core/operations/BLAKE3.mjs
@@ -30,7 +30,11 @@ class BLAKE3 extends Operation {
         this.args = [
             {
                 "name": "Size (bytes)",
-                "type": "number"
+                "type": "number",
+                "value": 16,
+                "min": 1,
+                "max": 65535, // arbitrary limit to prevent resource exhaustion
+                "integer": true,
             }, {
                 "name": "Key",
                 "type": "string",
diff --git a/src/core/operations/BitShiftLeft.mjs b/src/core/operations/BitShiftLeft.mjs
index cd9f4568..540ab659 100644
--- a/src/core/operations/BitShiftLeft.mjs
+++ b/src/core/operations/BitShiftLeft.mjs
@@ -27,7 +27,10 @@ class BitShiftLeft extends Operation {
             {
                 "name": "Amount",
                 "type": "number",
-                "value": 1
+                "value": 1,
+                "min": 0,
+                "max": 7,
+                "integer": true,
             }
         ];
     }
diff --git a/src/core/operations/PseudoRandomNumberGenerator.mjs b/src/core/operations/PseudoRandomNumberGenerator.mjs
index 53150566..da23c4de 100644
--- a/src/core/operations/PseudoRandomNumberGenerator.mjs
+++ b/src/core/operations/PseudoRandomNumberGenerator.mjs
@@ -31,7 +31,8 @@ class PseudoRandomNumberGenerator extends Operation {
             {
                 "name": "Number of bytes",
                 "type": "number",
-                "value": 32
+                "value": 32,
+                "min": 1
             },
             {
                 "name": "Output as",
diff --git a/src/core/operations/ToBase.mjs b/src/core/operations/ToBase.mjs
index 09a91571..4bf7ae83 100644
--- a/src/core/operations/ToBase.mjs
+++ b/src/core/operations/ToBase.mjs
@@ -28,7 +28,10 @@ class ToBase extends Operation {
             {
                 "name": "Radix",
                 "type": "number",
-                "value": 36
+                "value": 36,
+                "min": 2,
+                "max": 36,
+                "integer": true,
             }
         ];
     }
@@ -43,9 +46,6 @@ class ToBase extends Operation {
             throw new OperationError("Error: Input must be a number");
         }
         const radix = args[0];
-        if (radix < 2 || radix > 36) {
-            throw new OperationError("Error: Radix argument must be between 2 and 36");
-        }
         return input.toString(radix);
     }
 
diff --git a/src/core/operations/ToBinary.mjs b/src/core/operations/ToBinary.mjs
index ba72a55b..b19f94f0 100644
--- a/src/core/operations/ToBinary.mjs
+++ b/src/core/operations/ToBinary.mjs
@@ -35,7 +35,10 @@ class ToBinary extends Operation {
             {
                 "name": "Byte Length",
                 "type": "number",
-                "value": 8
+                "value": 8,
+                "min": 1,
+                "max": 256, // arbitrary - significantly larger than word size for any known machine ("640k ought to be enough for anybody")
+                "integer": true
             }
         ];
     }
diff --git a/src/core/operations/XORBruteForce.mjs b/src/core/operations/XORBruteForce.mjs
index 8c097731..96ea8ad0 100644
--- a/src/core/operations/XORBruteForce.mjs
+++ b/src/core/operations/XORBruteForce.mjs
@@ -31,7 +31,10 @@ class XORBruteForce extends Operation {
             {
                 "name": "Key length",
                 "type": "number",
-                "value": 1
+                "value": 1,
+                "min": 1,
+                "max": 2,
+                "integer": true
             },
             {
                 "name": "Sample length",
diff --git a/src/core/operations/XORChecksum.mjs b/src/core/operations/XORChecksum.mjs
index ca9c6fac..338b4bea 100644
--- a/src/core/operations/XORChecksum.mjs
+++ b/src/core/operations/XORChecksum.mjs
@@ -7,7 +7,7 @@
 import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import { toHex } from "../lib/Hex.mjs";
-import OperationError from "../errors/OperationError.mjs"; 
+import OperationError from "../errors/OperationError.mjs";
 
 /**
  * XOR Checksum operation
@@ -43,7 +43,7 @@ class XORChecksum extends Operation {
     run(input, args) {
         const blocksize = args[0];
 
-    
+
         if (!Number.isInteger(blocksize) || blocksize <= 0) {
             throw new OperationError("Blocksize must be a positive integer.");
         }
diff --git a/tests/operations/tests/BLAKE3.mjs b/tests/operations/tests/BLAKE3.mjs
index b3c14e99..e15144b2 100644
--- a/tests/operations/tests/BLAKE3.mjs
+++ b/tests/operations/tests/BLAKE3.mjs
@@ -69,5 +69,43 @@ TestRegister.addTests([
             { "op": "BLAKE3",
                 "args": [16390, "ThiskeyisexactlythirtytwoBytesLo"] }
         ]
-    }
+    },
+// test vectors from https://github.com/BLAKE3-team/BLAKE3/blob/master/test_vectors/test_vectors.json
+    {
+        name: "BLAKE3: Std test vector - 0 bytes input, plain hash",
+        input: "",
+        expectedOutput: "af1349b9f5f9a1a6a0404dea36dcc9499bcb25c9adc112b7cc9a93cae41f3262e00f03e7b69af26b7faaf09fcd333050338ddfe085b8cc869ca98b206c08243a26f5487789e8f660afe6c99ef9e0c52b92e7393024a80459cf91f476f9ffdbda7001c22e159b402631f277ca96f2defdf1078282314e763699a31c5363165421cce14d",
+        recipeConfig: [
+            {
+                "op": "BLAKE3",
+                "args": [131, ""]
+            }
+        ]
+    },
+    {
+        name: "BLAKE3: Std test vector - 0 bytes input, keyed hash",
+        input: "",
+        expectedOutput: "92b2b75604ed3c761f9d6f62392c8a9227ad0ea3f09573e783f1498a4ed60d26b18171a2f22a4b94822c701f107153dba24918c4bae4d2945c20ece13387627d3b73cbf97b797d5e59948c7ef788f54372df45e45e4293c7dc18c1d41144a9758be58960856be1eabbe22c2653190de560ca3b2ac4aa692a9210694254c371e851bc8f",
+        recipeConfig: [
+            {
+                "op": "BLAKE3",
+                "args": [131, "whats the Elvish word for friend"]
+            }
+        ]
+    },
+    {
+        name: "BLAKE3: Std test vector - 7 bytes input, keyed hash",
+        input: "0001020304050607",
+        expectedOutput: "be2f5495c61cba1bb348a34948c004045e3bd4dae8f0fe82bf44d0da245a060048eb5e68ce6dea1eb0229e144f578b3aa7e9f4f85febd135df8525e6fe40c6f0340d13dd09b255ccd5112a94238f2be3c0b5b7ecde06580426a93e0708555a265305abf86d874e34b4995b788e37a823491f25127a502fe0704baa6bfdf04e76c13276",
+        recipeConfig: [
+            {
+                "op": "From Hex",
+                args: [],
+            },
+            {
+                "op": "BLAKE3",
+                "args": [131, "whats the Elvish word for friend"]
+            }
+        ]
+    },
 ]);

From 9f87fec52d2780d23be73385205587a55e307596 Mon Sep 17 00:00:00 2001
From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com>
Date: Mon, 22 Jun 2026 11:52:26 +0100
Subject: [PATCH 14/14] =?UTF-8?q?Clean=20up/rationalise=20webpack=20paths?=
 =?UTF-8?q?=20and=20thereby=20increase=20compatibility=20for=20Win?=
 =?UTF-8?q?=E2=80=A6=20(#2585)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 webpack.config.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/webpack.config.js b/webpack.config.js
index 4c6c00ba..555a33c3 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -88,8 +88,8 @@ module.exports = {
                     from: "tesseract/**/*",
                     to: "assets/"
                 }, {
-                    context: "node_modules/tesseract.js/",
-                    from: "dist/worker.min.js",
+                    context: "node_modules/tesseract.js/dist",
+                    from: "worker.min.js",
                     to: "assets/tesseract"
                 }, {
                     context: "node_modules/tesseract.js-core/",
@@ -221,7 +221,7 @@ module.exports = {
             },
             { // Third party images are inlined
                 test: /\.(png|jpg|gif)$/,
-                exclude: /web\/static/,
+                include: /node_modules/,
                 type: "asset/inline",
             },
         ]