diff --git a/go.mod b/go.mod
index b56defe8..a910ffa8 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.25.7
 
 require (
 	github.com/gdamore/tcell/v2 v2.13.10
-	github.com/gopacket/gopacket v1.6.1
+	github.com/gopacket/gopacket v1.7.0
 	github.com/jpillora/sizestr v1.0.0
 	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/navidys/tvxwidgets v0.14.0
diff --git a/go.sum b/go.sum
index 3f9cbb4a..3ff711de 100644
--- a/go.sum
+++ b/go.sum
@@ -106,8 +106,8 @@ github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oX
 github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gopacket/gopacket v1.6.1 h1:S19Ok/KVGDFNHVW2uCva5U0vZ+uHqiZQdxteL50v6Ak=
-github.com/gopacket/gopacket v1.6.1/go.mod h1:i3NaGaqfoWKAr1+g7qxEdWsmfT+MXuWkAe9+THv8LME=
+github.com/gopacket/gopacket v1.7.0 h1:GdmF8ytGnjtSvyy30CTZhIwX1ybDWH3Q0MNK0blIKzA=
+github.com/gopacket/gopacket v1.7.0/go.mod h1:QKowPlTLrQU2rqV5C5I14Aoaid3l8da3kbddibc/Wgk=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
diff --git a/vendor/github.com/gopacket/gopacket/layers/ip4.go b/vendor/github.com/gopacket/gopacket/layers/ip4.go
index 1538ab08..d195edba 100644
--- a/vendor/github.com/gopacket/gopacket/layers/ip4.go
+++ b/vendor/github.com/gopacket/gopacket/layers/ip4.go
@@ -139,6 +139,14 @@ func (ip *IPv4) SerializeTo(b gopacket.SerializeBuffer, opts gopacket.SerializeO
 			bytes[curLocation] = opt.OptionType
 			bytes[curLocation+1] = opt.OptionLength
 
+			// the type and length bytes occupy two octets, so a non-trivial
+			// option must declare a length of at least 2. without this guard
+			// opt.OptionLength-2 underflows below and the copy slices a
+			// reversed range, panicking with "slice bounds out of range".
+			if opt.OptionLength < 2 {
+				return fmt.Errorf("invalid IP option type %v length %d, must be greater than 2", opt.OptionType, opt.OptionLength)
+			}
+
 			// sanity checking to protect us from buffer overrun
 			if len(opt.OptionData) > int(opt.OptionLength-2) {
 				return errors.New("option length is smaller than length of option data")
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 4c2d9961..bbf19959 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -140,8 +140,8 @@ github.com/google/pprof/profile
 # github.com/google/uuid v1.6.0
 ## explicit
 github.com/google/uuid
-# github.com/gopacket/gopacket v1.6.1
-## explicit; go 1.24.0
+# github.com/gopacket/gopacket v1.7.0
+## explicit; go 1.25.0
 github.com/gopacket/gopacket
 github.com/gopacket/gopacket/endian
 github.com/gopacket/gopacket/layers