diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a1dd70a1..c1c590a4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -69,13 +69,13 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           config-file: ./.github/codeql/codeql-config.yml
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/flake-test.yml b/.github/workflows/flake-test.yml
index e66fd319..93622dbe 100644
--- a/.github/workflows/flake-test.yml
+++ b/.github/workflows/flake-test.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
         with:
           extra_nix_config: |
             experimental-features = nix-command flakes
diff --git a/.github/workflows/issue-validation.yml b/.github/workflows/issue-validation.yml
index efa9782e..466c27d5 100644
--- a/.github/workflows/issue-validation.yml
+++ b/.github/workflows/issue-validation.yml
@@ -887,7 +887,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
       - name: Run opencode
-        uses: anomalyco/opencode/github@e7a34f09bfd9134dfade5a8ddb843f7030bc9a69 #v2.0.24
+        uses: anomalyco/opencode/github@042d0832f5f3a73eaa039a58a7d565776f6d4290 #v2.0.29
         env:
           ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint-rs.yml b/.github/workflows/lint-rs.yml
index 88d4be7b..3f755ca5 100644
--- a/.github/workflows/lint-rs.yml
+++ b/.github/workflows/lint-rs.yml
@@ -59,7 +59,7 @@ jobs:
           cache: "pnpm"
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f #master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 #master
         with:
           toolchain: stable
           components: rustfmt, clippy
diff --git a/.github/workflows/linux-packages.yml b/.github/workflows/linux-packages.yml
index cf7236ad..db1dd797 100644
--- a/.github/workflows/linux-packages.yml
+++ b/.github/workflows/linux-packages.yml
@@ -73,7 +73,7 @@ jobs:
           cache: "pnpm"
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f #master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 #master
         with:
           toolchain: stable
 
diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml
index 99bfc366..c9d281e7 100644
--- a/.github/workflows/osv.yml
+++ b/.github/workflows/osv.yml
@@ -32,7 +32,7 @@ permissions:
 jobs:
   scan-scheduled:
     name: Scheduled Security Scan
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0
     with:
       scan-args: |-
         -r
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index eec86bae..7c2a73ae 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -112,7 +112,7 @@ jobs:
     name: Security Vulnerability Scan
     needs: changes
     if: needs.changes.outputs.deps == 'true'
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0
     permissions:
       security-events: write
       contents: read
diff --git a/.github/workflows/publish-sidecars.yml b/.github/workflows/publish-sidecars.yml
index c0741141..d33db750 100644
--- a/.github/workflows/publish-sidecars.yml
+++ b/.github/workflows/publish-sidecars.yml
@@ -107,7 +107,7 @@ jobs:
           node-version-file: .node-version
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: stable
           targets: ${{ matrix.target }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 833e7bba..9a5c542e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
   security-scan:
     if: github.repository == 'donutbrowser/donutbrowser'
     name: Security Vulnerability Scan
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0
     with:
       scan-args: |-
         -r
@@ -110,7 +110,7 @@ jobs:
           cache: "pnpm"
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f #master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 #master
         with:
           toolchain: stable
           targets: ${{ matrix.target }}
diff --git a/.github/workflows/rolling-release.yml b/.github/workflows/rolling-release.yml
index 4e5a7ac1..5312d99f 100644
--- a/.github/workflows/rolling-release.yml
+++ b/.github/workflows/rolling-release.yml
@@ -27,7 +27,7 @@ jobs:
   security-scan:
     if: github.repository == 'donutbrowser/donutbrowser'
     name: Security Vulnerability Scan
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0
     with:
       scan-args: |-
         -r
@@ -119,7 +119,7 @@ jobs:
           cache: "pnpm"
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f #master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 #master
         with:
           toolchain: stable
           targets: ${{ matrix.target }}