From 9bec131c59b84afa07c582cd0757c77c2caeb3e4 Mon Sep 17 00:00:00 2001
From: Renovate Bot <byronawilliams@gmail.com>
Date: Sun, 2 Aug 2026 14:06:31 +0000
Subject: [PATCH] chore(deps): Update GitHub Actions

---
 .github/workflows/claude-baseline-review.yml  |  4 ++--
 .github/workflows/codeql.yml                  |  6 +++---
 .github/workflows/dependency-review.yml       |  2 +-
 .github/workflows/docs-deploy.yml             |  2 +-
 .github/workflows/pre-commit.yml              |  2 +-
 .github/workflows/python-ci.yml               | 14 ++++++-------
 .github/workflows/python-compatibility.yml    |  2 +-
 .../workflows/python-container-security.yml   | 10 +++++-----
 .../python-dependency-provenance.yml          |  6 +++---
 .github/workflows/python-docker.yml           |  8 ++++----
 .github/workflows/python-docs.yml             |  2 +-
 .../workflows/python-fips-compatibility.yml   |  6 +++---
 .github/workflows/python-fuzzing.yml          |  4 ++--
 .github/workflows/python-mutation.yml         |  2 +-
 .../python-performance-regression.yml         |  2 +-
 .github/workflows/python-precommit.yml        |  2 +-
 .github/workflows/python-publish-pypi.yml     |  6 +++---
 .github/workflows/python-qlty-gate.yml        |  2 +-
 .github/workflows/python-release.yml          |  8 ++++----
 .github/workflows/python-reuse.yml            |  2 +-
 .github/workflows/python-sbom.yml             | 12 +++++------
 .github/workflows/python-scorecard.yml        |  6 +++---
 .../workflows/python-security-analysis.yml    | 16 +++++++--------
 .github/workflows/python-snyk-iac.yml         | 14 ++++++-------
 .github/workflows/python-snyk.yml             | 12 +++++------
 .github/workflows/python-sonarcloud.yml       |  4 ++--
 .../workflows/python-supplemental-checks.yml  |  4 ++--
 .github/workflows/release-tag.yml             |  2 +-
 .github/workflows/reuse.yml                   |  4 ++--
 .github/workflows/scorecard.yml               |  2 +-
 .github/workflows/security-analysis.yml       |  2 +-
 .github/workflows/self-test.yml               |  6 +++---
 .github/workflows/shell-tests.yml             |  4 ++--
 .github/workflows/sonarcloud.yml              |  4 ++--
 .../workflows/supply-chain-build-verify.yml   |  2 +-
 .../workflows/supply-chain-consume-verify.yml |  2 +-
 .../workflows/supply-chain-promote-core.yml   |  4 ++--
 workflow-templates/python-ci.yml              |  6 +++---
 workflow-templates/python-cifuzzy.yml         |  4 ++--
 workflow-templates/python-compatibility.yml   |  2 +-
 .../python-container-security.yml             |  2 +-
 workflow-templates/python-docs.yml            |  8 ++++----
 .../python-fips-compatibility.yml             |  2 +-
 workflow-templates/python-mutation.yml        |  2 +-
 workflow-templates/python-pr-validation.yml   |  2 +-
 workflow-templates/python-publish-pypi.yml    |  6 +++---
 workflow-templates/python-release.yml         |  4 ++--
 workflow-templates/python-reuse.yml           |  2 +-
 workflow-templates/python-sbom.yml            |  2 +-
 workflow-templates/python-scorecard.yml       |  2 +-
 .../python-security-analysis.yml              | 20 +++++++++----------
 workflow-templates/python-slsa.yml            |  2 +-
 workflow-templates/python-sonarcloud.yml      |  4 ++--
 53 files changed, 131 insertions(+), 131 deletions(-)

diff --git a/.github/workflows/claude-baseline-review.yml b/.github/workflows/claude-baseline-review.yml
index 9f087b62..05cf1e8e 100644
--- a/.github/workflows/claude-baseline-review.yml
+++ b/.github/workflows/claude-baseline-review.yml
@@ -114,7 +114,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           # #ASSUME: depth 1 suffices; the reviewer reads PR state through
           # the gh CLI, not local git history.
@@ -138,7 +138,7 @@ jobs:
         run: git submodule update --init --recursive
 
       - name: Run baseline triage review
-        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342  # v1.0.171
+        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b  # v1.0.183
         with:
           # #CRITICAL: secret reference; ANTHROPIC_API_KEY must exist as a
           # repository or organization secret or this step fails at startup.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 385f6b09..b9f4e43b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,17 +45,17 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: actions
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:actions"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 9ab76163..761026fd 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -22,7 +22,7 @@ jobs:
           disable-sudo: true
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index 3950ec51..367ec105 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 17aea230..f2729670 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -51,7 +51,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index b1e4d8c2..150ab6f1 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -148,7 +148,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -510,7 +510,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -618,7 +618,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -729,7 +729,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -864,7 +864,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -999,7 +999,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -1152,7 +1152,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
diff --git a/.github/workflows/python-compatibility.yml b/.github/workflows/python-compatibility.yml
index 4238830d..36aac6ae 100644
--- a/.github/workflows/python-compatibility.yml
+++ b/.github/workflows/python-compatibility.yml
@@ -201,7 +201,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python ${{ matrix.python }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/.github/workflows/python-container-security.yml b/.github/workflows/python-container-security.yml
index a2172091..bd54c1af 100644
--- a/.github/workflows/python-container-security.yml
+++ b/.github/workflows/python-container-security.yml
@@ -136,7 +136,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Check Dockerfile exists
         id: check-dockerfile
@@ -152,7 +152,7 @@ jobs:
 
       - name: Run Hadolint
         if: steps.check-dockerfile.outputs.exists == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5  # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6  # v3.4.0
         with:
           dockerfile: ${{ inputs.dockerfile-path }}
           failure-threshold: ${{ inputs.hadolint-failure-threshold }}
@@ -161,7 +161,7 @@ jobs:
 
       - name: Upload Hadolint SARIF
         if: ${{ inputs.upload-sarif && steps.check-dockerfile.outputs.exists == 'true' }}
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           sarif_file: hadolint-results.sarif
           category: hadolint
@@ -195,7 +195,7 @@ jobs:
 
       - name: Checkout repository
         if: ${{ inputs.build-image }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # Conditional DHI login: docker/login-action emits "##[error]Username and
       # password required" when secrets are absent, which clutters CI logs even
@@ -279,7 +279,7 @@ jobs:
 
       - name: Upload Trivy SARIF
         if: ${{ inputs.upload-sarif && steps.image.outputs.ref != '' }}
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           sarif_file: trivy-container-results.sarif
           category: trivy-container
diff --git a/.github/workflows/python-dependency-provenance.yml b/.github/workflows/python-dependency-provenance.yml
index 7d4f9ab4..ff9e1843 100644
--- a/.github/workflows/python-dependency-provenance.yml
+++ b/.github/workflows/python-dependency-provenance.yml
@@ -106,7 +106,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Detect ecosystems
         id: detect
         env:
@@ -193,7 +193,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -259,7 +259,7 @@ jobs:
       # tracer helper scripts are checked out from this reusable workflow's own
       # commit (SHA-pinned), so a caller pinned to @<sha> runs exactly that code.
       - name: Checkout provenance scripts
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
diff --git a/.github/workflows/python-docker.yml b/.github/workflows/python-docker.yml
index 09a232c9..c7565a9e 100644
--- a/.github/workflows/python-docker.yml
+++ b/.github/workflows/python-docker.yml
@@ -194,13 +194,13 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
       - name: Login to DHI Registry
         if: inputs.enable-dhi-login
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
           registry: dhi.io
           username: ${{ secrets.DHI_USERNAME }}
@@ -271,7 +271,7 @@ jobs:
 
       - name: Login to Container Registry
         if: steps.push-check.outputs.push == 'true'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ github.actor }}
@@ -348,7 +348,7 @@ jobs:
 
       - name: Upload Trivy scan results
         if: inputs.enable-trivy-scan && always()
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           sarif_file: 'trivy-results.sarif'
         continue-on-error: true
diff --git a/.github/workflows/python-docs.yml b/.github/workflows/python-docs.yml
index bcbc1cea..f5ab91bb 100644
--- a/.github/workflows/python-docs.yml
+++ b/.github/workflows/python-docs.yml
@@ -76,7 +76,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0  # Full history for git-based dates
 
diff --git a/.github/workflows/python-fips-compatibility.yml b/.github/workflows/python-fips-compatibility.yml
index 40b7a955..527a7b72 100644
--- a/.github/workflows/python-fips-compatibility.yml
+++ b/.github/workflows/python-fips-compatibility.yml
@@ -164,7 +164,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
@@ -251,7 +251,7 @@ jobs:
           steps.script-check.outputs.script_exists != 'true'
           && inputs.use-central-checker
           && (steps.detect.outputs.state == 'uv-locked' || steps.detect.outputs.state == 'uv-no-lock')
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           repository: ByronWilliamsCPA/.github
           ref: ${{ inputs.central-checker-ref }}
@@ -648,7 +648,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
diff --git a/.github/workflows/python-fuzzing.yml b/.github/workflows/python-fuzzing.yml
index 905b8573..d011fe0f 100644
--- a/.github/workflows/python-fuzzing.yml
+++ b/.github/workflows/python-fuzzing.yml
@@ -113,7 +113,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -265,7 +265,7 @@ jobs:
 
       - name: Upload SARIF Report
         if: inputs.upload-sarif && always() && steps.build.outcome == 'success'
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           sarif_file: sarif/cifuzz.sarif
         continue-on-error: true
diff --git a/.github/workflows/python-mutation.yml b/.github/workflows/python-mutation.yml
index 71387d00..36bb1fec 100644
--- a/.github/workflows/python-mutation.yml
+++ b/.github/workflows/python-mutation.yml
@@ -136,7 +136,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/.github/workflows/python-performance-regression.yml b/.github/workflows/python-performance-regression.yml
index ad796749..672d37ee 100644
--- a/.github/workflows/python-performance-regression.yml
+++ b/.github/workflows/python-performance-regression.yml
@@ -165,7 +165,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout PR branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/.github/workflows/python-precommit.yml b/.github/workflows/python-precommit.yml
index ed8b690c..8cd42b36 100644
--- a/.github/workflows/python-precommit.yml
+++ b/.github/workflows/python-precommit.yml
@@ -64,7 +64,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
diff --git a/.github/workflows/python-publish-pypi.yml b/.github/workflows/python-publish-pypi.yml
index e0f44ea9..b9182138 100644
--- a/.github/workflows/python-publish-pypi.yml
+++ b/.github/workflows/python-publish-pypi.yml
@@ -73,7 +73,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -159,7 +159,7 @@ jobs:
         # re-pin here when the next release ships. After GitHub's 2026-06-16
         # cutover, node20 actions execute on node24 automatically, so until then
         # this surfaces as a deprecation warning only, not a failure.
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           print-hash: true
           verbose: true
@@ -211,7 +211,7 @@ jobs:
 
       - name: Publish to TestPyPI
         # #VERIFY: see node20 note on the PyPI publish step above.
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           print-hash: true
diff --git a/.github/workflows/python-qlty-gate.yml b/.github/workflows/python-qlty-gate.yml
index 7601f2ea..a8560f7f 100644
--- a/.github/workflows/python-qlty-gate.yml
+++ b/.github/workflows/python-qlty-gate.yml
@@ -113,7 +113,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
           # #ASSUME: qlty check needs no Git credentials; disabling persistence keeps
diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index 850f354d..69ebf63f 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -144,7 +144,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -286,7 +286,7 @@ jobs:
           echo "Pre-release tests skipped intentionally. Reason: $SKIP_TESTS_REASON"
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
           token: ${{ github.token }}
@@ -488,7 +488,7 @@ jobs:
         # potential future provenance use.
         # #VERIFY: if Sigstore bundle uploads fail, check the id-token and contents
         # grants, not attestations.
-        uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1  # v3.4.0
+        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9  # v3.5.0
         with:
           inputs: ./dist/*.tar.gz ./dist/*.whl
           release-signing-artifacts: true
@@ -520,7 +520,7 @@ jobs:
 
       - name: Create GitHub Release (Manual)
         if: ${{ !inputs.semantic-release }}
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           tag_name: ${{ steps.manual-release.outputs.tag }}
           generate_release_notes: true
diff --git a/.github/workflows/python-reuse.yml b/.github/workflows/python-reuse.yml
index 70d77370..b5a24b2a 100644
--- a/.github/workflows/python-reuse.yml
+++ b/.github/workflows/python-reuse.yml
@@ -57,7 +57,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Check for required license files
         id: license-check
diff --git a/.github/workflows/python-sbom.yml b/.github/workflows/python-sbom.yml
index ea9f3423..54f44609 100644
--- a/.github/workflows/python-sbom.yml
+++ b/.github/workflows/python-sbom.yml
@@ -114,7 +114,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -286,7 +286,7 @@ jobs:
       # The sparse-checkout uses the caller-configured grype-config-path so a custom
       # path (e.g., configs/.grype.yaml) is fetched too. Path is validated above.
       - name: Checkout repository (for grype config and SARIF context)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           sparse-checkout: |
             ${{ inputs.grype-config-path }}
@@ -374,7 +374,7 @@ jobs:
 
       - name: Upload Grype results to GitHub Security tab
         if: always() && steps.grype-sarif.outputs.sarif != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true  # Don't fail if Code Scanning not enabled on repo
         with:
           sarif_file: ${{ steps.grype-sarif.outputs.sarif }}
@@ -412,7 +412,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository (for SARIF context)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           sparse-checkout: |
             .git
@@ -450,7 +450,7 @@ jobs:
 
       - name: Upload OSV-Scanner results to GitHub Security tab
         if: always()
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true
         with:
           sarif_file: osv-sbom-runtime.sarif
@@ -511,7 +511,7 @@ jobs:
       # #VERIFY: on first caller run, confirm the checked-out script SHA matches
       # the called workflow ref in the job log.
       - name: Checkout license checker script
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
diff --git a/.github/workflows/python-scorecard.yml b/.github/workflows/python-scorecard.yml
index eeacb3cd..43c2b41e 100644
--- a/.github/workflows/python-scorecard.yml
+++ b/.github/workflows/python-scorecard.yml
@@ -96,7 +96,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           persist-credentials: false
 
@@ -123,7 +123,7 @@ jobs:
         # gate evaluation) all proceed correctly. The next "Verify SARIF was generated" step
         # turns missing-SARIF into an explicit failure so we don't silently lose detection.
         continue-on-error: true
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc  # v2.4.4
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload Scorecard SARIF to Security tab
         if: ${{ inputs.upload-sarif }}
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           sarif_file: scorecard-results.sarif
           category: scorecard
diff --git a/.github/workflows/python-security-analysis.yml b/.github/workflows/python-security-analysis.yml
index 97f3681b..36c438b9 100644
--- a/.github/workflows/python-security-analysis.yml
+++ b/.github/workflows/python-security-analysis.yml
@@ -132,7 +132,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Check for security-relevant changes
         id: filter
@@ -172,7 +172,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -235,7 +235,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: steps.detect.outputs.state == 'uv-locked' || steps.detect.outputs.state == 'uv-no-lock'
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           languages: python
           queries: security-extended,security-and-quality
@@ -249,11 +249,11 @@ jobs:
 
       - name: Build CodeQL Database
         if: steps.detect.outputs.state == 'uv-locked' || steps.detect.outputs.state == 'uv-no-lock'
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
 
       - name: Perform CodeQL Analysis
         if: steps.detect.outputs.state == 'uv-locked' || steps.detect.outputs.state == 'uv-no-lock'
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           category: "/language:python"
           upload: true
@@ -276,7 +276,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
@@ -306,7 +306,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -403,7 +403,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Run OSV Scanner
         uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2  # v2.3.8
diff --git a/.github/workflows/python-snyk-iac.yml b/.github/workflows/python-snyk-iac.yml
index c93987b6..1fae6f51 100644
--- a/.github/workflows/python-snyk-iac.yml
+++ b/.github/workflows/python-snyk-iac.yml
@@ -84,7 +84,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Check for SNYK_TOKEN
         id: check-token
         env:
@@ -173,7 +173,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Setup Snyk CLI
         uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04  # v1.0.0
       - name: Run Snyk IaC (Terraform)
@@ -204,7 +204,7 @@ jobs:
           exit 0
       - name: Upload Terraform SARIF
         if: always() && hashFiles('iac-terraform.sarif') != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true
         with:
           sarif_file: iac-terraform.sarif
@@ -231,7 +231,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Setup Snyk CLI
         uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04  # v1.0.0
       - name: Run Snyk IaC (Kubernetes)
@@ -261,7 +261,7 @@ jobs:
           exit 0
       - name: Upload Kubernetes SARIF
         if: always() && hashFiles('iac-k8s.sarif') != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true
         with:
           sarif_file: iac-k8s.sarif
@@ -288,7 +288,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Setup Snyk CLI
         uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04  # v1.0.0
       - name: Run Snyk IaC (Docker Compose)
@@ -318,7 +318,7 @@ jobs:
           exit 0
       - name: Upload Docker Compose SARIF
         if: always() && hashFiles('iac-compose.sarif') != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true
         with:
           sarif_file: iac-compose.sarif
diff --git a/.github/workflows/python-snyk.yml b/.github/workflows/python-snyk.yml
index 0357fb5c..f1849650 100644
--- a/.github/workflows/python-snyk.yml
+++ b/.github/workflows/python-snyk.yml
@@ -94,7 +94,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       # Secrets-in-if antipattern guard: read presence via env, decide in shell.
       - name: Check for SNYK_TOKEN
         id: check
@@ -143,7 +143,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Setup Snyk CLI
         uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04  # v1.0.0
       - name: Run Snyk Code
@@ -173,7 +173,7 @@ jobs:
           exit 0
       - name: Upload Snyk Code SARIF
         if: always() && hashFiles('snyk-code.sarif') != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true
         with:
           sarif_file: snyk-code.sarif
@@ -202,7 +202,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
@@ -231,7 +231,7 @@ jobs:
           exit 0
       - name: Upload Snyk OSS SARIF
         if: always() && hashFiles('snyk-oss.sarif') != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         continue-on-error: true
         with:
           sarif_file: snyk-oss.sarif
@@ -254,7 +254,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Setup Snyk CLI
         uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04  # v1.0.0
       - name: Generate AI-BOM
diff --git a/.github/workflows/python-sonarcloud.yml b/.github/workflows/python-sonarcloud.yml
index 53f3a8c8..d72f6d52 100644
--- a/.github/workflows/python-sonarcloud.yml
+++ b/.github/workflows/python-sonarcloud.yml
@@ -219,7 +219,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0  # Disable shallow clone for better analysis
 
@@ -384,7 +384,7 @@ jobs:
 
       - name: SonarCloud Scan
         if: steps.detect.outputs.state == 'uv-locked' || steps.detect.outputs.state == 'uv-no-lock'
-        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e  # v8.2  # nosemgrep: detected-sonarqube-docs-api-key  # FP -- see #37
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f  # v8.2  # nosemgrep: detected-sonarqube-docs-api-key  # FP -- see #37
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/python-supplemental-checks.yml b/.github/workflows/python-supplemental-checks.yml
index 958ff304..67174dba 100644
--- a/.github/workflows/python-supplemental-checks.yml
+++ b/.github/workflows/python-supplemental-checks.yml
@@ -135,7 +135,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Build exclude args
         id: exclude-args
@@ -238,7 +238,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index 010ca9fb..f25c78bd 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -36,7 +36,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index d5372945..887c8a01 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -46,7 +46,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: REUSE Compliance Check
         uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5  # v6.0.0
@@ -77,7 +77,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Check primary license exists
         run: |
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 1b5b6a59..1b283284 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -25,4 +25,4 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
index 60ef6056..a0f1a7d1 100644
--- a/.github/workflows/security-analysis.yml
+++ b/.github/workflows/security-analysis.yml
@@ -22,7 +22,7 @@ jobs:
       security-events: write
       pull-requests: write
       actions: read
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       python-version: "3.12"
       run-codeql: false
diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
index 987f452e..ed01463b 100644
--- a/.github/workflows/self-test.yml
+++ b/.github/workflows/self-test.yml
@@ -61,7 +61,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Install actionlint
         run: |
@@ -96,7 +96,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Run shellcheck
         run: |
@@ -130,7 +130,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Check workflows match docs/python-versions.md
         run: scripts/check-python-versions.sh
diff --git a/.github/workflows/shell-tests.yml b/.github/workflows/shell-tests.yml
index 98a6a91b..37f05906 100644
--- a/.github/workflows/shell-tests.yml
+++ b/.github/workflows/shell-tests.yml
@@ -47,7 +47,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           submodules: recursive
 
@@ -79,7 +79,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index b0e0e7c8..c32cbad2 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -34,13 +34,13 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
       - name: SonarCloud Scan
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e  # v8.2  # nosemgrep: detected-sonarqube-docs-api-key  # FP -- see #37
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f  # v8.2  # nosemgrep: detected-sonarqube-docs-api-key  # FP -- see #37
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/supply-chain-build-verify.yml b/.github/workflows/supply-chain-build-verify.yml
index 62cb87cf..e82d0d49 100644
--- a/.github/workflows/supply-chain-build-verify.yml
+++ b/.github/workflows/supply-chain-build-verify.yml
@@ -112,7 +112,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/supply-chain-consume-verify.yml b/.github/workflows/supply-chain-consume-verify.yml
index 63b268cc..28f7db92 100644
--- a/.github/workflows/supply-chain-consume-verify.yml
+++ b/.github/workflows/supply-chain-consume-verify.yml
@@ -97,7 +97,7 @@ jobs:
 
       # Checkout is needed only to read lock_file when one is provided.
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/supply-chain-promote-core.yml b/.github/workflows/supply-chain-promote-core.yml
index fa784ebc..309888fc 100644
--- a/.github/workflows/supply-chain-promote-core.yml
+++ b/.github/workflows/supply-chain-promote-core.yml
@@ -233,7 +233,7 @@ jobs:
 
       - name: Upload Grype SARIF
         if: always() && hashFiles('grype-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: grype-results.sarif
           category: grype-${{ inputs.image_id }}
@@ -451,7 +451,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/workflow-templates/python-ci.yml b/workflow-templates/python-ci.yml
index da63b911..12bffa6d 100644
--- a/workflow-templates/python-ci.yml
+++ b/workflow-templates/python-ci.yml
@@ -68,7 +68,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Generate cache keys
         id: cache-key
@@ -144,7 +144,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python ${{  matrix.python-version  }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -211,7 +211,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python 3.12
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/workflow-templates/python-cifuzzy.yml b/workflow-templates/python-cifuzzy.yml
index 95d66d71..846921cd 100644
--- a/workflow-templates/python-cifuzzy.yml
+++ b/workflow-templates/python-cifuzzy.yml
@@ -52,7 +52,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Build Fuzzers
         id: build
@@ -73,7 +73,7 @@ jobs:
 
       - name: Upload SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif
           category: fuzzing-${{  matrix.sanitizer  }}
diff --git a/workflow-templates/python-compatibility.yml b/workflow-templates/python-compatibility.yml
index 6bfd2769..e1e18358 100644
--- a/workflow-templates/python-compatibility.yml
+++ b/workflow-templates/python-compatibility.yml
@@ -32,7 +32,7 @@ permissions:
 jobs:
   compatibility:
     name: Compatibility Matrix
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       python-versions: '["3.10", "3.11", "3.12", "3.13"]'
       operating-systems: '["ubuntu-latest"]'
diff --git a/workflow-templates/python-container-security.yml b/workflow-templates/python-container-security.yml
index 79033296..94d9259a 100644
--- a/workflow-templates/python-container-security.yml
+++ b/workflow-templates/python-container-security.yml
@@ -44,7 +44,7 @@ permissions:
 jobs:
   container-security:
     name: Container Security Scan
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-container-security.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-container-security.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       dockerfile-path: './Dockerfile'
       build-image: true
diff --git a/workflow-templates/python-docs.yml b/workflow-templates/python-docs.yml
index 4ba94b28..6903cbcb 100644
--- a/workflow-templates/python-docs.yml
+++ b/workflow-templates/python-docs.yml
@@ -50,7 +50,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0  # Required for git-based dates
 
@@ -106,7 +106,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -149,7 +149,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0  # Required for git-based dates
 
@@ -232,7 +232,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Download site artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
diff --git a/workflow-templates/python-fips-compatibility.yml b/workflow-templates/python-fips-compatibility.yml
index 52ef1af5..69aaa867 100644
--- a/workflow-templates/python-fips-compatibility.yml
+++ b/workflow-templates/python-fips-compatibility.yml
@@ -63,7 +63,7 @@ permissions:
 jobs:
   fips-check:
     name: FIPS Compliance Check
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-fips-compatibility.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-fips-compatibility.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       strict-mode: ${{ github.event.inputs.strict_mode || false }}
       include-tests: true
diff --git a/workflow-templates/python-mutation.yml b/workflow-templates/python-mutation.yml
index 537029cf..5ca98234 100644
--- a/workflow-templates/python-mutation.yml
+++ b/workflow-templates/python-mutation.yml
@@ -36,7 +36,7 @@ permissions:
 jobs:
   mutation:
     name: Mutation Testing
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       source-directory: 'src'
       test-directory: 'tests'
diff --git a/workflow-templates/python-pr-validation.yml b/workflow-templates/python-pr-validation.yml
index 6a1ce4ae..fbc002b4 100644
--- a/workflow-templates/python-pr-validation.yml
+++ b/workflow-templates/python-pr-validation.yml
@@ -33,7 +33,7 @@ permissions:
 jobs:
   pr-validation:
     name: PR Validation
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-pr-validation.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-pr-validation.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       python-version: '3.12'
       source-directory: 'src'
diff --git a/workflow-templates/python-publish-pypi.yml b/workflow-templates/python-publish-pypi.yml
index 5832521d..4b596e0a 100644
--- a/workflow-templates/python-publish-pypi.yml
+++ b/workflow-templates/python-publish-pypi.yml
@@ -42,7 +42,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
 
@@ -111,7 +111,7 @@ jobs:
         # re-pin here when the next release ships. After GitHub's 2026-06-16
         # cutover, node20 actions execute on node24 automatically, so until then
         # this surfaces as a deprecation warning only, not a failure.
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           print-hash: true
           verbose: true
@@ -154,7 +154,7 @@ jobs:
 
       - name: Publish to TestPyPI
         # #VERIFY: see node20 note on the PyPI publish step above.
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           print-hash: true
diff --git a/workflow-templates/python-release.yml b/workflow-templates/python-release.yml
index 9d7fd4f5..d89eb6e7 100644
--- a/workflow-templates/python-release.yml
+++ b/workflow-templates/python-release.yml
@@ -48,7 +48,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0  # Full history for version detection
 
@@ -215,7 +215,7 @@ jobs:
           EOF
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           files: |
             dist/*
diff --git a/workflow-templates/python-reuse.yml b/workflow-templates/python-reuse.yml
index e2970bfe..4143f460 100644
--- a/workflow-templates/python-reuse.yml
+++ b/workflow-templates/python-reuse.yml
@@ -32,7 +32,7 @@ permissions:
 jobs:
   reuse:
     name: REUSE Compliance Check
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-reuse.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-reuse.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       generate-spdx: true
       fail-on-missing: true
diff --git a/workflow-templates/python-sbom.yml b/workflow-templates/python-sbom.yml
index 386e9309..df320c26 100644
--- a/workflow-templates/python-sbom.yml
+++ b/workflow-templates/python-sbom.yml
@@ -35,7 +35,7 @@ permissions:
 jobs:
   sbom:
     name: SBOM Generation & Scan
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       python-version: '3.12'
       fail-on-vulnerabilities: true
diff --git a/workflow-templates/python-scorecard.yml b/workflow-templates/python-scorecard.yml
index 47b7052a..bc1544b0 100644
--- a/workflow-templates/python-scorecard.yml
+++ b/workflow-templates/python-scorecard.yml
@@ -29,7 +29,7 @@ permissions:
 jobs:
   scorecard:
     name: Scorecard Analysis
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@6109af2dba735bef8bc387aa01e2645f50ccae6e # v7.0.25
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@7aaf24d13d9ff61d0d231797bfa6fd3cad478e2b # v7.1.12
     with:
       upload-sarif: true
     permissions:
diff --git a/workflow-templates/python-security-analysis.yml b/workflow-templates/python-security-analysis.yml
index 9f37dc3c..ca6bf181 100644
--- a/workflow-templates/python-security-analysis.yml
+++ b/workflow-templates/python-security-analysis.yml
@@ -67,7 +67,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Check for security-relevant file changes
         id: filter
@@ -97,7 +97,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -118,7 +118,7 @@ jobs:
           uv sync --only main --no-interaction
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           languages: python
           queries: security-extended,security-and-quality
@@ -134,10 +134,10 @@ jobs:
               - uses: security-and-quality
 
       - name: Build CodeQL Database
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           category: "/language:python"
           upload: true
@@ -160,7 +160,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
@@ -183,7 +183,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
@@ -236,7 +236,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Run OSV Scanner
         uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2  # v2.3.8
@@ -373,7 +373,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Run OWASP Dependency-Check
         uses: dependency-check/Dependency-Check_Action@75ba02d6183445fe0761d26e836bde58b1560600  # 1.1.0
@@ -396,7 +396,7 @@ jobs:
 
       - name: Upload SARIF to GitHub Security tab
         if: always()
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           sarif_file: reports/dependency-check-report.sarif
 
diff --git a/workflow-templates/python-slsa.yml b/workflow-templates/python-slsa.yml
index c603e93b..0e44f1e8 100644
--- a/workflow-templates/python-slsa.yml
+++ b/workflow-templates/python-slsa.yml
@@ -45,7 +45,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
diff --git a/workflow-templates/python-sonarcloud.yml b/workflow-templates/python-sonarcloud.yml
index 638838d7..662818cd 100644
--- a/workflow-templates/python-sonarcloud.yml
+++ b/workflow-templates/python-sonarcloud.yml
@@ -47,7 +47,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0  # Disable shallow clone for better analysis
 
@@ -89,7 +89,7 @@ jobs:
           fi
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed for PR decoration
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}      # SonarCloud authentication