diff --git a/.github/workflows/release-compiler.yaml b/.github/workflows/release-compiler.yaml
index c9832ea864..b7f9b61342 100644
--- a/.github/workflows/release-compiler.yaml
+++ b/.github/workflows/release-compiler.yaml
@@ -55,7 +55,7 @@ jobs:
           python -m build --sdist --wheel
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  # v1.14.0
         if: ${{ contains(github.ref_name, '-') }}
         with:
           repository-url: https://test.pypi.org/legacy/
@@ -65,7 +65,7 @@ jobs:
           packages-dir: compiler/dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.14.0
         if: ${{ !contains(github.ref_name, '-') }}
         with:
           skip-existing: true
diff --git a/.github/workflows/release-python.yaml b/.github/workflows/release-python.yaml
index eb97c05641..0b810b6c72 100644
--- a/.github/workflows/release-python.yaml
+++ b/.github/workflows/release-python.yaml
@@ -52,7 +52,7 @@ jobs:
           echo "head_branch: ${{ github.event.workflow_run.head_branch }}"
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  # v1.14.0
         if: startsWith(github.event.workflow_run.head_branch, 'v') && contains(github.event.workflow_run.head_branch, '-')
         with:
           repository-url: https://test.pypi.org/legacy/
@@ -62,7 +62,7 @@ jobs:
           packages-dir: dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.14.0
         if: startsWith(github.event.workflow_run.head_branch, 'v') && !contains(github.event.workflow_run.head_branch, '-')
         with:
           skip-existing: true
diff --git a/javascript/packages/hps/package.json b/javascript/packages/hps/package.json
index 6e8f9dd066..dceea64716 100644
--- a/javascript/packages/hps/package.json
+++ b/javascript/packages/hps/package.json
@@ -16,6 +16,7 @@
     "prepublishOnly": "npm run build"
   },
   "license": "Apache-2.0",
+  "repository": "git@github.com:apache/fory.git",
   "dependencies": {
     "bindings": "~1.2.1",
     "fs-extra": "^11.3.0",