diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70d81d1..221f4ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -99,7 +99,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/cpp-ci.yml b/.github/workflows/cpp-ci.yml
index 9baef38..b4ffb7f 100644
--- a/.github/workflows/cpp-ci.yml
+++ b/.github/workflows/cpp-ci.yml
@@ -95,7 +95,7 @@ jobs:
 
       - name: Set up ccache
         if: ${{ inputs.enable_ccache }}
-        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03  # v1.2.23
+        uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d  # v1.2.24
         with:
           key: ${{ inputs.ccache_key }}
 
diff --git a/.github/workflows/dependabot-catalog-convergence.yml b/.github/workflows/dependabot-catalog-convergence.yml
index 3043ad5..6141ca1 100644
--- a/.github/workflows/dependabot-catalog-convergence.yml
+++ b/.github/workflows/dependabot-catalog-convergence.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
       - name: Checkout trusted generator
diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml
index 5452e81..097248e 100644
--- a/.github/workflows/docs-quality.yml
+++ b/.github/workflows/docs-quality.yml
@@ -75,7 +75,7 @@ jobs:
 
       - name: Spell check (typos)
         if: ${{ inputs.typos }}
-        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f  # v1.49.0
+        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3  # v1.50.0
         with:
           files: ${{ inputs.typos_files }}
 
diff --git a/.github/workflows/grype-scan.yml b/.github/workflows/grype-scan.yml
index de8382d..dcfd441 100644
--- a/.github/workflows/grype-scan.yml
+++ b/.github/workflows/grype-scan.yml
@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
 
       - name: Grype scan
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439  # v7.4.2
         with:
           path: ${{ inputs.path }}
           fail-build: ${{ inputs.fail_build }}
diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml
index 4d2cd4c..8c04bc7 100644
--- a/.github/workflows/iac-scan.yml
+++ b/.github/workflows/iac-scan.yml
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8  # v12.3119.0
+        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e  # v12.3122.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index 7115752..97b1906 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -39,7 +39,7 @@ jobs:
       issues: write   # file/update the single tracking issue
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/nddev-security-bundle.yml b/.github/workflows/nddev-security-bundle.yml
index f54f155..bc9d407 100644
--- a/.github/workflows/nddev-security-bundle.yml
+++ b/.github/workflows/nddev-security-bundle.yml
@@ -39,7 +39,7 @@ jobs:
       security-events: write  # publish zizmor SARIF to code scanning
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor
diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml
index 6dc7bf0..181033d 100644
--- a/.github/workflows/public-codeql.yml
+++ b/.github/workflows/public-codeql.yml
@@ -79,7 +79,7 @@ jobs:
         language: ${{ fromJSON(inputs.languages) }}
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: ${{ inputs.egress_policy }}
 
@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}
diff --git a/.github/workflows/public-dependency-review.yml b/.github/workflows/public-dependency-review.yml
index c576644..a071914 100644
--- a/.github/workflows/public-dependency-review.yml
+++ b/.github/workflows/public-dependency-review.yml
@@ -36,7 +36,7 @@ jobs:
       pull-requests: write    # post the dependency-review summary comment
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/public-scorecard-analysis.yml b/.github/workflows/public-scorecard-analysis.yml
index c7edc11..fe72bb3 100644
--- a/.github/workflows/public-scorecard-analysis.yml
+++ b/.github/workflows/public-scorecard-analysis.yml
@@ -34,7 +34,7 @@ jobs:
       actions: read           # Scorecard inspects workflow definitions
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/public-scorecard-json.yml b/.github/workflows/public-scorecard-json.yml
index 32950a4..d8ac080 100644
--- a/.github/workflows/public-scorecard-json.yml
+++ b/.github/workflows/public-scorecard-json.yml
@@ -39,7 +39,7 @@ jobs:
       actions: read           # Scorecard inspects workflow definitions
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml
index 8428166..ed8a496 100644
--- a/.github/workflows/public-scorecard.yml
+++ b/.github/workflows/public-scorecard.yml
@@ -51,7 +51,7 @@ jobs:
       actions: read           # Scorecard inspects workflow definitions
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}
diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml
index 2f0e649..a00d815 100644
--- a/.github/workflows/qt-ci.yml
+++ b/.github/workflows/qt-ci.yml
@@ -289,7 +289,7 @@ jobs:
 
       - name: Set up ccache
         if: ${{ inputs.enable_ccache }}
-        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03  # v1.2.23
+        uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d  # v1.2.24
         with:
           key: ${{ inputs.ccache_key }}
 
diff --git a/.github/workflows/r-ci.yml b/.github/workflows/r-ci.yml
index 9d36945..eda79fd 100644
--- a/.github/workflows/r-ci.yml
+++ b/.github/workflows/r-ci.yml
@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up R
-        uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6  # v2.12.1
+        uses: r-lib/actions/setup-r@465b7d8e732ca3921382b1674c59bada9cbf3399  # v2.13.0
         with:
           r-version: ${{ inputs.r_version }}
           use-public-rspm: ${{ inputs.use_public_rspm }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c5c874..a70d1fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
       version: ${{ steps.v.outputs.version }}
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/rust-supply-chain.yml b/.github/workflows/rust-supply-chain.yml
index d6382f9..18c9379 100644
--- a/.github/workflows/rust-supply-chain.yml
+++ b/.github/workflows/rust-supply-chain.yml
@@ -97,7 +97,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install cargo-audit
-        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
+        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -116,7 +116,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install cargo-machete
-        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
+        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete
diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml
index 9635a29..91c6d9b 100644
--- a/.github/workflows/zizmor-sarif.yml
+++ b/.github/workflows/zizmor-sarif.yml
@@ -47,7 +47,7 @@ jobs:
       security-events: write  # publish zizmor SARIF to code scanning
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -82,7 +82,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: zizmor.sarif
           category: zizmor