[dependabot]

Bumps github.com/grokify/mogo from 0.74.9 to 0.75.0.

Release notes

Sourced from github.com/grokify/mogo's releases.

v0.74.10

Full Changelog: grokify/mogo@v0.74.9...v0.74.10

Changelog

Sourced from github.com/grokify/mogo's changelog.

[v0.75.0] - 2026-10-01

Highlights

• crypto/aesutil now uses authenticated AES-GCM encryption; data encrypted by earlier versions must be re-encrypted

Breaking

• crypto/aesutil: EncryptAES(), DecryptAES(), and the Base58, JSON, base64, and file helpers built on them now use AES-GCM instead of AES-CFB. Ciphertext from earlier versions, including files written by WriteFileAES() and EncryptDirectoryFilesAES(), can no longer be decrypted and returns an error; decrypt existing data with v0.74.x and re-encrypt it before upgrading (997e933)

Changed

• crypto/aesutil: decryption now rejects tampered, truncated, and wrong-key ciphertext, and plaintext is no longer base64-encoded before encryption, reducing ciphertext size (997e933)

Fixed

• crypto/aesutil: DecryptAES() no longer overwrites its ciphertext argument (997e933)

Tests

• crypto/aesutil: add AES-GCM tests covering all key sizes, fresh nonces, rejection of tampered, wrong-key, and legacy CFB ciphertext, and the file and encoding helpers (1282281)

[v0.74.10] - 2026-10-01

Added

• net/http/retryhttp: add Limiter interface and WithLimiter() option for request pacing, with IntervalLimiter, NewIntervalLimiter(), and PerSecond() (9ec3e57)
• crypto/sshutil: add ParseAuthorizedKeyFile(), ScanDir(), and FindByFingerprint() for locating SSH public key files by SHA256 fingerprint (7ab42dc)
• cmd/mogo: add mogo CLI with ssh list, ssh find, and version commands (56d2328)
• image/imageutil: add animated GIF support with ReadGIF()/ReadGIFFile(), GIFInfoFromGIF() frame timing metadata, disposal-aware GIFFrames() compositing, and WriteGIFFramesPNG(), plus a gifframes command (edb9889)
• text/markdown: add ShiftHeaders() and NormalizeHeaders() to adjust header levels, skipping fenced code blocks (8b33937)
• lintfix/dupl: add Nolint() and CommonReasons for documented nolint:dupl comments (1e9eb9b)
• net/http/httputilmore: add RFC 8705 certificate-bound access token checks with VerifyRFC8705CertificateBinding(), EnforceRFC8705MTLSClientCertBinding() middleware, and CertificateThumbprintSHA256() (a1e6586)
• image/imageutil: add DrawText() for drawing text onto images (1bc248f)
• image/imageutil/cmd/merge_grid: add command to merge images into a grid with configurable columns, width, and JPEG quality (9813ac7)
• licenses: add IsMIT() to detect MIT License text, tolerating title, copyright, whitespace, and case differences (95df23b)
• crypto/tlsutil: detect SecP256r1MLKEM768 and SecP384r1MLKEM1024 hybrid PQC key exchanges and name pure ML-KEM-1024 (56f376f)
• image/imageutil/cmd/crop: add command to crop, square, and split images from a file or URL (f4cc2ec)

Changed

• crypto/tlsutil: PQCCurvePreferences() now offers SecP256r1MLKEM768 and SecP384r1MLKEM1024, and CheckPQCSupport() uses http.NewRequestWithContext instead of ctxhttp (56f376f)

Deprecated

• crypto/tlsutil: X25519MLKEM768; use tls.X25519MLKEM768 (56f376f)

Fixed

• crypto/randutil: CryptoRandIntInRange() no longer hangs on wide narrow-type ranges such as int8 -100..100 or full uint8/uint16/uint32 ranges, no longer errors on full int8/int64/uint64 ranges, and supports named integer types (26dcc3c)

... (truncated)

Commits

• 8bb1ea2 docs(changelog): add v0.75.0 release entry
• 1282281 test(aesutil): add AES-GCM encryption tests
• 997e933 feat(aesutil)!: switch EncryptAES and DecryptAES to AES-GCM
• be94b0e docs(changelog): add retryhttp test fix to v0.74.10
• 255ea19 test(retryhttp): make concurrent IntervalLimiter test robust to wake-up latency
• b5510bb docs(changelog): add aesutil G407 fix to v0.74.10
• 4ed765c fix(aesutil): suppress gosec G407 false positive for random IV
• db8c754 docs(changelog): add v0.74.10 release entry
• 4b727ca test(jsonutil): add file marshal and unmarshal tests
• 50df3b4 fix(jsonutil): return file close errors from MarshalFile and UnmarshalFile
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 53f26d86-f10a-4246-ae30-2728112fcfed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}