diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index cda6ecb..772c7a7 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -44,7 +44,7 @@ jobs:
           ref: ${{ matrix.commit }}
           persist-credentials: false
       - name: Cache base ref build
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache
         with:
           key: bin-cache-${{ hashFiles('cpp-linter/src/**', 'Cargo.toml', 'Cargo.lock', 'cpp-linter/Cargo.toml') }}
@@ -63,7 +63,7 @@ jobs:
       - run: cargo build --bin cpp-linter --release
         if: steps.cache.outputs.cache-hit != 'true' || steps.validate.outputs.cache-valid == 'false'
       - name: Upload build artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: ${{ matrix.name }}
           path: ${{ env.BIN }}
@@ -90,7 +90,7 @@ jobs:
   #           yum update -y
   #           yum install -y openssl openssl-devel
   #     - name: Upload wheels
-  #       uses: actions/upload-artifact@v5
+  #       uses: actions/upload-artifact@v6
   #       with:
   #         name: wheel
   #         path: dist/cpp_linter-*-cp3*-abi3-*.whl
@@ -113,10 +113,10 @@ jobs:
           persist-credentials: false
 
       - name: Download built binaries
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
         env:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Install hyperfine
@@ -124,9 +124,9 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: cargo binstall -y hyperfine
       - name: Install nushell
-        uses: hustcer/setup-nu@3a97c8160c2bb5af321a03336e7addc28f94444e # v3.21
+        uses: hustcer/setup-nu@920172d92eb04671776f3ba69d605d3b09351c30 # v3.22
       - name: Install uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
 
       - name: Run benchmark script
         working-directory: benchmark
diff --git a/.github/workflows/binary-builds.yml b/.github/workflows/binary-builds.yml
index a40ef28..fbfc767 100644
--- a/.github/workflows/binary-builds.yml
+++ b/.github/workflows/binary-builds.yml
@@ -114,7 +114,7 @@ jobs:
 
       - name: Install cargo-binstall
         if: matrix.cross
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
         env:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Install cross (cargo cross compiler)
@@ -153,7 +153,7 @@ jobs:
           tar -a -c -v -f "${arc_name}" ${tgt} LICENSE
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: cpp-linter-${{ matrix.target }}
           path: cpp-linter-${{ matrix.target }}*
@@ -176,7 +176,7 @@ jobs:
         with:
           python-version: 3.x
       - name: Download built assets
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           pattern: cpp-linter-*
           path: dist
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index d8c2e1b..e4177bf 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
       - run: rustup update --no-self-update
       - name: Cache .cargo locked resources
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
@@ -52,14 +52,14 @@ jobs:
         with:
           persist-credentials: false
       - name: Cache .cargo locked resources
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
       - name: Install uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
         env:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Install nur
@@ -83,14 +83,14 @@ jobs:
           persist-credentials: false
       - run: rustup update --no-self-update
       - name: Cache .cargo locked resources
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
       - name: Install uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
         env:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Install nur
@@ -99,7 +99,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
       - run: nur docs rs
       - name: upload rustdoc build as artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           path: target/doc
           name: cpp-linter-api_docs
diff --git a/.github/workflows/bump-n-release.yml b/.github/workflows/bump-n-release.yml
index 32eb582..7a9f2d7 100644
--- a/.github/workflows/bump-n-release.yml
+++ b/.github/workflows/bump-n-release.yml
@@ -45,7 +45,7 @@ jobs:
         with:
           node-version: 24.x
       - run: yarn install
-      - uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+      - uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
       - run: cargo binstall -y git-cliff
         env:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/node-js-packaging.yml b/.github/workflows/node-js-packaging.yml
index bab0cff..2a92246 100644
--- a/.github/workflows/node-js-packaging.yml
+++ b/.github/workflows/node-js-packaging.yml
@@ -89,7 +89,7 @@ jobs:
           rustup update stable --no-self-update
           rustup target add ${{ matrix.settings.target }}
       - name: Cache cargo
-        uses: actions/cache@v4 # zizmor: ignore[cache-poisoning]
+        uses: actions/cache@v5 # zizmor: ignore[cache-poisoning]
         with:
           path: |
             ~/.cargo/registry/index/
@@ -99,14 +99,14 @@ jobs:
             .cargo-cache
             target/
           key: ${{ matrix.settings.target }}-cargo-${{ matrix.settings.host }}
-      - uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f # v2.0.5
+      - uses: mlugg/setup-zig@fa65c4058643678a4e4a9a60513944a7d8d35440 # v2.1.0
         if: ${{ contains(matrix.settings.build, ' -x ') }}
         with:
           version: 0.14.1
           use-cache: true # zizmor: ignore[cache-poisoning]
       - name: Install cargo-binstall
         if: contains(matrix.settings.build, ' -x ') || contains(matrix.settings.build, '--use-cross ')
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
         env:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Install ${{contains(matrix.settings.build, ' -x ') && 'cargo-zigbuild' || 'cargo-cross'}}
@@ -125,7 +125,7 @@ jobs:
         run: ${{ matrix.settings.build }}
         shell: bash
       - name: Upload artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: bindings-${{ matrix.settings.target }}
           path: |
@@ -141,7 +141,7 @@ jobs:
           persist-credentials: false
       - name: Build
         id: build
-        uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda # v0.30.0
+        uses: cross-platform-actions/action@3fbf2723ff48aac8defe0070706f36088999fd47 # v0.31.0
         env:
           DEBUG: napi:*
           RUSTUP_IO_THREADS: 1
@@ -175,7 +175,7 @@ jobs:
             rm -rf target
             rm -rf .yarn/cache
       - name: Upload artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: bindings-freebsd
           path: bindings/node/${{ env.APP_NAME }}.*.node
@@ -217,7 +217,7 @@ jobs:
       - name: Install dependencies
         run: yarn install
       - name: Download artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: bindings-${{ matrix.settings.target }}
           path: bindings/node
@@ -277,7 +277,7 @@ jobs:
           yarn config set --json supportedArchitectures.libc '["current", "musl", "gnu"]'
           yarn install
       - name: Download artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: bindings-${{ matrix.target }}
           path: bindings/node
@@ -329,7 +329,7 @@ jobs:
         working-directory: bindings/node
         run: yarn napi create-npm-dirs
       - name: Download all artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           path: bindings/node/artifacts
       - name: Move artifacts
diff --git a/.github/workflows/pre-commit-hooks.yml b/.github/workflows/pre-commit-hooks.yml
index 39e844c..c1c04f2 100644
--- a/.github/workflows/pre-commit-hooks.yml
+++ b/.github/workflows/pre-commit-hooks.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
       - run: rustup update
       - name: Cache .cargo locked resources
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
diff --git a/.github/workflows/python-packaging.yml b/.github/workflows/python-packaging.yml
index c922399..3940ae4 100644
--- a/.github/workflows/python-packaging.yml
+++ b/.github/workflows/python-packaging.yml
@@ -99,7 +99,7 @@ jobs:
                 ;;
             esac
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: dist/*
@@ -128,7 +128,7 @@ jobs:
           args: --release --out dist --find-interpreter
           sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} # zizmor: ignore[cache-poisoning]
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: dist/*
@@ -157,7 +157,7 @@ jobs:
           args: --release --out dist --find-interpreter --features openssl-vendored
           sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} # zizmor: ignore[cache-poisoning]
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: dist/*
@@ -177,7 +177,7 @@ jobs:
           command: sdist
           args: --out dist
       - name: Upload sdist
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: wheels-sdist
           path: dist/*
@@ -189,7 +189,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v7
         with:
           pattern: wheels-*
           path: dist
diff --git a/.github/workflows/run-dev-tests.yml b/.github/workflows/run-dev-tests.yml
index d897017..9e3a874 100644
--- a/.github/workflows/run-dev-tests.yml
+++ b/.github/workflows/run-dev-tests.yml
@@ -55,7 +55,7 @@ jobs:
       #   if: runner.os == 'Windows'
       #   run: vcpkg install openssl
 
-      - uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+      - uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
         env:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Install third-party binaries
@@ -69,7 +69,7 @@ jobs:
           python-version: 3.x
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -83,7 +83,7 @@ jobs:
         run: choco install ninja
 
       - name: Cache .cargo locked resources
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-tests-cargo-${{ hashFiles('Cargo.lock') }}
@@ -227,7 +227,7 @@ jobs:
         run: nur test llvm-cov
 
       - name: Upload coverage data
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: HTML_report-${{ runner.os }}
           path: target/llvm-cov/html
@@ -235,7 +235,7 @@ jobs:
       - name: Generate Coverage lcov report
         run: nur test lcov
 
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           token: ${{secrets.CODECOV_TOKEN}}
           files: lcov.info