diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index a4ca447f9..f3c48764a 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -28,15 +28,15 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout
-        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Setup docker buildx
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and run benchmarks in Docker
         id: docker_build
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: benchmark/Dockerfile
@@ -56,7 +56,7 @@ jobs:
 
       # Uploads the benchmark results as an artifact
       - name: Upload Benchmark Results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-results
           path: bencher.dev.sn.json
diff --git a/.github/workflows/coverage-comment.yml b/.github/workflows/coverage-comment.yml
index 19be433d4..1e7f86e0b 100644
--- a/.github/workflows/coverage-comment.yml
+++ b/.github/workflows/coverage-comment.yml
@@ -48,7 +48,7 @@ jobs:
           github.event.repository.default_branch))
     steps:
       - name: Download merged coverage artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           # Must match the upload name in coverage.yml's merge job.
           name: coverage-merged
@@ -119,7 +119,7 @@ jobs:
 
       - name: Resolve PR number
         id: pr
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           # Pass the event JSON via the environment, not via inline
           # `${{ toJson(...) }}` interpolation. Actions resolves
@@ -180,7 +180,7 @@ jobs:
       # ------------------------------------------------------------
       - name: Comment on PR
         if: steps.pr.outputs.pr != ''
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr.outputs.pr }}
         with:
@@ -246,7 +246,7 @@ jobs:
       # ------------------------------------------------------------
       - name: Update tracking issue
         if: steps.pr.outputs.pr == '' && vars.COVERAGE_TRACKING_ISSUE != ''
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ISSUE_NUMBER: ${{ vars.COVERAGE_TRACKING_ISSUE }}
         with:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 68857f340..c3de93136 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -172,10 +172,10 @@ jobs:
     needs: [ build, build-vm, windows ]
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download coverage artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: coverage-artifacts
           pattern: coverage-*
@@ -242,7 +242,7 @@ jobs:
           python3 -c "import json; m=json.load(open('coverage-merged.json')); print('files:', len(m['files'])); print('totals:', m['totals']); print('platforms:', list(m['platforms'].keys()))"
 
       - name: Upload merged coverage
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           # Artifact name is consumed by coverage-comment.yml. If
           # this name changes, update coverage-comment.yml's
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c0600fdb4..5b968030c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -151,10 +151,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     name: Bazel - ${{ matrix.os }} ${{ matrix.build-type }}
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2 # v3.0.0
     - name: Mount bazel cache  # Optional
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: "~/.cache/bazel"
         key: bazel-${{ matrix.os }}-${{ matrix.build-type }}
@@ -258,7 +258,7 @@ jobs:
     runs-on: ${{matrix.arch.host-os}}
     name: Crossbuild - ${{matrix.build-type}} ${{matrix.arch.triple}}
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install cross-compile toolchain and QEMU
       run: >
         sudo apt update &&
@@ -371,7 +371,7 @@ jobs:
     name: Format check
     # We don't need to do the build for this job, but we need to configure it to get the clang-format target
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install clang-tidy and clang-format
       run: |
         sudo apt update
@@ -400,7 +400,7 @@ jobs:
     name: Fuzzing
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Configure CMake
       run: cmake -B ${{github.workspace}}/build -DSNMALLOC_ENABLE_FUZZING=ON -DFUZZTEST_FUZZING_MODE=ON -DCMAKE_CXX_COMPILER=clang++
     - name: Build
@@ -420,17 +420,17 @@ jobs:
     runs-on: ${{matrix.os}}
     name: GWP-ASan - ${{matrix.os}} ${{matrix.profile}}
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install Ninja
       run: sudo apt-get install -y ninja-build
     - name: Set up sccache
-      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+      uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
       with:
         variant: sccache
         key: gwp-asan-${{matrix.os}}-${{matrix.profile}}
     - name: Cache compiler-rt
       id: cache-compiler-rt
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           ${{ runner.temp }}/compiler-rt
@@ -484,7 +484,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     name: vcpkg - ${{ matrix.os }} ${{ matrix.feature }}
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Bootstrap vcpkg
       shell: bash
diff --git a/.github/workflows/morello.yml b/.github/workflows/morello.yml
index c615dabdb..a416291e5 100644
--- a/.github/workflows/morello.yml
+++ b/.github/workflows/morello.yml
@@ -70,7 +70,7 @@ jobs:
         inputs.bootenv_label || 'benchmark' )) }}
     name: ${{ matrix.os }} ${{ matrix.build-type }} ${{ matrix.caps }}
     steps:
-    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install build dependencies
       run: |
         su -l root -c "pkg64 install -y ${{ matrix.dependencies }}"
diff --git a/.github/workflows/reusable-cmake-build.yml b/.github/workflows/reusable-cmake-build.yml
index ae6293bb6..dd5d793bd 100644
--- a/.github/workflows/reusable-cmake-build.yml
+++ b/.github/workflows/reusable-cmake-build.yml
@@ -77,7 +77,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Validate coverage inputs
       if: inputs.coverage
@@ -105,7 +105,7 @@ jobs:
       run: echo "hash=$(echo '${{ inputs.cmake-config }} ${{ inputs.extra-cmake-flags }}' | shasum -a 256 | cut -c1-16)" >> "$GITHUB_OUTPUT"
 
     - name: Set up sccache
-      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+      uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
       with:
         variant: sccache
         key: ${{ inputs.os }}-${{ inputs.build-type }}-${{ steps.config-hash.outputs.hash }}
@@ -242,7 +242,7 @@ jobs:
 
     - name: Upload coverage artifact
       if: ${{ !inputs.build-only && inputs.coverage }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-${{ inputs.coverage-artifact-name }}
         path: |
diff --git a/.github/workflows/reusable-vm-build.yml b/.github/workflows/reusable-vm-build.yml
index 501e5ce87..d5a0f20ec 100644
--- a/.github/workflows/reusable-vm-build.yml
+++ b/.github/workflows/reusable-vm-build.yml
@@ -50,7 +50,7 @@ jobs:
     runs-on: ${{ inputs.host-os }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Validate coverage inputs
       if: inputs.coverage
@@ -105,7 +105,7 @@ jobs:
 
     - name: Build on OpenBSD
       if: inputs.vm-type == 'openbsd'
-      uses: vmactions/openbsd-vm@2cbd7618ff813d8235acc5ade8cb5260dcee4502 # v0.1.2
+      uses: vmactions/openbsd-vm@e6c68b637a12e83519688d115d57d5b0b53923cd # v1.4.6
       with:
         release: ${{ inputs.vm-version }}
         usesh: true
@@ -126,7 +126,7 @@ jobs:
 
     - name: Upload coverage artifact
       if: inputs.coverage
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-${{ inputs.coverage-artifact-name }}
         path: ${{ github.workspace }}/build/coverage.json
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index e5a5319c7..34e5bdcaa 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -58,7 +58,7 @@ jobs:
       with:
         toolchain: ${{ matrix.rust }}
     - name: Checkout
-      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: update dependency
       run: |
         if bash -c 'uname -s | grep 'Linux' >/dev/null'; then
@@ -81,7 +81,7 @@ jobs:
       with:
         toolchain: stable
     - name: Checkout
-      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: update dependency
       run: sudo apt-get update -y && sudo apt-get --reinstall install -y libc6-dev
     - name: Dry-run workspace publish