diff --git a/go.mod b/go.mod
index de7d1d1..40783f1 100644
--- a/go.mod
+++ b/go.mod
@@ -174,7 +174,7 @@ require (
 	github.com/hdevalence/ed25519consensus v0.1.0 // indirect
 	github.com/illarion/gonotify v1.0.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 // indirect
+	github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82 // indirect
 	github.com/invopop/jsonschema v0.14.0 // indirect
 	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 // indirect
 	github.com/jsimonetti/rtnetlink v1.3.5 // indirect
diff --git a/go.sum b/go.sum
index b61fb2c..5d3b57d 100644
--- a/go.sum
+++ b/go.sum
@@ -544,8 +544,8 @@ github.com/illarion/gonotify v1.0.1 h1:F1d+0Fgbq/sDWjj/r66ekjDG+IDeecQKUFH4wNwso
 github.com/illarion/gonotify v1.0.1/go.mod h1:zt5pmDofZpU1f8aqlK0+95eQhoEAn/d4G4B/FjVW4jE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 h1:9K06NfxkBh25x56yVhWWlKFE8YpicaSfHwoV8SFbueA=
-github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
+github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82 h1:y5aU8Uvl7eyM5WNgdQvRxbMJb+zo7pD+S72/Yo4pvnQ=
+github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82/go.mod h1:qfvBmyDNp+/liLEYWRvqny/PEz9hGe2Dz833eXILSmo=
 github.com/invopop/jsonschema v0.14.0 h1:MHQqLhvpNUZfw+hM3AZDYK7jxO8FZoQeQM77g8iyZjg=
 github.com/invopop/jsonschema v0.14.0/go.mod h1:ygm6C2EaVNMBDPpaPlnOA2pFAxBnxGjFlMZABxm9n2I=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 0000000..aa094dc
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,31 @@
+[[IgnoredVulns]]
+id = "GO-2026-4610"
+reason = "The vulnerable Docker CLI plugin search path is Windows-only. Envbox runs on Linux and only uses Docker CLI compose parsing through dockertest."
+
+[[IgnoredVulns]]
+id = "GO-2026-4883"
+reason = "The vulnerable legacy plugin privilege validation is Docker daemon code. Envbox imports only Docker API types and the client package."
+
+[[IgnoredVulns]]
+id = "GO-2026-4887"
+reason = "The vulnerable authorization plugin request handling is Docker daemon code. Envbox imports only Docker API types and the client package."
+
+[[IgnoredVulns]]
+id = "GO-2026-5617"
+reason = "The vulnerable docker cp implementation is Docker daemon code. Envbox imports only Docker API types and the client package."
+
+[[IgnoredVulns]]
+id = "GO-2026-5668"
+reason = "The vulnerable docker cp implementation is Docker daemon code. Envbox imports only Docker API types and the client package."
+
+[[IgnoredVulns]]
+id = "GO-2026-5746"
+reason = "The vulnerable archive extraction implementation is Docker daemon code. Envbox imports only Docker API types and the client package."
+
+[[IgnoredVulns]]
+id = "GO-2026-5761"
+reason = "The vulnerable runc device setup is not used. Envbox reaches runc only through dockertest's homedir package, which imports libcontainer/user."
+
+[[IgnoredVulns]]
+id = "GO-2026-5932"
+reason = "Envbox uses maintained x/crypto packages such as bcrypt and does not import the vulnerable deprecated openpgp package."