From 091da0741ddd0e4f0f3b39cd777cd6d5851d2463 Mon Sep 17 00:00:00 2001
From: "app-token-issuer-releng-renovate[bot]"
 <142360764+app-token-issuer-releng-renovate[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:12:48 +0000
Subject: [PATCH] Update minor-patch dependencies grouped by manager

---
 .github/workflows/pull-request-main.yml       |  2 +-
 .github/workflows/reusable-dependabump.yml    |  6 ++--
 .../reusable-docker-build-publish.yml         |  2 +-
 .github/workflows/run-e2e-tests.yml           | 30 +++++++++----------
 .../workflows/solidity-review-artifacts.yml   | 20 ++++++-------
 actions/build-push-docker-manifest/action.yml | 12 ++++----
 actions/build-push-docker/action.yml          |  2 +-
 actions/chip-schema-registration/action.yml   |  4 +--
 actions/ci-beholder-validator/action.yml      |  4 +--
 actions/ci-benchmarking/action.yml            |  4 +--
 actions/ci-lint-charts/action.yml             |  2 +-
 actions/ci-lint-go/action.yml                 |  4 +--
 actions/ci-lint-misc/action.yml               |  2 +-
 actions/ci-sonarqube-go/action.yml            |  2 +-
 actions/ci-sonarqube-ts/action.yml            |  2 +-
 actions/ci-test-go/action.yml                 |  2 +-
 actions/ci-test-sol/action.yml                |  2 +-
 .../action.yml                                | 14 ++++-----
 .../action.yml                                |  8 ++---
 actions/cicd-build-publish-charts/action.yml  |  6 ++--
 actions/crib-deploy-environment/action.yml    |  4 +--
 actions/ctf-build-test-image/action.yml       | 10 +++----
 actions/ctf-fetch-aws-secret/action.yml       |  2 +-
 .../action.yml                                | 10 +++----
 actions/docker-image-patch/action.yml         |  6 ++--
 actions/ecr-image-exists/action.yml           |  4 +--
 actions/helm-version-bump-receiver/action.yml |  4 +--
 actions/k8s-tailscale-connect/action.yml      |  4 +--
 actions/oci-image-bump/action.yml             |  2 +-
 .../parse-and-mask-test-secrets/action.yml    |  2 +-
 actions/pr-quality-check/action.yml           |  4 +--
 actions/pr-slack-alert/action.yml             |  2 +-
 actions/promote-image-ecr/action.yaml         | 12 ++++----
 actions/pull-private-ecr-image/action.yml     |  4 +--
 actions/setup-gap/action.yml                  |  2 +-
 actions/setup-github-token/action.yml         |  2 +-
 actions/setup-nix-cache/action.yml            |  2 +-
 actions/setup-renovate/action.yml             |  2 +-
 actions/slack-notify-git-ref/action.yml       |  2 +-
 39 files changed, 105 insertions(+), 105 deletions(-)

diff --git a/.github/workflows/pull-request-main.yml b/.github/workflows/pull-request-main.yml
index 39f2f3bfd..00a192ff2 100644
--- a/.github/workflows/pull-request-main.yml
+++ b/.github/workflows/pull-request-main.yml
@@ -87,7 +87,7 @@ jobs:
         run: pnpm nx run signed-commits:build
 
       - name: Commit back any changes
-        uses: planetscale/ghcommit-action@25309d8005ac7c3bcd61d3fe19b69e0fe47dbdde # v0.2.20
+        uses: planetscale/ghcommit-action@a6b150b81dca5dd027baa898604418eec9e11465 # v0.2.22
         with:
           commit_message: "🤖 Update build"
           repo: ${{ github.repository }}
diff --git a/.github/workflows/reusable-dependabump.yml b/.github/workflows/reusable-dependabump.yml
index 785c0658a..0f8de35f3 100644
--- a/.github/workflows/reusable-dependabump.yml
+++ b/.github/workflows/reusable-dependabump.yml
@@ -77,7 +77,7 @@ jobs:
 
       - name: Notify Failure
         if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }}
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
         with:
           method: chat.postMessage
           token: ${{ secrets.SLACK_TOKEN }}
@@ -102,7 +102,7 @@ jobs:
 
       - name: Notify PR Failure
         if: ${{ steps.pr.outcome == 'failure' }}
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
         with:
           method: chat.postMessage
           token: ${{ secrets.SLACK_TOKEN }}
@@ -116,7 +116,7 @@ jobs:
 
       - name: Notify PR Created
         if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
         with:
           method: chat.postMessage
           token: ${{ secrets.SLACK_TOKEN }}
diff --git a/.github/workflows/reusable-docker-build-publish.yml b/.github/workflows/reusable-docker-build-publish.yml
index 95ac91076..13b9b4b28 100644
--- a/.github/workflows/reusable-docker-build-publish.yml
+++ b/.github/workflows/reusable-docker-build-publish.yml
@@ -616,7 +616,7 @@ jobs:
         uses: smartcontractkit/.github/actions/free-disk-space@free-disk-space/v1
 
       - name: Enable S3 Cache for Self-Hosted Runners
-        uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc # v2.2.0
+        uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
 
       - uses: actions/checkout@v6
         id: checkout
diff --git a/.github/workflows/run-e2e-tests.yml b/.github/workflows/run-e2e-tests.yml
index 073b47477..ab411e35d 100644
--- a/.github/workflows/run-e2e-tests.yml
+++ b/.github/workflows/run-e2e-tests.yml
@@ -378,7 +378,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
       - name: Install citool
@@ -431,14 +431,14 @@ jobs:
       workflow_id: ${{ steps.gen_id.outputs.workflow_id }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.24.0"
+          go-version: "1.26.5"
           check-latest: true
           cache: false # disable caching as this job doesn't benefit from it
 
@@ -640,7 +640,7 @@ jobs:
 
       - name: Checkout the repo
         if: ${{ steps.check-image-exists.outputs.exists != 'true' }}
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
           ref: ${{ inputs.chainlink_version }}
@@ -684,7 +684,7 @@ jobs:
           }}
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
           ref: ${{ inputs.chainlink_version }}
@@ -738,7 +738,7 @@ jobs:
       QUARANTINE: ${{ inputs.quarantine }}
     steps:
       - name: Enable S3 Cache for Self-Hosted Runners
-        uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0 # v2.1.0
+        uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
         with:
           metrics: cpu,network,memory,disk
 
@@ -751,7 +751,7 @@ jobs:
         uses: smartcontractkit/.github/actions/free-disk-space@free-disk-space/v1
 
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
           ref: ${{ inputs.chainlink_version }}
@@ -1043,7 +1043,7 @@ jobs:
         }}.amazonaws.com/chainlink-tests
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
       - name: Build Test Runner Image
@@ -1107,7 +1107,7 @@ jobs:
       QUARANTINE: ${{ inputs.quarantine }}
     steps:
       - name: Enable S3 Cache for Self-Hosted Runners
-        uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0 # v2.1.0
+        uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
         with:
           metrics: cpu,network,memory,disk
 
@@ -1120,7 +1120,7 @@ jobs:
         uses: smartcontractkit/.github/actions/free-disk-space@free-disk-space/v1
 
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
 
@@ -1310,7 +1310,7 @@ jobs:
       QUARANTINE: ${{ inputs.quarantine }}
     steps:
       - name: Enable S3 Cache for Self-Hosted Runners
-        uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0 # v2.1.0
+        uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
         with:
           metrics: cpu,network,memory,disk
 
@@ -1323,7 +1323,7 @@ jobs:
         uses: smartcontractkit/.github/actions/free-disk-space@free-disk-space/v1
 
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
 
@@ -1424,7 +1424,7 @@ jobs:
       test_results: ${{ steps.set_test_results.outputs.results }}
     steps:
       - name: Download all test result artifacts
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v4.3.0
         with:
           path: test_results
           pattern: test_result_${{ needs.load-test-configurations.outputs.workflow_id
@@ -1475,7 +1475,7 @@ jobs:
           { echo "cl_ref=$cl_ref"; echo "cl_short_ref=$cl_short_ref"; echo "cl_ref_path=$cl_ref_path"; } >> "$GITHUB_OUTPUT"
 
       - name: Send Slack notification
-        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
+        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
         if: ${{ inputs.slack_notification_after_tests == 'true' ||
           inputs.slack_notification_after_tests == 'always' ||
           (inputs.slack_notification_after_tests == 'on_failure' &&
@@ -1516,7 +1516,7 @@ jobs:
           contains(join(needs.*.result, ','), 'failure') &&
           inputs.slack_notification_after_tests_notify_user_id_on_failure != ''
           }}
-        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
+        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
diff --git a/.github/workflows/solidity-review-artifacts.yml b/.github/workflows/solidity-review-artifacts.yml
index 1365c3087..862a03f37 100644
--- a/.github/workflows/solidity-review-artifacts.yml
+++ b/.github/workflows/solidity-review-artifacts.yml
@@ -141,7 +141,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout the caller repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -207,7 +207,7 @@ jobs:
     needs: [gather-basic-info]
     steps:
       - name: Checkout the caller repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ env.head_ref }}
           persist-credentials: false
@@ -226,14 +226,14 @@ jobs:
           mkdir -p code-coverage
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: ${{ inputs.foundry_version }}
 
       # required for code coverage report generation
       - name: Setup LCOV
         if: ${{ inputs.generate_code_coverage == true }}
-        uses: hrishikesh-kadam/setup-lcov@f5da1b26b0dcf5d893077a3c4f29cf78079c841d # v1.0.0
+        uses: hrishikesh-kadam/setup-lcov@6c1aa0cc9e1c02f9f58f01ac599f1064ccc83470 # v1.1.0
 
       - name: Run Forge build for product contracts
         run: |
@@ -308,14 +308,14 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout caller repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.head_ref }}
           persist-credentials: false
 
       - name: Checkout .github repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           repository: smartcontractkit/.github
           ref: 65249c7eae628aad6e70a0c0850d981cd0074bf9
@@ -329,7 +329,7 @@ jobs:
           pnpm-version: ^10.0.0
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: ${{ inputs.foundry_version }}
 
@@ -342,7 +342,7 @@ jobs:
         if: ${{ inputs.generate_slither_reports == true }}
         uses: actions/setup-python@v6.3.0
         with:
-          python-version: "3.8"
+          python-version: "3.14"
 
       - name: Install solc-select and solc
         if: ${{ inputs.generate_slither_reports == true }}
@@ -472,14 +472,14 @@ jobs:
 
       - name: Checkout caller repository
         if: ${{ inputs.link_with_jira == true }}
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ env.head_ref }}
           persist-credentials: false
 
       - name: Checkout chainlink-github-actions repository
         if: ${{ inputs.link_with_jira == true }}
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           repository: smartcontractkit/.github
           ref: 65249c7eae628aad6e70a0c0850d981cd0074bf9
diff --git a/actions/build-push-docker-manifest/action.yml b/actions/build-push-docker-manifest/action.yml
index 54be8cb40..10adb51b6 100644
--- a/actions/build-push-docker-manifest/action.yml
+++ b/actions/build-push-docker-manifest/action.yml
@@ -163,13 +163,13 @@ runs:
         echo "name=${DOCKER_REGISTRY_URL}/${DOCKER_REPOSITORY_NAME}" | tee -a "$GITHUB_OUTPUT"
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       with:
         # https://github.com/docker/buildx/tags
-        version: v0.33.0
+        version: v0.36.1
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         role-duration-seconds: 900
@@ -178,7 +178,7 @@ runs:
 
     - name: Login to ECR
       id: login-ecr
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registry-type: >-
           ${{
@@ -467,10 +467,10 @@ runs:
 
     - name: Install cosign
       if: inputs.docker-manifest-sign == 'true'
-      uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       with:
         # https://github.com/sigstore/cosign/releases
-        cosign-release: "v2.6.1"
+        cosign-release: "v2.6.5"
 
     - name: Sign Docker Manifest using GH OIDC
       if: inputs.docker-manifest-sign == 'true'
diff --git a/actions/build-push-docker/action.yml b/actions/build-push-docker/action.yml
index eee113658..90969d8c4 100644
--- a/actions/build-push-docker/action.yml
+++ b/actions/build-push-docker/action.yml
@@ -254,7 +254,7 @@ runs:
       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       with:
         # https://github.com/docker/buildx/tags
-        version: v0.35.0
+        version: v0.36.1
 
     - name: Docker meta
       id: docker-meta
diff --git a/actions/chip-schema-registration/action.yml b/actions/chip-schema-registration/action.yml
index 273b9ec2d..4dfe9190a 100644
--- a/actions/chip-schema-registration/action.yml
+++ b/actions/chip-schema-registration/action.yml
@@ -47,7 +47,7 @@ runs:
     - uses: actions/checkout@v7
 
     - name: Login to ECR
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registries: ${{ inputs.aws-account-id }}
 
@@ -61,7 +61,7 @@ runs:
         docker tag $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/atlas-chip-cli:qa-latest chip-cli
 
     - name: Connect to Tailscale
-      uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4.1.2
+      uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
       with:
         oauth-client-id: ${{ inputs.ts-ouath-client-id }}
         oauth-secret: ${{ inputs.ts-ouath-secret }}
diff --git a/actions/ci-beholder-validator/action.yml b/actions/ci-beholder-validator/action.yml
index f0a595f30..03e6af9b0 100644
--- a/actions/ci-beholder-validator/action.yml
+++ b/actions/ci-beholder-validator/action.yml
@@ -62,7 +62,7 @@ runs:
         docker compose -f "${{ env.ACTIONS_PATH }}/docker-compose.yml" up -d redpanda-console
 
     - name: Configure aws creds
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
@@ -71,7 +71,7 @@ runs:
 
     - name: Login to aws ecr
       id: login-ecr
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registries: ${{ inputs.aws-account-number }}
 
diff --git a/actions/ci-benchmarking/action.yml b/actions/ci-benchmarking/action.yml
index d50b0cc1c..b95a33045 100644
--- a/actions/ci-benchmarking/action.yml
+++ b/actions/ci-benchmarking/action.yml
@@ -116,7 +116,7 @@ runs:
 
     - name: Run github-action-benchmark for PRs
       if: ${{ env.IS_PR == 'true' }}
-      uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29 # v1.20.3
+      uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
       with:
         tool: "go"
         output-file-path: output.txt
@@ -129,7 +129,7 @@ runs:
 
     - name: Run github-action-benchmark for Merges
       if: ${{ env.IS_MERGE == 'true' }}
-      uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29 # v1.20.3
+      uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
       with:
         tool: "go"
         output-file-path: output.txt
diff --git a/actions/ci-lint-charts/action.yml b/actions/ci-lint-charts/action.yml
index ef8560168..29befa1c3 100644
--- a/actions/ci-lint-charts/action.yml
+++ b/actions/ci-lint-charts/action.yml
@@ -46,7 +46,7 @@ runs:
         fi
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
+      uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
 
     - name: Run chart-testing (lint)
       shell: bash
diff --git a/actions/ci-lint-go/action.yml b/actions/ci-lint-go/action.yml
index 690c33bdf..6b8d44b31 100644
--- a/actions/ci-lint-go/action.yml
+++ b/actions/ci-lint-go/action.yml
@@ -98,7 +98,7 @@ runs:
 
     - name: Set env from files
       if: inputs.use-env-files == 'true'
-      uses: cardinalby/export-env-action@b16a08b396d047e3f9e1446e3946440e2be02a73 # 2.2.2
+      uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
       with:
         envFile: ${{ inputs.env-files }}
 
@@ -122,7 +122,7 @@ runs:
         fi
 
     - name: Setup golangci-lint
-      uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
       with:
         version: ${{ inputs.golangci-lint-version }}
         args: >-
diff --git a/actions/ci-lint-misc/action.yml b/actions/ci-lint-misc/action.yml
index d7621413f..d759afa89 100644
--- a/actions/ci-lint-misc/action.yml
+++ b/actions/ci-lint-misc/action.yml
@@ -26,7 +26,7 @@ runs:
         fetch-depth: ${{ inputs.checkout-repo-fetch-depth }}
 
     - name: Run actionlint
-      uses: reviewdog/action-actionlint@50842263c20a7c46bd0065b9e624d3c569db061e # v1.73.0
+      uses: reviewdog/action-actionlint@d63ba7532e0942965320cd8d73cbae4c7b3c5283 # v1.73.1
 
     - name: Run shellcheck
       uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
diff --git a/actions/ci-sonarqube-go/action.yml b/actions/ci-sonarqube-go/action.yml
index ad8d9d8f5..d645dad70 100644
--- a/actions/ci-sonarqube-go/action.yml
+++ b/actions/ci-sonarqube-go/action.yml
@@ -90,7 +90,7 @@ runs:
         echo "SONARQUBE_ARGS=$ARGS" >> $GITHUB_ENV
 
     - name: SonarQube Scan
-      uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0
+      uses: sonarsource/sonarqube-scan-action@c7ee0f9df90b7aa20e8dcf9695dcfe2e7da5b4f2 # v7.2.1
       with:
         args: ${{ env.SONARQUBE_ARGS }}
       env:
diff --git a/actions/ci-sonarqube-ts/action.yml b/actions/ci-sonarqube-ts/action.yml
index 7fa9e5302..84d0548e3 100644
--- a/actions/ci-sonarqube-ts/action.yml
+++ b/actions/ci-sonarqube-ts/action.yml
@@ -110,7 +110,7 @@ runs:
         steps.sonarqube_report_paths.outputs.sonarqube_lint_report_paths }}
 
     - name: SonarQube Scan
-      uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0
+      uses: sonarsource/sonarqube-scan-action@c7ee0f9df90b7aa20e8dcf9695dcfe2e7da5b4f2 # v7.2.1
       with:
         args: ${{ env.SONARQUBE_ARGS }}
       env:
diff --git a/actions/ci-test-go/action.yml b/actions/ci-test-go/action.yml
index af7c92f33..fcd504910 100644
--- a/actions/ci-test-go/action.yml
+++ b/actions/ci-test-go/action.yml
@@ -119,7 +119,7 @@ runs:
 
     - name: Set env from files
       if: inputs.use-env-files == 'true'
-      uses: cardinalby/export-env-action@b16a08b396d047e3f9e1446e3946440e2be02a73 # 2.2.2
+      uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
       with:
         envFile: ${{ inputs.env-files }}
 
diff --git a/actions/ci-test-sol/action.yml b/actions/ci-test-sol/action.yml
index 1b849fb51..a45286172 100644
--- a/actions/ci-test-sol/action.yml
+++ b/actions/ci-test-sol/action.yml
@@ -68,7 +68,7 @@ runs:
         run-install: "true"
 
     - name: Setup foundry
-      uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
+      uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
       with:
         version: ${{ inputs.foundry-version }}
 
diff --git a/actions/cicd-build-publish-artifacts-go/action.yml b/actions/cicd-build-publish-artifacts-go/action.yml
index b6843fd1d..7089aefe1 100644
--- a/actions/cicd-build-publish-artifacts-go/action.yml
+++ b/actions/cicd-build-publish-artifacts-go/action.yml
@@ -135,15 +135,15 @@ runs:
 
     - name: Setup zig
       if: inputs.use-zig == 'true'
-      uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d5824358023be3a2802d # v2.2.0
+      uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
       with:
         version: ${{ inputs.zig-version }}
 
     - name: Setup docker buildx
-      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
     - name: Set up qemu
-      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
     - name: Process params
       shell: bash
@@ -164,7 +164,7 @@ runs:
         fi
 
     - name: Configure aws creds
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       if: inputs.publish == 'true' && inputs.docker-registry == 'aws'
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
@@ -174,20 +174,20 @@ runs:
 
     - name: Login to aws ecr
       if: inputs.publish == 'true' && inputs.docker-registry == 'aws'
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registries: ${{ steps.process-params.outputs.aws-account-number }}
 
     - name: Update tag
       if: inputs.update-git-tag == 'true'
-      uses: richardsimko/update-tag@e173a8ef8f54ab526a91dad6139a25efed62424c # v1.0.11
+      uses: richardsimko/update-tag@aab2434e9a5040687874aa39d1c6377ec0cb0d94 # v1.1.6
       with:
         tag_name: v0.0.0-devel
       env:
         GITHUB_TOKEN: ${{ github.token }} # ${{ steps.get-gh-token.outputs.access-token }}
 
     - name: Run goreleaser release
-      uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1
+      uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
       with:
         version: ${{ inputs.goreleaser-version }}
         distribution: ${{ inputs.goreleaser-dist }}
diff --git a/actions/cicd-build-publish-artifacts-ts/action.yml b/actions/cicd-build-publish-artifacts-ts/action.yml
index f7bc0d8c3..03da7d4bd 100644
--- a/actions/cicd-build-publish-artifacts-ts/action.yml
+++ b/actions/cicd-build-publish-artifacts-ts/action.yml
@@ -85,11 +85,11 @@ runs:
 
     - name: Set up qemu
       if: inputs.setup-qemu == 'true'
-      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
     - name: Setup foundry
       if: inputs.setup-foundry == 'true'
-      uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
+      uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
       with:
         version: ${{ inputs.foundry-version }}
 
@@ -108,7 +108,7 @@ runs:
 
     - name: Upload artifacts to release
       if: inputs.publish-release == 'true'
-      uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # 2.9.0
+      uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
       with:
         repo_token: ${{ github.token }}
         file: ${{ inputs.release-assets }}
@@ -118,7 +118,7 @@ runs:
 
     - name: Upload artifacts to monorepo release
       if: inputs.publish-monorepo-release == 'true'
-      uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # 2.9.0
+      uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
       with:
         repo_token: ${{ github.token }}
         file:
diff --git a/actions/cicd-build-publish-charts/action.yml b/actions/cicd-build-publish-charts/action.yml
index c1f08b7c8..93f70039a 100644
--- a/actions/cicd-build-publish-charts/action.yml
+++ b/actions/cicd-build-publish-charts/action.yml
@@ -53,9 +53,9 @@ runs:
         fetch-depth: ${{ inputs.checkout-repo-fetch-depth }}
 
     - name: Setup helm
-      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
       with:
-        version: v3.12.0
+        version: v3.21.3
 
     - name: Process params
       shell: bash
@@ -69,7 +69,7 @@ runs:
 
     - name: Configure aws creds
       if: inputs.publish == 'true'
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
diff --git a/actions/crib-deploy-environment/action.yml b/actions/crib-deploy-environment/action.yml
index 0ad4514bd..11947ff89 100644
--- a/actions/crib-deploy-environment/action.yml
+++ b/actions/crib-deploy-environment/action.yml
@@ -232,7 +232,7 @@ runs:
           cli: './cli/**'
 
     - name: Login to AWS ECR for Helm
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       env:
         AWS_REGION: ${{ inputs.aws-region }}
       with:
@@ -364,7 +364,7 @@ runs:
         failure() && inputs.crib-alert-slack-webhook != '' && inputs.send-alerts
         == 'true'
       id: slack
-      uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
+      uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
       with:
         # For posting a rich message using Block Kit
         payload: ${{ steps.render-slack-template.outputs.result }}
diff --git a/actions/ctf-build-test-image/action.yml b/actions/ctf-build-test-image/action.yml
index 82fa97184..db7ae0c6f 100644
--- a/actions/ctf-build-test-image/action.yml
+++ b/actions/ctf-build-test-image/action.yml
@@ -53,7 +53,7 @@ runs:
     # Base Test Image Logic
     - name: Get CTF Version
       id: version
-      uses: smartcontractkit/chainlink-github-actions/chainlink-testing-framework/mod-version@fc3e0df622521019f50d772726d6bf8dc919dd38 # v2.3.19
+      uses: smartcontractkit/chainlink-github-actions/chainlink-testing-framework/mod-version@1ada5d85b0de3439a0ba238210d40605b5ed6704 # v2.3.32
       with:
         go-project-path: ./integration-tests
         module-name: github.com/smartcontractkit/chainlink-testing-framework/lib
@@ -90,7 +90,7 @@ runs:
     - name: Check if test base image exists
       if: steps.version.outputs.is_semantic == 'false'
       id: check-base-image
-      uses: smartcontractkit/chainlink-github-actions/docker/image-exists@75a9005952a9e905649cfb5a6971fd9429436acd # v2.3.25
+      uses: smartcontractkit/chainlink-github-actions/docker/image-exists@1ada5d85b0de3439a0ba238210d40605b5ed6704 # v2.3.32
       with:
         repository: test-base-image
         tag: ${{ steps.long_sha.outputs.long_sha }}
@@ -102,7 +102,7 @@ runs:
       if:
         steps.version.outputs.is_semantic == 'false' &&
         steps.check-base-image.outputs.exists == 'false'
-      uses: smartcontractkit/chainlink-github-actions/docker/build-push@75a9005952a9e905649cfb5a6971fd9429436acd # v2.3.25
+      uses: smartcontractkit/chainlink-github-actions/docker/build-push@1ada5d85b0de3439a0ba238210d40605b5ed6704 # v2.3.32
       env:
         BASE_IMAGE_NAME:
           ${{ inputs.QA_AWS_ACCOUNT_NUMBER }}.dkr.ecr.${{ inputs.QA_AWS_REGION
@@ -146,7 +146,7 @@ runs:
 
     - name: Check if image exists
       id: check-image
-      uses: smartcontractkit/chainlink-github-actions/docker/image-exists@75a9005952a9e905649cfb5a6971fd9429436acd # v2.3.25
+      uses: smartcontractkit/chainlink-github-actions/docker/image-exists@1ada5d85b0de3439a0ba238210d40605b5ed6704 # v2.3.32
       with:
         repository: ${{ inputs.repository }}
         tag: ${{ inputs.tag || steps.test_runner_hash.outputs.hash_value }}
@@ -154,7 +154,7 @@ runs:
         AWS_ROLE_TO_ASSUME: ${{ inputs.QA_AWS_ROLE_TO_ASSUME }}
     - name: Build and Publish Test Runner
       if: steps.check-image.outputs.exists == 'false'
-      uses: smartcontractkit/chainlink-github-actions/docker/build-push@75a9005952a9e905649cfb5a6971fd9429436acd # v2.3.25
+      uses: smartcontractkit/chainlink-github-actions/docker/build-push@1ada5d85b0de3439a0ba238210d40605b5ed6704 # v2.3.32
       with:
         tags: |
           ${{ inputs.QA_AWS_ACCOUNT_NUMBER }}.dkr.ecr.${{ inputs.QA_AWS_REGION }}.amazonaws.com/${{ inputs.repository }}:${{ inputs.tag || steps.test_runner_hash.outputs.hash_value }}
diff --git a/actions/ctf-fetch-aws-secret/action.yml b/actions/ctf-fetch-aws-secret/action.yml
index f39ffde31..a10be2455 100644
--- a/actions/ctf-fetch-aws-secret/action.yml
+++ b/actions/ctf-fetch-aws-secret/action.yml
@@ -25,7 +25,7 @@ runs:
   using: "composite"
   steps:
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ inputs.aws_region }}
         role-to-assume: ${{ inputs.aws_role_to_assume }}
diff --git a/actions/ctf-setup-run-tests-environment/action.yml b/actions/ctf-setup-run-tests-environment/action.yml
index c1beca84d..bdce977ce 100644
--- a/actions/ctf-setup-run-tests-environment/action.yml
+++ b/actions/ctf-setup-run-tests-environment/action.yml
@@ -200,7 +200,7 @@ runs:
 
     # Setup AWS cred and K8s context
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ inputs.QA_AWS_REGION }}
         role-to-assume: ${{ inputs.QA_AWS_ROLE_TO_ASSUME }}
@@ -225,7 +225,7 @@ runs:
     - name: Login to Amazon ECR
       if: inputs.aws_registries && inputs.QA_AWS_REGION
       id: login-ecr
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registries: ${{ inputs.aws_registries }}
       env:
@@ -234,15 +234,15 @@ runs:
     # To avoid rate limiting from Docker Hub, we can login with a paid user account.
     - name: Login to Docker Hub
       if: inputs.dockerhub_username && inputs.dockerhub_password
-      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.dockerhub_username }}
         password: ${{ inputs.dockerhub_password }}
 
     # Helm Setup
-    - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v3.13.1
+        version: v3.21.3
     - name: Add required helm charts including chainlink-qa
       shell: bash
       run: |
diff --git a/actions/docker-image-patch/action.yml b/actions/docker-image-patch/action.yml
index 36e07e172..ff94b2ace 100644
--- a/actions/docker-image-patch/action.yml
+++ b/actions/docker-image-patch/action.yml
@@ -129,7 +129,7 @@ runs:
         echo "::endgroup::"
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         role-duration-seconds: 900
@@ -138,7 +138,7 @@ runs:
 
     - name: Login to ECR for source image
       id: login-ecr-src
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       env:
         AWS_REGION: ${{ steps.set-outputs.outputs.registry-src-type == 'public' && 'us-east-1' || inputs.aws-region }}
       with:
@@ -175,7 +175,7 @@ runs:
 
     - name: Login to ECR for destination image
       id: login-ecr-dst
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       env:
         AWS_REGION: ${{ inputs.aws-region }}
       with:
diff --git a/actions/ecr-image-exists/action.yml b/actions/ecr-image-exists/action.yml
index e4754ec43..13fc075a4 100644
--- a/actions/ecr-image-exists/action.yml
+++ b/actions/ecr-image-exists/action.yml
@@ -141,7 +141,7 @@ runs:
 
     - name: Configure AWS Credentials
       if: ${{ inputs.aws-role-arn != '' }}
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ inputs.aws-region }}
         role-to-assume: ${{ inputs.aws-role-arn }}
@@ -152,7 +152,7 @@ runs:
       if:
         ${{ inputs.registry-auth == 'true' &&
         steps.validate.outputs.registry-type == 'private' }}
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registry-type: private
         mask-password: "true"
diff --git a/actions/helm-version-bump-receiver/action.yml b/actions/helm-version-bump-receiver/action.yml
index 7bc1ad205..f168d8e0a 100644
--- a/actions/helm-version-bump-receiver/action.yml
+++ b/actions/helm-version-bump-receiver/action.yml
@@ -96,7 +96,7 @@ runs:
 
     - name: Bump helm chart version
       id: bump-helm-chart-version
-      uses: mikefarah/yq@f15500b20a1c991c8729870ba60a4dc3524b6a94 # v4.44.2
+      uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d # v4.53.3
       env:
         AWS_SECRET_ACCESS_KEY: ""
         AWS_ACCESS_KEY_ID: ""
@@ -110,7 +110,7 @@ runs:
     - name: Update helm chart repo
       if: inputs.helm-chart-repo-update == 'true'
       id: update-helm-chart-repo
-      uses: mikefarah/yq@f15500b20a1c991c8729870ba60a4dc3524b6a94 # v4.44.2
+      uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d # v4.53.3
       env:
         AWS_SECRET_ACCESS_KEY: ""
         AWS_ACCESS_KEY_ID: ""
diff --git a/actions/k8s-tailscale-connect/action.yml b/actions/k8s-tailscale-connect/action.yml
index 0aa196075..15e959f85 100644
--- a/actions/k8s-tailscale-connect/action.yml
+++ b/actions/k8s-tailscale-connect/action.yml
@@ -31,14 +31,14 @@ runs:
   using: "composite"
   steps:
     - name: Connect to Tailscale
-      uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4.1.2
+      uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
       with:
         oauth-client-id: ${{ inputs.tailscale-oauth-client-id }}
         oauth-secret: ${{ inputs.tailscale-oauth-secret }}
         tags: ${{ inputs.tailscale-tags }}
 
     - name: Configure AWS credentials using OIDC
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.aws-oidc-role }}
         aws-region: ${{ inputs.aws-region }}
diff --git a/actions/oci-image-bump/action.yml b/actions/oci-image-bump/action.yml
index 14a3e6d41..ae012e69d 100644
--- a/actions/oci-image-bump/action.yml
+++ b/actions/oci-image-bump/action.yml
@@ -166,7 +166,7 @@ runs:
     # Commits, creates/pushes branch, and creates the PR.
     - name: Create PR
       id: create-pr
-      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
       with:
         base: ${{ inputs.pr-base-branch }}
         branch: ${{ inputs.pr-head-branch }}
diff --git a/actions/parse-and-mask-test-secrets/action.yml b/actions/parse-and-mask-test-secrets/action.yml
index 72ce8c516..69d78032c 100644
--- a/actions/parse-and-mask-test-secrets/action.yml
+++ b/actions/parse-and-mask-test-secrets/action.yml
@@ -13,7 +13,7 @@ runs:
     - name: Setup Go
       uses: actions/setup-go@v7
       with:
-        go-version: 1.21.3
+        go-version: 1.26.5
 
     - name: Parse and mask test secrets
       shell: bash
diff --git a/actions/pr-quality-check/action.yml b/actions/pr-quality-check/action.yml
index a2c7b40c8..6552709ff 100644
--- a/actions/pr-quality-check/action.yml
+++ b/actions/pr-quality-check/action.yml
@@ -104,7 +104,7 @@ runs:
       if: env.SHOULD_RUN == 'true' && github.event.action != 'closed'
       uses: actions/setup-python@v6
       with:
-        python-version: "3.11"
+        python-version: "3.14"
 
     - name: Install dependencies
       if: env.SHOULD_RUN == 'true' && github.event.action != 'closed'
@@ -326,7 +326,7 @@ runs:
         steps.check-claude.outputs.should-run-claude == 'true' &&
         steps.check-fingerprint.outputs.fingerprint-changed == 'true' &&
         github.event.pull_request.head.repo.full_name == github.repository
-      uses: google-github-actions/auth@55bd3a7c6e2ae7cf1877fd1ccb9d54c0503c457c #v2.1.2
+      uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
       with:
         credentials_json: ${{ inputs.claude-code-gcp-service-account-key }}
         create_credentials_file: true
diff --git a/actions/pr-slack-alert/action.yml b/actions/pr-slack-alert/action.yml
index 6ca19691a..719fef6ad 100644
--- a/actions/pr-slack-alert/action.yml
+++ b/actions/pr-slack-alert/action.yml
@@ -56,7 +56,7 @@ runs:
     - name: Send slack alert
       if: steps.filter.outputs.SKIP_SLACK != 'true'
       id: slack
-      uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e #v1.26.0
+      uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
       with:
         channel-id: ${{ inputs.slack-channel-id }}
         # https://api.slack.com/surfaces/messages#payloads
diff --git a/actions/promote-image-ecr/action.yaml b/actions/promote-image-ecr/action.yaml
index 16298d7ad..bb390d696 100644
--- a/actions/promote-image-ecr/action.yaml
+++ b/actions/promote-image-ecr/action.yaml
@@ -78,29 +78,29 @@ runs:
   using: "composite"
   steps:
     - name: Install cosign
-      uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       with:
-        cosign-release: "v3.0.2"
+        cosign-release: "v3.1.3"
 
     - name: Configure AWS credentials (SOURCE)
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.source-role-arn }}
         aws-region: ${{ inputs.source-aws-region || inputs.aws-region }}
 
     - name: Login to Amazon ECR (SOURCE)
       id: src
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
 
     - name: Configure AWS credentials (DESTINATION)
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.destination-role-arn }}
         aws-region: ${{ inputs.destination-aws-region || inputs.aws-region }}
 
     - name: Login to Amazon ECR (DESTINATION)
       id: dst
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
 
     - name: Copy image
       shell: bash
diff --git a/actions/pull-private-ecr-image/action.yml b/actions/pull-private-ecr-image/action.yml
index b55663f86..7f5ab3563 100644
--- a/actions/pull-private-ecr-image/action.yml
+++ b/actions/pull-private-ecr-image/action.yml
@@ -68,7 +68,7 @@ runs:
         fi
 
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ inputs.aws-region }}
         role-to-assume: ${{ inputs.aws-role-arn }}
@@ -76,7 +76,7 @@ runs:
         mask-aws-account-id: true
 
     - name: Login to Amazon ECR
-      uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
       with:
         registries: ${{ inputs.aws-account-number }}
 
diff --git a/actions/setup-gap/action.yml b/actions/setup-gap/action.yml
index 74f0d030d..bab4c5980 100644
--- a/actions/setup-gap/action.yml
+++ b/actions/setup-gap/action.yml
@@ -159,7 +159,7 @@ runs:
     - name: Assume role
       # We only need to assume a role if we intend to use k8s API server access via the proxy
       if: inputs.use-k8s == 'true'
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
diff --git a/actions/setup-github-token/action.yml b/actions/setup-github-token/action.yml
index 269ad47c3..4d910bfbc 100644
--- a/actions/setup-github-token/action.yml
+++ b/actions/setup-github-token/action.yml
@@ -47,7 +47,7 @@ runs:
         fi
 
     - name: Assume role capable of getting token from gati
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ inputs.aws-region }}
         mask-aws-account-id: true
diff --git a/actions/setup-nix-cache/action.yml b/actions/setup-nix-cache/action.yml
index 0c0f36b6e..69a973306 100644
--- a/actions/setup-nix-cache/action.yml
+++ b/actions/setup-nix-cache/action.yml
@@ -42,7 +42,7 @@ runs:
   steps:
     # Step to configure AWS credentials for Nix cache
     - name: Configure AWS credentials for Nix cache
-      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: ${{ inputs.role-to-assume }}
         role-duration-seconds: ${{ inputs.role-duration-seconds }}
diff --git a/actions/setup-renovate/action.yml b/actions/setup-renovate/action.yml
index f9bd34c05..42330a073 100644
--- a/actions/setup-renovate/action.yml
+++ b/actions/setup-renovate/action.yml
@@ -62,7 +62,7 @@ runs:
         aws-role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
 
     - name: Run renovate
-      uses: renovatebot/github-action@76d49712364696a06b60e8647df46b288fff0ddc # v40.2.4
+      uses: renovatebot/github-action@0984fb80fc633b17e57f3e8b6c007fe0dc3e0d62 # v40.3.6
       with:
         renovate-version: ${{ inputs.renovate-version }}
         token: ${{ steps.get-access-token.outputs.access-token }}
diff --git a/actions/slack-notify-git-ref/action.yml b/actions/slack-notify-git-ref/action.yml
index b0110bc89..d9f4ca7e3 100644
--- a/actions/slack-notify-git-ref/action.yml
+++ b/actions/slack-notify-git-ref/action.yml
@@ -146,7 +146,7 @@ runs:
         } >> $GITHUB_ENV
 
     - name: Notify slack
-      uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
+      uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
       id: notify-slack
       with:
         payload: ${{ env.payload }}