diff --git a/.github/actions/init-pnpm/action.yaml b/.github/actions/init-pnpm/action.yaml
index accf3f6..4933545 100644
--- a/.github/actions/init-pnpm/action.yaml
+++ b/.github/actions/init-pnpm/action.yaml
@@ -9,7 +9,7 @@ runs:
   using: composite
   steps:
     - name: Cache turbo build
-      uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
       with:
         path: .turbo
         key: ${{ runner.os }}-turbo-${{ github.sha }}
diff --git a/.github/workflows/enforce-no-catalog.yaml b/.github/workflows/enforce-no-catalog.yaml
index c81bedb..51e600c 100644
--- a/.github/workflows/enforce-no-catalog.yaml
+++ b/.github/workflows/enforce-no-catalog.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Scan ALL package.json files
         shell: bash
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index a8bd9b9..be88095 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Init nodejs
         uses: ./.github/actions/init-pnpm
@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 240a825..9a6a657 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -35,7 +35,7 @@ jobs:
         # 2. Parse the JSON string (e.g. '["packages/a"]') into a real array for the matrix
         path: ${{ fromJson(needs.release-please.outputs.paths_released) }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Init nodejs
         uses: ./.github/actions/init-pnpm
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 97304ea..7528d09 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # This third party action allows you to download the cache artifact from different workflow runs
       # Note that actions/cache doesn't work well because the cache key would need to be computed from
       # a file within the cache, meaning there would never be any data to restore. With other keys, the
@@ -65,7 +65,7 @@ jobs:
           ls -R $cache_dir
 
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@8cb0d4a6ab7d8bb90460a005f7bd33b80dd07ca8 # v44.2.5
+        uses: renovatebot/github-action@eaf12548c13069dcc28bb75c4ee4610cdbe400c5 # v44.2.6
         with:
           configurationFile: renovate.json
           token: ${{ secrets.GH_PAT }}
diff --git a/.github/workflows/typedoc.yaml b/.github/workflows/typedoc.yaml
index a2fc98a..82cdaad 100644
--- a/.github/workflows/typedoc.yaml
+++ b/.github/workflows/typedoc.yaml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Init nodejs
         uses: ./.github/actions/init-pnpm
       - name: build docs