diff --git a/.github/workflows/_build-cached.yml b/.github/workflows/_build-cached.yml
index 3b17bb2292..a25a5a5856 100644
--- a/.github/workflows/_build-cached.yml
+++ b/.github/workflows/_build-cached.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Lookup cache (no restore)
         id: cache_deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: ${{ steps.set_outputs.outputs.cache-path }}
           key:  ${{ steps.set_outputs.outputs.cache-key }}
diff --git a/.github/workflows/_build-core.yml b/.github/workflows/_build-core.yml
index 1c018d975b..a413f6e97e 100644
--- a/.github/workflows/_build-core.yml
+++ b/.github/workflows/_build-core.yml
@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: load cached deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: ${{ inputs.cache-path || format('{0}/deps/build', github.workspace) }}
           key: ${{ inputs.cache-key }}
@@ -106,7 +106,7 @@ jobs:
 
       - name: Cache Homebrew downloads (macOS)
         if: runner.os == 'macOS'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: ~/Library/Caches/Homebrew/downloads
           key: brew-core-${{ inputs.os }}-${{ hashFiles('.github/workflows/_build-core.yml') }}
diff --git a/.github/workflows/_build-deps.yml b/.github/workflows/_build-deps.yml
index ef00fb4bad..a47f948405 100644
--- a/.github/workflows/_build-deps.yml
+++ b/.github/workflows/_build-deps.yml
@@ -43,7 +43,7 @@ jobs:
           lfs: 'true'
 
       - name: load cached deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: ${{ inputs.cache-path }}
           key: ${{ inputs.cache-key }}
@@ -148,7 +148,7 @@ jobs:
 
       - name: Cache Homebrew downloads (macOS)
         if: startsWith(inputs.os, 'macos-')
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: ~/Library/Caches/Homebrew/downloads
           key: brew-deps-${{ inputs.os }}-${{ hashFiles('.github/workflows/_build-deps.yml') }}
diff --git a/.github/workflows/automation-ai-fix.yml b/.github/workflows/automation-ai-fix.yml
index 5e01e13b82..69e7560866 100644
--- a/.github/workflows/automation-ai-fix.yml
+++ b/.github/workflows/automation-ai-fix.yml
@@ -193,7 +193,7 @@ jobs:
 
       - name: Cache build deps
         if: steps.changes.outputs.changed == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: deps/build/destdir
           key: autofix-deps-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }}
diff --git a/.github/workflows/cd-nightly.yml b/.github/workflows/cd-nightly.yml
index 7f37befab2..759ef697aa 100644
--- a/.github/workflows/cd-nightly.yml
+++ b/.github/workflows/cd-nightly.yml
@@ -363,7 +363,7 @@ jobs:
 
       - name: Attest build provenance
         if: steps.check.outputs.n > 0
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: artifacts/**
 
diff --git a/.github/workflows/cd-packages.yml b/.github/workflows/cd-packages.yml
index c00844ffa3..b3bee68ce1 100644
--- a/.github/workflows/cd-packages.yml
+++ b/.github/workflows/cd-packages.yml
@@ -77,7 +77,7 @@ jobs:
 
       - name: Cache deps
         id: cache-deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: deps/build/destdir
           key: pkg-deps-debian-trixie-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }}
@@ -206,7 +206,7 @@ jobs:
 
       - name: Cache deps
         id: cache-deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: deps/build/destdir
           key: pkg-deps-fedora42_rpm-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }}
@@ -276,7 +276,7 @@ jobs:
 
       - name: Cache deps
         id: cache-deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: deps/build/destdir
           key: pkg-deps-arch-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }}
diff --git a/.github/workflows/cd-release-candidate.yml b/.github/workflows/cd-release-candidate.yml
index ee7d00b95f..116464b777 100644
--- a/.github/workflows/cd-release-candidate.yml
+++ b/.github/workflows/cd-release-candidate.yml
@@ -302,7 +302,7 @@ jobs:
 
       - name: Attest build provenance
         if: steps.check.outputs.n > 0
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: artifacts/**
 
diff --git a/.github/workflows/cd-release.yml b/.github/workflows/cd-release.yml
index aa84e30647..9b64cfae81 100644
--- a/.github/workflows/cd-release.yml
+++ b/.github/workflows/cd-release.yml
@@ -290,7 +290,7 @@ jobs:
         run: bash scripts/generate-checksums.sh release-assets/
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: release-assets/**
 
diff --git a/.github/workflows/ci-arch-container.yml b/.github/workflows/ci-arch-container.yml
index db052f4d30..891d03af73 100644
--- a/.github/workflows/ci-arch-container.yml
+++ b/.github/workflows/ci-arch-container.yml
@@ -37,10 +37,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -50,7 +50,7 @@ jobs:
         run: echo "IMAGE_OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
 
       - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: docker
           file: docker/Dockerfile.archlinux
diff --git a/.github/workflows/ci-debian-container.yml b/.github/workflows/ci-debian-container.yml
index 9e59bc2257..5ce29eafb8 100644
--- a/.github/workflows/ci-debian-container.yml
+++ b/.github/workflows/ci-debian-container.yml
@@ -37,10 +37,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -50,7 +50,7 @@ jobs:
         run: echo "IMAGE_OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
 
       - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: docker
           file: docker/Dockerfile.debian-trixie
diff --git a/.github/workflows/ci-fedora-container.yml b/.github/workflows/ci-fedora-container.yml
index 1cf0d4b79b..d7be0b8847 100644
--- a/.github/workflows/ci-fedora-container.yml
+++ b/.github/workflows/ci-fedora-container.yml
@@ -37,10 +37,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -50,7 +50,7 @@ jobs:
         run: echo "IMAGE_OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
 
       - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: docker
           file: docker/Dockerfile.fedora
diff --git a/.github/workflows/ci-pull-request.yml b/.github/workflows/ci-pull-request.yml
index 9bab8c3510..89dbbb8e0a 100644
--- a/.github/workflows/ci-pull-request.yml
+++ b/.github/workflows/ci-pull-request.yml
@@ -120,7 +120,7 @@ jobs:
 
       - name: Cache deps
         id: cache-deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: deps/build/destdir
           key: pkg-deps-debian-trixie_deb-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }}
@@ -182,7 +182,7 @@ jobs:
 
       - name: Cache deps
         id: cache-deps
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
         with:
           path: deps/build/destdir
           key: pkg-deps-fedora42_rpm-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }}
diff --git a/.github/workflows/security-codeql.yml b/.github/workflows/security-codeql.yml
index 460556d612..ee913e909e 100644
--- a/.github/workflows/security-codeql.yml
+++ b/.github/workflows/security-codeql.yml
@@ -47,7 +47,7 @@ jobs:
           submodules: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
         with:
           languages: ${{ matrix.language }}
           build-mode: manual
@@ -80,6 +80,6 @@ jobs:
             --parallel 4 2>&1 | head -5000 || true
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml
index 7ae1f7aa11..4bbc124f54 100644
--- a/.github/workflows/security-scorecard.yml
+++ b/.github/workflows/security-scorecard.yml
@@ -42,6 +42,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
         with:
           sarif_file: results.sarif