From 1f33de4bef7abcad6c6e43b32b1b09969c7d0b16 Mon Sep 17 00:00:00 2001
From: Nazmus Sayad <87106526+NazmusSayad@users.noreply.github.com>
Date: Wed, 7 Oct 2026 20:52:16 +0600
Subject: [PATCH 1/3] Security: fix dependency vulnerabilities

---
 .github/workflows/ci.yml | 2 +-
 Dockerfile               | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94a63bd..2e280db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.25'
       - run: make build
       - uses: golangci/golangci-lint-action@v7
         with:
diff --git a/Dockerfile b/Dockerfile
index 1eebfef..eabf14f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,11 @@
-FROM golang:1.23-alpine AS builder
+FROM golang:1.25-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /uigraph-cli .
 
-FROM alpine:3.20
+FROM alpine:3.24
 RUN apk add --no-cache ca-certificates git
 COPY --from=builder /uigraph-cli /usr/local/bin/uigraph-cli
 ENTRYPOINT ["/usr/local/bin/uigraph-cli"]

From 5b85b1a8a4337c196c96e2d0d77ee2ad470371d7 Mon Sep 17 00:00:00 2001
From: Nazmus Sayad <87106526+NazmusSayad@users.noreply.github.com>
Date: Wed, 7 Oct 2026 21:31:04 +0600
Subject: [PATCH 2/3] ci: add security scan workflow on push to main

---
 .github/workflows/security.yml | 44 ++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..b6778c6
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,44 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install osv-scanner
+        run: |
+          curl -sSfL -o "$RUNNER_TEMP/osv-scanner" https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64
+          chmod +x "$RUNNER_TEMP/osv-scanner"
+
+      - name: Scan dependencies
+        run: |
+          status=0
+          "$RUNNER_TEMP/osv-scanner" scan source -r . || status=$?
+          if [ "$status" -gt 1 ]; then
+            exit "$status"
+          fi
+          status=0
+          "$RUNNER_TEMP/osv-scanner" scan source -r --format json --output-file "$RUNNER_TEMP/osv.json" . || status=$?
+          if [ "$status" -gt 1 ]; then
+            exit "$status"
+          fi
+          count=$(jq '[.results[]?.packages[].groups[] | select((.max_severity // "" | tonumber? // 0) >= 7)] | length' "$RUNNER_TEMP/osv.json")
+          if [ "$count" -gt 0 ]; then
+            echo "::error::$count High/Critical vulnerabilities found"
+            exit 1
+          fi
+
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: '1.25'

From b8a6c90e9b3bc08176fad604514dfa24980425ea Mon Sep 17 00:00:00 2001
From: Nazmus Sayad <87106526+NazmusSayad@users.noreply.github.com>
Date: Wed, 7 Oct 2026 22:09:54 +0600
Subject: [PATCH 3/3] docs: add security policy

---
 SECURITY.md | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..0a9f6d5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release receives security fixes.
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues.
+
+Report them privately through [GitHub Security Advisories](https://github.com/uigraph-oss/uigraph-cli/security/advisories/new). We will acknowledge your report within 3 business days and keep you updated until it is resolved.