diff --git a/.github/actions/pr/action.yaml b/.github/actions/pr/action.yaml
index 68260064383..ba2e9e8e6e9 100644
--- a/.github/actions/pr/action.yaml
+++ b/.github/actions/pr/action.yaml
@@ -50,14 +50,14 @@ runs:
 
     - id: generate-token
       if: env.git_status == 'dirty'
-      uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 #v3.0.0
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
         app-id: ${{ inputs.app_id }}
         private-key: ${{ inputs.app_private_key }}
 
     - name: Create Pull Request
       if: env.git_status == 'dirty'
-      uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       with:
         commit-message: ${{ inputs.commit-message }}
         branch: ${{ inputs.branch }}
diff --git a/.github/actions/setup-node/action.yaml b/.github/actions/setup-node/action.yaml
index 03a2ac5eab1..87d156fd660 100644
--- a/.github/actions/setup-node/action.yaml
+++ b/.github/actions/setup-node/action.yaml
@@ -9,7 +9,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v5
+      uses: pnpm/action-setup@v6
 
     - name: Use Node.js ${{ inputs.node-version }}
       uses: actions/setup-node@v6.3.0
diff --git a/.github/workflows/cspell-cli.yml b/.github/workflows/cspell-cli.yml
index c8eaf948ca7..3f804bfcd65 100644
--- a/.github/workflows/cspell-cli.yml
+++ b/.github/workflows/cspell-cli.yml
@@ -25,7 +25,7 @@ jobs:
       - run: pnpm build:prod
 
       - name: Restore CSpell cache
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         with:
           key: cspell-cache-v2-${{ runner.os }}-${{ hashFiles('**/*.ts', '**/*.md') }}
           path: |
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index ae78b75cc94..eaf5176f8c7 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -38,7 +38,7 @@ jobs:
           pnpm run build:site
 
       - name: Upload Build Artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: website/build
 
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 39086c53c37..8dc7572ebab 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -165,7 +165,7 @@ jobs:
 
       - name: Cache Integration Run
         id: step-cache-run
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         with:
           key: integration-run--${{ env.REF_BRANCH }}-${{ steps.repo-hash.outputs.value }}-${{ fromJSON(steps.step-repo-info.outputs.repo-info).commit }}-1
           # Store the patch files to update the integration perf data
@@ -190,7 +190,7 @@ jobs:
 
       - name: Cache Integration Test Repository Files
         if: ${{ steps.step-cache-run.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         with:
           key: int-repo-temp-files-${{ matrix.repo }}-${{ fromJSON(steps.step-repo-info.outputs.repo-info).commit }}
           path: |
diff --git a/.github/workflows/release-drafter-labeler.yml b/.github/workflows/release-drafter-labeler.yml
index 32a460dfa34..a9298b1dfc7 100644
--- a/.github/workflows/release-drafter-labeler.yml
+++ b/.github/workflows/release-drafter-labeler.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
       - id: release-drafter-labeler
-        uses: release-drafter/release-drafter/autolabeler@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7.1.1
+        uses: release-drafter/release-drafter/autolabeler@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7.2.0
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 51720e8bb0b..de2d1162563 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "main"
       - id: release-drafter
-        uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7.1.1
+        uses: release-drafter/release-drafter@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7.2.0
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml
diff --git a/.github/workflows/update-dictionaries.yml b/.github/workflows/update-dictionaries.yml
index f048ed7234d..143fb89028e 100644
--- a/.github/workflows/update-dictionaries.yml
+++ b/.github/workflows/update-dictionaries.yml
@@ -171,7 +171,7 @@ jobs:
 
       - name: Cache Build
         id: step-cache-build
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         with:
           key: ${{ needs.build.outputs.key }}
           path: ${{ needs.build.outputs.path }}
@@ -199,7 +199,7 @@ jobs:
           echo "repo-info=$(jq -c '.repositories[] | select(.path == "${{ matrix.repo }}")' integration-tests/config/config.json)" >> $GITHUB_OUTPUT
 
       - name: Cache Integration Test Repository Files
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         with:
           key: int-repo-temp-files-${{ matrix.repo }}-${{ fromJSON(steps.step-repo-info.outputs.repo-info).commit }}
           path: |
@@ -339,7 +339,7 @@ jobs:
           title: Update Dictionaries (${{ env.REF_BRANCH }})
 
       - id: generate-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 #v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
         with:
           app-id: ${{ secrets.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/update-integration-repositories.yml b/.github/workflows/update-integration-repositories.yml
index 8c4f3f954cc..0d7f18af4a3 100644
--- a/.github/workflows/update-integration-repositories.yml
+++ b/.github/workflows/update-integration-repositories.yml
@@ -85,7 +85,7 @@ jobs:
 
       - name: Cache Build
         id: step-cache-build
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         with:
           key: ${{ needs.build.outputs.key }}
           path: ${{ needs.build.outputs.path }}