diff --git a/.github/actions/build-for-integrations/action.yaml b/.github/actions/build-for-integrations/action.yaml
index 219b971810b0..fb12606a9671 100644
--- a/.github/actions/build-for-integrations/action.yaml
+++ b/.github/actions/build-for-integrations/action.yaml
@@ -68,7 +68,7 @@ runs:
 
     - name: Cache Build
       id: step-cache-build
-      uses: actions/cache@v5.0.3
+      uses: actions/cache@v5.0.4
       with:
         key: ${{ steps.cache-key.outputs.value }}
         path: ${{ steps.cache-path.outputs.value }}
diff --git a/.github/actions/build/action.yaml b/.github/actions/build/action.yaml
index c6bb6a87fc86..9bdd11bb3e40 100644
--- a/.github/actions/build/action.yaml
+++ b/.github/actions/build/action.yaml
@@ -78,7 +78,7 @@ runs:
 
     - name: Cache Build
       id: step-cache-build
-      uses: actions/cache@v5.0.3
+      uses: actions/cache@v5.0.4
       with:
         key: ${{ steps.cache-key.outputs.value }}
         path: ${{ steps.cache-path.outputs.value }}
diff --git a/.github/actions/pr/action.yaml b/.github/actions/pr/action.yaml
index dcf8119ddc67..68260064383f 100644
--- a/.github/actions/pr/action.yaml
+++ b/.github/actions/pr/action.yaml
@@ -50,7 +50,7 @@ runs:
 
     - id: generate-token
       if: env.git_status == 'dirty'
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
+      uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 #v3.0.0
       with:
         app-id: ${{ inputs.app_id }}
         private-key: ${{ inputs.app_private_key }}
diff --git a/.github/actions/setup-node/action.yaml b/.github/actions/setup-node/action.yaml
index c2ee9886c389..03a2ac5eab1f 100644
--- a/.github/actions/setup-node/action.yaml
+++ b/.github/actions/setup-node/action.yaml
@@ -9,7 +9,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@v5
 
     - name: Use Node.js ${{ inputs.node-version }}
       uses: actions/setup-node@v6.3.0
diff --git a/.github/actions/smoke-test/action.yaml b/.github/actions/smoke-test/action.yaml
index 59257cf2ba72..22e804a8d635 100644
--- a/.github/actions/smoke-test/action.yaml
+++ b/.github/actions/smoke-test/action.yaml
@@ -22,7 +22,7 @@ runs:
       shell: bash
 
     - name: Restore CSpell cache
-      uses: actions/cache@v5.0.3
+      uses: actions/cache@v5.0.4
       if: ${{ inputs.use_cspell_cache == 'true' }}
       with:
         key: cspell-cache-${{ runner.os }}-smoke-test-${{ hashFiles('**/*.ts', '**/*.md') }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9f9d4ae4d0e5..fec4ce02c737 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         id: codecov
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         continue-on-error: true
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/cspell-cli.yml b/.github/workflows/cspell-cli.yml
index 3f6647c634d5..c8eaf948ca7b 100644
--- a/.github/workflows/cspell-cli.yml
+++ b/.github/workflows/cspell-cli.yml
@@ -25,7 +25,7 @@ jobs:
       - run: pnpm build:prod
 
       - name: Restore CSpell cache
-        uses: actions/cache@v5.0.3
+        uses: actions/cache@v5.0.4
         with:
           key: cspell-cache-v2-${{ runner.os }}-${{ hashFiles('**/*.ts', '**/*.md') }}
           path: |
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 1759f5b40cdd..39086c53c374 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -165,7 +165,7 @@ jobs:
 
       - name: Cache Integration Run
         id: step-cache-run
-        uses: actions/cache@v5.0.3
+        uses: actions/cache@v5.0.4
         with:
           key: integration-run--${{ env.REF_BRANCH }}-${{ steps.repo-hash.outputs.value }}-${{ fromJSON(steps.step-repo-info.outputs.repo-info).commit }}-1
           # Store the patch files to update the integration perf data
@@ -190,7 +190,7 @@ jobs:
 
       - name: Cache Integration Test Repository Files
         if: ${{ steps.step-cache-run.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v5.0.3
+        uses: actions/cache@v5.0.4
         with:
           key: int-repo-temp-files-${{ matrix.repo }}-${{ fromJSON(steps.step-repo-info.outputs.repo-info).commit }}
           path: |
diff --git a/.github/workflows/release-drafter-labeler.yml b/.github/workflows/release-drafter-labeler.yml
index 2205b8513dfd..2e7fa653e1a7 100644
--- a/.github/workflows/release-drafter-labeler.yml
+++ b/.github/workflows/release-drafter-labeler.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
       - id: release-drafter-labeler
-        uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v5
+        uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v5
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 0f1c206204f1..1a86fb65cc15 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "main"
       - id: release-drafter
-        uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v5
+        uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v5
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml
diff --git a/.github/workflows/update-dictionaries.yml b/.github/workflows/update-dictionaries.yml
index 6a3479e13fe3..f048ed7234dc 100644
--- a/.github/workflows/update-dictionaries.yml
+++ b/.github/workflows/update-dictionaries.yml
@@ -171,7 +171,7 @@ jobs:
 
       - name: Cache Build
         id: step-cache-build
-        uses: actions/cache@v5.0.3
+        uses: actions/cache@v5.0.4
         with:
           key: ${{ needs.build.outputs.key }}
           path: ${{ needs.build.outputs.path }}
@@ -199,7 +199,7 @@ jobs:
           echo "repo-info=$(jq -c '.repositories[] | select(.path == "${{ matrix.repo }}")' integration-tests/config/config.json)" >> $GITHUB_OUTPUT
 
       - name: Cache Integration Test Repository Files
-        uses: actions/cache@v5.0.3
+        uses: actions/cache@v5.0.4
         with:
           key: int-repo-temp-files-${{ matrix.repo }}-${{ fromJSON(steps.step-repo-info.outputs.repo-info).commit }}
           path: |
@@ -339,7 +339,7 @@ jobs:
           title: Update Dictionaries (${{ env.REF_BRANCH }})
 
       - id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 #v3.0.0
         with:
           app-id: ${{ secrets.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/update-integration-repositories.yml b/.github/workflows/update-integration-repositories.yml
index b07fcc08ad1e..e20d7c1f09a9 100644
--- a/.github/workflows/update-integration-repositories.yml
+++ b/.github/workflows/update-integration-repositories.yml
@@ -85,7 +85,7 @@ jobs:
 
       - name: Cache Build
         id: step-cache-build
-        uses: actions/cache@v5.0.3
+        uses: actions/cache@v5.0.4
         with:
           key: ${{ needs.build.outputs.key }}
           path: ${{ needs.build.outputs.path }}