diff --git a/.github/workflows/codacy-ci.yml b/.github/workflows/codacy-ci.yml
index 01fa06c..2c6249d 100644
--- a/.github/workflows/codacy-ci.yml
+++ b/.github/workflows/codacy-ci.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
       - name: Run Codacy Analysis CLI
         uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # v4.4.7
         with:
diff --git a/.github/workflows/codeql-ci.yml b/.github/workflows/codeql-ci.yml
index 9799294..3a8da9f 100644
--- a/.github/workflows/codeql-ci.yml
+++ b/.github/workflows/codeql-ci.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Initialize CodeQL
       uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699  # v3
       with:
diff --git a/.github/workflows/conventional-commits-ci.yml b/.github/workflows/conventional-commits-ci.yml
index d277065..716644d 100644
--- a/.github/workflows/conventional-commits-ci.yml
+++ b/.github/workflows/conventional-commits-ci.yml
@@ -25,7 +25,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: PR Conventional Commit Validation
         uses: ytanikin/PRConventionalCommits@b7be9213c4fa33260646db6c9b905332dc90b310  # 1.1.0
diff --git a/.github/workflows/dco-check-ci.yml b/.github/workflows/dco-check-ci.yml
index c6c4649..0ac0f35 100644
--- a/.github/workflows/dco-check-ci.yml
+++ b/.github/workflows/dco-check-ci.yml
@@ -23,7 +23,7 @@ jobs:
       github.actor != 'github-actions[bot]'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/dependency-review-ci.yml b/.github/workflows/dependency-review-ci.yml
index eca28ec..9ca1a38 100644
--- a/.github/workflows/dependency-review-ci.yml
+++ b/.github/workflows/dependency-review-ci.yml
@@ -20,6 +20,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48  # v4.9.0
diff --git a/.github/workflows/dockerfile-linter-ci.yml b/.github/workflows/dockerfile-linter-ci.yml
index f71a839..961d50c 100644
--- a/.github/workflows/dockerfile-linter-ci.yml
+++ b/.github/workflows/dockerfile-linter-ci.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Run hadolint
         id: hadolint
         if: hashFiles('Dockerfile') != ''
diff --git a/.github/workflows/encoding-check-ci.yml b/.github/workflows/encoding-check-ci.yml
index 29ffce1..0dbb3f4 100644
--- a/.github/workflows/encoding-check-ci.yml
+++ b/.github/workflows/encoding-check-ci.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/gpg-verify-ci.yml b/.github/workflows/gpg-verify-ci.yml
index 464fcb7..3c8685a 100644
--- a/.github/workflows/gpg-verify-ci.yml
+++ b/.github/workflows/gpg-verify-ci.yml
@@ -23,7 +23,7 @@ jobs:
       github.actor != 'github-actions[bot]'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/njsscan-ci.yml b/.github/workflows/njsscan-ci.yml
index 44733a0..a1997db 100644
--- a/.github/workflows/njsscan-ci.yml
+++ b/.github/workflows/njsscan-ci.yml
@@ -26,7 +26,7 @@ jobs:
     name: njsscan code scanning
     steps:
     - name: Checkout the code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: nodejsscan scan
       id: njsscan
       continue-on-error: true
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 4e4454e..b5dcece 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     name: run build
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Use Node.js 22
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
         with:
@@ -48,7 +48,7 @@ jobs:
     name: check style
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Use Node.js 22
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
         with:
@@ -73,7 +73,7 @@ jobs:
     name: check tests
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Use Node.js 22
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
         with:
diff --git a/.github/workflows/package-rule-rc.yml b/.github/workflows/package-rule-rc.yml
index 6cdbaeb..859c0a8 100644
--- a/.github/workflows/package-rule-rc.yml
+++ b/.github/workflows/package-rule-rc.yml
@@ -80,7 +80,7 @@ jobs:
 
     steps:
       - name: Checkout rule repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
diff --git a/.github/workflows/package-rule.yml b/.github/workflows/package-rule.yml
index 3006ffb..9880632 100644
--- a/.github/workflows/package-rule.yml
+++ b/.github/workflows/package-rule.yml
@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: Checkout rule repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7dbc429..4055199 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -86,7 +86,7 @@ jobs:
           fi
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           token: ${{ secrets.GH_TOKEN_LIB }}
 
diff --git a/.github/workflows/release-orchestrator.yml b/.github/workflows/release-orchestrator.yml
index 40440ef..e131637 100644
--- a/.github/workflows/release-orchestrator.yml
+++ b/.github/workflows/release-orchestrator.yml
@@ -58,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout workflows repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Resolve inputs
         id: cfg
diff --git a/.github/workflows/release-train.yml b/.github/workflows/release-train.yml
index 7ae7fd2..27cb9d6 100644
--- a/.github/workflows/release-train.yml
+++ b/.github/workflows/release-train.yml
@@ -124,7 +124,7 @@ jobs:
           fi
 
       - name: Checkout source branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.source_branch || vars.SOURCE_BRANCH || 'dev' }}
           token: ${{ secrets.GH_TOKEN_RELEASE || secrets.GH_TOKEN_LIB }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6648334..cd38e1c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -113,7 +113,7 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.release_branch || vars.TARGET_BRANCH || github.event.client_payload.release_branch || 'main' }}
           fetch-depth: 0
diff --git a/.github/workflows/sbom-ci.yml b/.github/workflows/sbom-ci.yml
index 4498dba..aa49ee5 100644
--- a/.github/workflows/sbom-ci.yml
+++ b/.github/workflows/sbom-ci.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Build the Docker image
       if: hashFiles('Dockerfile') != ''
       env:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4d11cdb..c88dee2 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/sync-workflows.yml b/.github/workflows/sync-workflows.yml
index 57f631d..6773dad 100644
--- a/.github/workflows/sync-workflows.yml
+++ b/.github/workflows/sync-workflows.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest  # Use the latest Ubuntu runner for the job
     steps:
       - name: Checkout Central Workflows Repo  # Step to checkout the repository containing the central workflows
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 09a26b3..7957776 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Reject prerelease version on main PR
         run: |