diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index f07f223..ee586c9 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -152,7 +152,7 @@ jobs:
         run: gh pr review --approve "$PR_URL"
       -
         name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/bump-release-monorepo.yml b/.github/workflows/bump-release-monorepo.yml
index 7fcbe00..1c354bc 100644
--- a/.github/workflows/bump-release-monorepo.yml
+++ b/.github/workflows/bump-release-monorepo.yml
@@ -136,7 +136,7 @@ jobs:
       -
         name: Detect go mono-repo
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
 
   bump-release-single:
     name: Bump release (single module)
@@ -195,7 +195,7 @@ jobs:
       -
         name: Determine next tag
         id: bump-release
-        uses: go-openapi/gh-actions/ci-jobs/next-tag@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/next-tag@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         with:
           bump-patch: ${{ steps.bump-check.outputs.bump-patch }}
           bump-minor: ${{ steps.bump-check.outputs.bump-minor }}
@@ -307,7 +307,7 @@ jobs:
       -
         name: Configure bot credentials
         if: ${{ inputs.enable-tag-signing == 'true' }}
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         # This is using the GPG signature of bot-go-openapi.
         #
         # For go-openapi repos (using secrets: inherit):
diff --git a/.github/workflows/bump-release.yml b/.github/workflows/bump-release.yml
index 591853b..67d5430 100644
--- a/.github/workflows/bump-release.yml
+++ b/.github/workflows/bump-release.yml
@@ -114,7 +114,7 @@ jobs:
       -
         name: Determine next tag
         id: bump-release
-        uses: go-openapi/gh-actions/ci-jobs/next-tag@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/next-tag@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         with:
           bump-patch: ${{ steps.bump-check.outputs.bump-patch }}
           bump-minor: ${{ steps.bump-check.outputs.bump-minor }}
@@ -122,7 +122,7 @@ jobs:
       -
         name: Configure bot credentials
         if: ${{ inputs.enable-tag-signing == 'true' }}
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         # This is using the GPG signature of bot-go-openapi.
         #
         # For go-openapi repos (using secrets: inherit):
diff --git a/.github/workflows/collect-reports.yml b/.github/workflows/collect-reports.yml
index 6e25330..47d7c8d 100644
--- a/.github/workflows/collect-reports.yml
+++ b/.github/workflows/collect-reports.yml
@@ -32,7 +32,7 @@ jobs:
           path: reports/
       -
         name: Install go-junit-report
-        uses: go-openapi/gh-actions/install/go-junit-report@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/install/go-junit-report@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: Convert test reports to a merged JUnit XML
         # NOTE: codecov test reports only support JUnit format at this moment. See https://docs.codecov.com/docs/test-analytics.
@@ -57,7 +57,7 @@ jobs:
           verbose: true
       -
         name: Install go-ctrf-json-reporter
-        uses: go-openapi/gh-actions/install/go-ctrf-json-reporter@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/install/go-ctrf-json-reporter@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: Convert test reports to CTRF JSON
         # description: |
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index b2d4609..90cf209 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -118,7 +118,7 @@ jobs:
             } > "${file}"
           done
       - name: Configure bot credentials
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         id: bot-credentials
         # For go-openapi repos (using secrets: inherit):
         #   Falls back to: CI_BOT_APP_ID, CI_BOT_APP_PRIVATE_KEY, CI_BOT_GPG_PRIVATE_KEY, etc.
@@ -183,7 +183,7 @@ jobs:
       - name: Auto-approve PR
         run: gh pr review --approve "$PR_URL"
       - name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/fuzz-test.yml b/.github/workflows/fuzz-test.yml
index 0823a5a..2fbced9 100644
--- a/.github/workflows/fuzz-test.yml
+++ b/.github/workflows/fuzz-test.yml
@@ -136,7 +136,7 @@ jobs:
         name: Run go fuzz test ${{ matrix.test }}
         run: >
           go test
-          -fuzz=Fuzz
+          -fuzz='${{ matrix.test }}$'
           -run='${{ matrix.test }}$'
           -fuzztime='${{ env.FUZZ_TIME }}'
           -fuzzminimizetime='${{ env.FUZZ_MINIMIZE_TIME }}'
diff --git a/.github/workflows/go-test-monorepo.yml b/.github/workflows/go-test-monorepo.yml
index 3d3539f..7c749ab 100644
--- a/.github/workflows/go-test-monorepo.yml
+++ b/.github/workflows/go-test-monorepo.yml
@@ -55,7 +55,7 @@ jobs:
       -
         name: Detect go mono-repo
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: golangci-lint [monorepo]
         # golangci-action v9.1+ has an experimental built-in mono repo detection setup.
@@ -132,10 +132,10 @@ jobs:
       -
         name: Detect go version capabilities
         id: detect-go-version
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-version@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-version@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: Install gotestsum
-        uses: go-openapi/gh-actions/install/gotestsum@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/install/gotestsum@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: Ensure TMP is created on windows runners
         # On windows, some tests require testing.TempDir to reside on the same drive as the code.
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index ccf1507..e1d2956 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -80,7 +80,7 @@ jobs:
           cache: true
       -
         name: Install gotestsum
-        uses: go-openapi/gh-actions/install/gotestsum@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/install/gotestsum@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: Ensure TMP is created on windows runners
         # On windows, some tests require testing.TempDir to reside on the same drive as the code.
diff --git a/.github/workflows/prepare-release-monorepo.yml b/.github/workflows/prepare-release-monorepo.yml
index 757b1c4..18e6339 100644
--- a/.github/workflows/prepare-release-monorepo.yml
+++ b/.github/workflows/prepare-release-monorepo.yml
@@ -108,7 +108,7 @@ jobs:
           cache-dependency-path: "**/go.sum"
       - name: Detect go mono-repo
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       - name: Update go.mod files for new release
         env:
           TARGET_TAG: ${{ inputs.target-tag }}
@@ -185,7 +185,7 @@ jobs:
           echo "::notice title=changes::Git status after updates"
           git status --short
       - name: Configure bot credentials
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         id: bot-credentials
         # For go-openapi repos (using secrets: inherit):
         #   Falls back to: CI_BOT_APP_ID, CI_BOT_APP_PRIVATE_KEY, CI_BOT_GPG_PRIVATE_KEY, etc.
@@ -268,7 +268,7 @@ jobs:
         run: gh pr review --approve "$PR_URL"
       - name: Wait for all workflow runs to complete
         if: ${{ needs.prepare-modules.outputs.pull-request-url != '' }}
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a541e6a..501c387 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,7 +89,7 @@ jobs:
         name: Detect go mono-repo
         if: ${{ inputs.is-monorepo == 'true' }}
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@21fde93224f7f4c39a622fbe7eb50e4a620eb899 # v1.14.12
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@70c5bbea429a7d10a082ac9efb83036da0c5b7d0 # v1.4.14
       -
         name: Install git-cliff
         uses: taiki-e/install-action@e1c4cd42111751368541a7cb5db3522bd1f846a4 # v2.78.0