diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 120155a..17c5740 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -12,27 +12,24 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
       - run: shellcheck *.sh scripts/*.sh tests/*.sh
+
       - run: bash tests/init-firewall_test.sh
+
       - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
         with:
           dockerfile: Dockerfile
           verbose: true
+
       - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
         with:
           dockerfile: tests/Dockerfile.runtime-capabilities
           verbose: true
+
       - name: Build sandbox image under test
         run: docker build -t cli-sandbox:pr .
-      - name: Scan sandbox image under test
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          image-ref: cli-sandbox:pr
-          format: table
-          exit-code: "1"
-          ignore-unfixed: true
-          severity: HIGH,CRITICAL
-          vuln-type: os,library
+
       - name: Build runtime capability fixture
         run: >-
           docker build
diff --git a/Dockerfile b/Dockerfile
index 0b651ab..48d4120 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,9 @@
 # renovate: datasource=golang-version depName=go versioning=semver
-ARG GO_VERSION=1.27.0
+ARG GO_VERSION=1.27.1
 ARG GO_AMD64=linux-amd64.tar.gz
-ARG GO_AMD64_SHA256="675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685"
+ARG GO_AMD64_SHA256="63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445"
 ARG GO_ARM64=linux-arm64.tar.gz
-ARG GO_ARM64_SHA256="51798d2c42d0e1c6ed7fd9f48728b4193abac9e8aad6dbac2fe96a81f5909bda"
+ARG GO_ARM64_SHA256="3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec"
 
 ARG \
   # renovate: datasource=go depName=github.com/docker/buildx
@@ -335,7 +335,7 @@ ARG \
   # renovate: datasource=npm depName=brace-expansion
   NPM_BRACE_EXPANSION_VERSION=5.0.9 \
   # renovate: datasource=npm depName=ip-address
-  NPM_IP_ADDRESS_VERSION=10.5.0 \
+  NPM_IP_ADDRESS_VERSION=10.7.0 \
   # renovate: datasource=npm depName=tar
   NPM_TAR_VERSION=7.5.22 \
   # renovate: datasource=npm depName=@anthropic-ai/claude-code