diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index ff101b2..90f5263 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -44,7 +44,7 @@ jobs:
           ref: ${{ matrix.commit }}
           persist-credentials: false
       - name: Cache base ref build
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.4
         id: cache
         with:
           key: bin-cache-${{ hashFiles('cpp-linter/src/**', 'Cargo.toml', 'Cargo.lock', 'cpp-linter/Cargo.toml') }}
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 2ed2329..11e4341 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
       - run: rustup update --no-self-update
       - name: Cache .cargo locked resources
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.4
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
@@ -52,7 +52,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Cache .cargo locked resources
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v5.0.4
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
@@ -69,7 +69,7 @@ jobs:
       - name: Build docs
         run: nur docs --build
       - name: Upload docs build as artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           name: cpp-linter-docs
           path: docs/site
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
       - run: rustup update --no-self-update
       - name: Cache .cargo locked resources
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v5.0.4
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-docs-cargo-${{ hashFiles('Cargo.lock') }}
diff --git a/.github/workflows/node-js-packaging.yml b/.github/workflows/node-js-packaging.yml
index 8139c60..17a9657 100644
--- a/.github/workflows/node-js-packaging.yml
+++ b/.github/workflows/node-js-packaging.yml
@@ -89,7 +89,7 @@ jobs:
           rustup update stable --no-self-update
           rustup target add ${{ matrix.settings.target }}
       - name: Cache cargo
-        uses: actions/cache@v5 # zizmor: ignore[cache-poisoning]
+        uses: actions/cache@v5.0.4 # zizmor: ignore[cache-poisoning]
         with:
           path: |
             ~/.cargo/registry/index/
@@ -141,7 +141,7 @@ jobs:
           persist-credentials: false
       - name: Build
         id: build
-        uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
+        uses: cross-platform-actions/action@233156312992f3f169d8d0c633c21d12a5d30455 # v1.0.0
         env:
           DEBUG: napi:*
           RUSTUP_IO_THREADS: 1
diff --git a/.github/workflows/pre-commit-hooks.yml b/.github/workflows/pre-commit-hooks.yml
index 7a5ba06..0da3167 100644
--- a/.github/workflows/pre-commit-hooks.yml
+++ b/.github/workflows/pre-commit-hooks.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
       - run: rustup update
       - name: Cache .cargo locked resources
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.4
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
diff --git a/.github/workflows/python-packaging.yml b/.github/workflows/python-packaging.yml
index 5b25928..18b8b87 100644
--- a/.github/workflows/python-packaging.yml
+++ b/.github/workflows/python-packaging.yml
@@ -83,7 +83,7 @@ jobs:
           fi
 
       - name: Build wheels
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter ${{ steps.is-openssl-vendored.outputs.enabled }}
@@ -126,7 +126,7 @@ jobs:
           python-version: '3.x'
           architecture: ${{ matrix.platform.target }}
       - name: Build wheels
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
@@ -155,7 +155,7 @@ jobs:
         with:
           python-version: '3.x'
       - name: Build wheels
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter --features openssl-vendored
@@ -176,7 +176,7 @@ jobs:
         with:
           python-version: 3.x
       - name: Build sdist
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: sdist
           args: --out dist
@@ -208,7 +208,7 @@ jobs:
         run: pipx run twine check dist/*
       - name: Publish to PyPI
         if: startsWith(github.ref, 'refs/tags/cpp-linter-py/v')
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           skip-existing: true
           # This workflow is registered as a trusted publisher (for test-pypi and pypi).
diff --git a/.github/workflows/run-dev-tests.yml b/.github/workflows/run-dev-tests.yml
index de06bc0..7a558aa 100644
--- a/.github/workflows/run-dev-tests.yml
+++ b/.github/workflows/run-dev-tests.yml
@@ -83,7 +83,7 @@ jobs:
         run: choco install ninja
 
       - name: Cache .cargo locked resources
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.4
         with:
           path: ~/.cargo
           key: ${{ runner.os }}-tests-cargo-${{ hashFiles('Cargo.lock') }}
@@ -94,7 +94,7 @@ jobs:
         run: sudo apt-get update
 
       - name: Install nushell
-        uses: hustcer/setup-nu@920172d92eb04671776f3ba69d605d3b09351c30 # v3.22
+        uses: hustcer/setup-nu@92c296ba1ba2ba04cc948ab64ddefe192dc13f0c # v3.23
 
       - name: Run test suite
         env: