diff --git a/.github/actions/download-artifacts/action.yml b/.github/actions/download-artifacts/action.yml
index 261fd1626..88bd94662 100644
--- a/.github/actions/download-artifacts/action.yml
+++ b/.github/actions/download-artifacts/action.yml
@@ -10,7 +10,7 @@ runs:
   using: 'composite'
   steps:
     - name: 'Download ${{ inputs.pattern }} artifacts'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         pattern: ${{ inputs.pattern }}
         path: build
diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
index 245569e41..35b249ab9 100644
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -4,7 +4,7 @@ description: 'Setup Node.js and install dependencies'
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v7
       with:
         node-version-file: 'package.json'
         cache: 'npm'
diff --git a/.github/actions/upload-artifact/action.yml b/.github/actions/upload-artifact/action.yml
index 79c89205d..3086a1faa 100644
--- a/.github/actions/upload-artifact/action.yml
+++ b/.github/actions/upload-artifact/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Upload ${{ inputs.artifact-name }} artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ inputs.artifact-name }}
         path: ${{ inputs.path }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 842ac7e42..687f14985 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,7 +20,7 @@ jobs:
     name: 'Bundle single clever.cjs'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: 'Bundle to single clever.cjs'
         run: ./scripts/bundle-cjs.js ${{ inputs.version }} ${{ inputs.isPreview }}
@@ -34,7 +34,7 @@ jobs:
     needs: bundle-cjs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: bundle-cjs }
@@ -56,7 +56,7 @@ jobs:
     needs: bundle-cjs
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: bundle-cjs }
@@ -75,7 +75,7 @@ jobs:
     runs-on: windows-2025
     if: ${{ inputs.include-windows }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: bundle-cjs }
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index de80f4992..4420b2785 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -17,7 +17,7 @@ jobs:
     name: 'Code quality'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
       - uses: ./.github/actions/setup-node
       - name: 'Check commit message format with commitlint'
diff --git a/.github/workflows/preview-cleanup.yml b/.github/workflows/preview-cleanup.yml
index 7d3158e82..4785df4da 100644
--- a/.github/workflows/preview-cleanup.yml
+++ b/.github/workflows/preview-cleanup.yml
@@ -19,11 +19,11 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: 'Delete preview'
         run: ./scripts/preview.js delete ${{ github.event.pull_request.head.ref }}
       - name: 'Remove preview links from PR comment'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@v3.0.5
         with:
           message: 🔎 The preview has been automatically deleted.
diff --git a/.github/workflows/preview-publish.yml b/.github/workflows/preview-publish.yml
index b33b36474..a11d30439 100644
--- a/.github/workflows/preview-publish.yml
+++ b/.github/workflows/preview-publish.yml
@@ -37,7 +37,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-* }
@@ -50,6 +50,6 @@ jobs:
           ./scripts/preview.js pr-comment ${{ github.event.pull_request.head.ref }} >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
       - name: 'Add comment with preview links to PR'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@v3.0.5
         with:
           message: ${{ steps.preview-links.outputs.links }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index bd377e080..15a6764a9 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -13,7 +13,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.CI_TOKEN }}
           fetch-depth: 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94a993551..e1f8021eb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-linux-binary }
@@ -36,7 +36,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-linux-binary }
@@ -57,9 +57,9 @@ jobs:
       # We don't reuse ".github/actions/setup-node"
       # because we don't need the "npm ci" and we want the official https://registry.npmjs.org
       - name: 'Checkout sources'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       - name: 'Setup Node.js'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           # Here we use lts because we need a recent version of npm for the new OIDC publication on npmjs.org
           node-version: 'lts/*'
@@ -73,7 +73,7 @@ jobs:
     needs: [build, package-rpm, package-deb]
     steps:
       - name: 'Checkout sources'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-*-archive }
       - uses: ./.github/actions/download-artifacts
@@ -89,7 +89,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-*-archive }
@@ -105,7 +105,7 @@ jobs:
     needs: package-rpm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: package-rpm }
@@ -121,7 +121,7 @@ jobs:
     needs: package-deb
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: package-deb }
@@ -138,14 +138,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Setup SSH key'
-        uses: webfactory/ssh-agent@v0.9.1
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
       - name: 'Add AUR to known hosts'
         run: |
           mkdir -p ~/.ssh
           ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-linux-archive }
@@ -160,14 +160,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Setup SSH key'
-        uses: webfactory/ssh-agent@v0.9.1
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
       - name: 'Add AUR to known hosts'
         run: |
           mkdir -p ~/.ssh
           ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: 'Publish to AUR'
         run: ./scripts/publish-aur.js ${{ github.ref_name }} nodejs
@@ -180,10 +180,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Setup SSH key'
-        uses: webfactory/ssh-agent@v0.9.1
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: build-macos-archive }
@@ -198,10 +198,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Setup SSH key'
-        uses: webfactory/ssh-agent@v0.9.1
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: 'Publish to Docker Hub (and related GitHub project)'
         run: ./scripts/publish-dockerhub.js ${{ github.ref_name }}
@@ -218,10 +218,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Setup SSH key'
-        uses: webfactory/ssh-agent@v0.9.1
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: 'Publish to GitHub for exherbo'
         run: ./scripts/publish-exherbo.js ${{ github.ref_name }}
@@ -233,7 +233,7 @@ jobs:
     needs: package-rpm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: package-rpm }
@@ -249,7 +249,7 @@ jobs:
     needs: package-deb
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/download-artifacts
         with: { pattern: package-deb }
@@ -265,7 +265,7 @@ jobs:
     needs: publish-cellar-archives
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: 'Sync winget-pkgs fork with upstream'
         shell: bash