From da4cc004ef63179da675f20b20bb5f0978587301 Mon Sep 17 00:00:00 2001
From: github-merge-queue
 <118344674+github-merge-queue@users.noreply.github.com>
Date: Tue, 3 Nov 2026 05:35:44 +0000
Subject: [PATCH 1/2] Bump dependencies with known vulnerabilities

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index dac857aa087..3dbb51354cb 100644
--- a/go.mod
+++ b/go.mod
@@ -35,7 +35,7 @@ require (
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a // BSD-3-Clause
 	github.com/zalando/go-keyring v0.2.8 // MIT
 	go.yaml.in/yaml/v3 v3.0.5 // MIT AND Apache-2.0
-	golang.org/x/crypto v0.58.0 // BSD-3-Clause
+	golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2 // BSD-3-Clause
 	golang.org/x/mod v0.42.0 // BSD-3-Clause
 	golang.org/x/net v0.62.0 // BSD-3-Clause
 	golang.org/x/oauth2 v0.37.0 // BSD-3-Clause
diff --git a/go.sum b/go.sum
index 6e912bf0938..5100836d7b0 100644
--- a/go.sum
+++ b/go.sum
@@ -200,8 +200,8 @@ go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUS
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
-golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2 h1:zGDaB+/Mus2mScKvZ23k+W9NAUbP56sNM9SptgvWI5A=
+golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
 golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=

From 7ac13c79729c52c78a2d498365fc1eeb5ffbf8b9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 3 Nov 2026 05:35:53 +0000
Subject: [PATCH 2/2] Add changelog fragment

---
 .nextchanges/dependency-updates/7305.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .nextchanges/dependency-updates/7305.md

diff --git a/.nextchanges/dependency-updates/7305.md b/.nextchanges/dependency-updates/7305.md
new file mode 100644
index 00000000000..73168334e82
--- /dev/null
+++ b/.nextchanges/dependency-updates/7305.md
@@ -0,0 +1 @@
+* Bump dependencies with known vulnerabilities. ([#7305](https://github.com/databricks/cli/pull/7305))