diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4d1a835..3fd1145 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           # >=22 required: the `test` script uses --test-coverage-exclude,
           # which Node added in 22.5.0. On Node 20 it errors with
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4d97046..cf79dc6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,12 +19,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v3
+      - uses: actions/checkout@v6
+      - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/autobuild@v3
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/autobuild@v4
+      - uses: github/codeql-action/analyze@v4
         with:
           category: "/language:javascript-typescript"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 03939a2..050e119 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,18 +14,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           # >=22 for --test-coverage-exclude support (added 22.5.0).
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm test -- --coverage
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         if: always()
         with:
           fail_ci_if_error: false
@@ -58,7 +58,7 @@ jobs:
             dist-test/test/client-unit.test.js \
             dist-test/test/index-unit.test.js \
             dist-test/test/tools-unit.test.js
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index 7dfb03c..6f3b4c3 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: npm
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 5e46750..2c07a4d 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 89d7540..ecb52e6 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   scan:
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.1
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c827314..e5c4525 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,9 +19,9 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index d25ee6b..2fe6130 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v4
-      - uses: crate-ci/typos@v1.30.0
+      - uses: actions/checkout@v6
+      - uses: crate-ci/typos@v1.46.2
         continue-on-error: true  # warn-only — surface findings without blocking CI