diff --git a/.github/workflows/__main-ci.yml b/.github/workflows/__main-ci.yml
index 4ee4611..bcbf2cb 100644
--- a/.github/workflows/__main-ci.yml
+++ b/.github/workflows/__main-ci.yml
@@ -32,7 +32,7 @@ jobs:
   release:
     needs: ci
     if: github.event_name != 'schedule'
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@84e8ace407055e7a40ba6670a8c697e1ce2dfafa # 0.20.1
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@5ff7d4c3910971ed53834becd5967271b4e228cf # 0.21.1
     permissions:
       contents: read
     with:
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 24b4bc1..9b0f056 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -104,7 +104,7 @@ jobs:
         with:
           working-directory: ${{ steps.has-prettier-plugins.outputs.package-json-dir }}
 
-      - uses: super-linter/super-linter/slim@5119dcd8011e92182ce8219d9e9efc82f16fddb6 # v8.0.0
+      - uses: super-linter/super-linter/slim@12562e48d7059cf666c43a4ecb0d3b5a2b31bd9e # v8.4.0
         env:
           VALIDATE_ALL_CODEBASE: ${{ inputs.lint-all }}
           LOG_LEVEL: WARN
@@ -129,11 +129,11 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
+      - uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           languages: ${{ matrix.language }}
 
-      - uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
+      - uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           category: "/language:${{matrix.language}}"
 
diff --git a/.github/workflows/need-fix-to-issue.yml b/.github/workflows/need-fix-to-issue.yml
index 20cf870..a47d2d6 100644
--- a/.github/workflows/need-fix-to-issue.yml
+++ b/.github/workflows/need-fix-to-issue.yml
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
 
       - name: "TODO to Issue"
-        uses: "alstr/todo-to-issue-action@c45b007d85c8edf3365b139a9d4c65793e7c674f" # v5.1.13
+        uses: "alstr/todo-to-issue-action@64aca8fda7023259aada83ba44ad988c4c443657" # v5.1.14
         with:
           IDENTIFIERS: |
             [