diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46f3565..358b427 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -43,7 +43,7 @@ jobs:
   #   permissions:
   #     contents: read
   #   steps:
-  #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+  #     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   #     - name: Setup Python
   #       uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f392ef88b # v5.0.0
   #       with:
@@ -59,7 +59,7 @@ jobs:
       contents: read
     # needs: validate-protocol  # Disabled temporarily
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@c5c17d5275cb92490db7b58933b1ba3e6c507da6 # stable
@@ -71,7 +71,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y libglib2.0-dev libgtk-3-dev libwebkit2gtk-4.1-dev libjavascriptcoregtk-4.1-dev pkg-config
 
       - name: Cache Cargo
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: |
             ~/.cargo/registry
@@ -100,7 +100,7 @@ jobs:
       contents: read
     needs: test-rust
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -128,10 +128,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "20"
           cache: "npm"
@@ -150,10 +150,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "20"
           cache: "npm"
@@ -175,7 +175,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -183,7 +183,7 @@ jobs:
           targets: aarch64-apple-darwin, x86_64-apple-darwin
 
       - name: Setup Node
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "20"
           cache: "npm"
@@ -211,7 +211,7 @@ jobs:
         run: npm run tauri:build -- --target universal-apple-darwin
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: hqe-workbench-macos
           path: |
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e914750..20f71d5 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -27,7 +27,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Python
         uses: actions/setup-python@v5
@@ -42,7 +42,7 @@ jobs:
         run: mkdocs build --strict
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site/
 
@@ -56,12 +56,12 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
 
   link-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check Markdown Links
         uses: lycheeverse/lychee-action@v2
diff --git a/.github/workflows/qwen-dispatch.yml b/.github/workflows/qwen-dispatch.yml
index 34be089..788f795 100644
--- a/.github/workflows/qwen-dispatch.yml
+++ b/.github/workflows/qwen-dispatch.yml
@@ -73,7 +73,7 @@ jobs:
         id: "mint_identity_token"
         if: |-
           vars.APP_ID
-        uses: "actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf" # ratchet:actions/create-github-app-token@v2
+        uses: "actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3" # ratchet:actions/create-github-app-token@v2
         with:
           app-id: "${{ vars.APP_ID }}"
           private-key: "${{ secrets.APP_PRIVATE_KEY }}"
@@ -83,7 +83,7 @@ jobs:
 
       - name: "Extract command"
         id: "extract_command"
-        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v7
+        uses: "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3" # ratchet:actions/github-script@v7
         env:
           EVENT_TYPE: "${{ github.event_name }}.${{ github.event.action }}"
           REQUEST: "${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}"
@@ -183,7 +183,7 @@ jobs:
         id: "mint_identity_token"
         if: |-
           vars.APP_ID
-        uses: "actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf" # ratchet:actions/create-github-app-token@v2
+        uses: "actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3" # ratchet:actions/create-github-app-token@v2
         with:
           app-id: "${{ vars.APP_ID }}"
           private-key: "${{ secrets.APP_PRIVATE_KEY }}"
diff --git a/.github/workflows/qwen-invoke.yml b/.github/workflows/qwen-invoke.yml
index 745d886..88fd318 100644
--- a/.github/workflows/qwen-invoke.yml
+++ b/.github/workflows/qwen-invoke.yml
@@ -29,7 +29,7 @@ jobs:
         id: "mint_identity_token"
         if: |-
           vars.APP_ID
-        uses: "actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf" # ratchet:actions/create-github-app-token@v2
+        uses: "actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3" # ratchet:actions/create-github-app-token@v2
         with:
           app-id: "${{ vars.APP_ID }}"
           private-key: "${{ secrets.APP_PRIVATE_KEY }}"
diff --git a/.github/workflows/qwen-review.yml b/.github/workflows/qwen-review.yml
index c00babb..f87db3a 100644
--- a/.github/workflows/qwen-review.yml
+++ b/.github/workflows/qwen-review.yml
@@ -30,7 +30,7 @@ jobs:
         id: "mint_identity_token"
         if: |-
           vars.APP_ID
-        uses: "actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf" # ratchet:actions/create-github-app-token@v2
+        uses: "actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3" # ratchet:actions/create-github-app-token@v2
         with:
           app-id: "${{ vars.APP_ID }}"
           private-key: "${{ secrets.APP_PRIVATE_KEY }}"
@@ -39,7 +39,7 @@ jobs:
           permission-pull-requests: "write"
 
       - name: "Checkout repository"
-        uses: "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" # ratchet:actions/checkout@v5
+        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # ratchet:actions/checkout@v5
 
       - name: "Run Qwen Code pull request review"
         uses: "QwenLM/qwen-code-action@v1" # ratchet:exclude
diff --git a/.github/workflows/qwen-scheduled-triage.yml b/.github/workflows/qwen-scheduled-triage.yml
index 7051821..843df6f 100644
--- a/.github/workflows/qwen-scheduled-triage.yml
+++ b/.github/workflows/qwen-scheduled-triage.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - name: "Get repository labels"
         id: "get_labels"
-        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
+        uses: "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3" # ratchet:actions/github-script@v9.0.0
         with:
           # NOTE: we intentionally do not use the minted token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -141,7 +141,7 @@ jobs:
         id: "mint_identity_token"
         if: |-
           vars.APP_ID
-        uses: "actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf" # ratchet:actions/create-github-app-token@v2
+        uses: "actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3" # ratchet:actions/create-github-app-token@v2
         with:
           app-id: "${{ vars.APP_ID }}"
           private-key: "${{ secrets.APP_PRIVATE_KEY }}"
@@ -153,7 +153,7 @@ jobs:
         env:
           AVAILABLE_LABELS: "${{ needs.triage.outputs.available_labels }}"
           TRIAGED_ISSUES: "${{ needs.triage.outputs.triaged_issues }}"
-        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
+        uses: "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3" # ratchet:actions/github-script@v9.0.0
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.
diff --git a/.github/workflows/qwen-triage.yml b/.github/workflows/qwen-triage.yml
index 6e8133f..6bc940d 100644
--- a/.github/workflows/qwen-triage.yml
+++ b/.github/workflows/qwen-triage.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: "Get repository labels"
         id: "get_labels"
-        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
+        uses: "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3" # ratchet:actions/github-script@v9.0.0
         with:
           # NOTE: we intentionally do not use the given token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -106,7 +106,7 @@ jobs:
         id: "mint_identity_token"
         if: |-
           vars.APP_ID
-        uses: "actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf" # ratchet:actions/create-github-app-token@v2
+        uses: "actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3" # ratchet:actions/create-github-app-token@v2
         with:
           app-id: "${{ vars.APP_ID }}"
           private-key: "${{ secrets.APP_PRIVATE_KEY }}"
@@ -119,7 +119,7 @@ jobs:
           ISSUE_NUMBER: "${{ github.event.issue.number }}"
           AVAILABLE_LABELS: "${{ needs.triage.outputs.available_labels }}"
           SELECTED_LABELS: "${{ needs.triage.outputs.selected_labels }}"
-        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
+        uses: "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3" # ratchet:actions/github-script@v9.0.0
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 06f7e55..0948c15 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
   build-macos:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -24,7 +24,7 @@ jobs:
           targets: aarch64-apple-darwin, x86_64-apple-darwin
 
       - name: Setup Node
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "20"
           cache: "npm"
@@ -62,7 +62,7 @@ jobs:
           tar czf hqe-macos-universal.tar.gz hqe
 
       - name: Upload macOS artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: macos-release
           path: |
@@ -72,7 +72,7 @@ jobs:
   build-linux:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -91,7 +91,7 @@ jobs:
           tar czf hqe-linux-x86_64.tar.gz hqe
 
       - name: Upload Linux artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: linux-release
           path: target/release/hqe-linux-x86_64.tar.gz
@@ -100,10 +100,10 @@ jobs:
     needs: [build-macos, build-linux]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Download all artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: artifacts
 
@@ -129,7 +129,7 @@ jobs:
           awk "/^## \[$VERSION\]/ {flag=1; next} /^## \[/ {flag=0} flag" CHANGELOG.md > RELEASE_NOTES.md || echo "See CHANGELOG.md for release notes." > RELEASE_NOTES.md
 
       - name: Create Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           name: Release ${{ steps.changelog.outputs.version }}
           body_path: RELEASE_NOTES.md
@@ -145,7 +145,7 @@ jobs:
     if: "!contains(github.ref_name, 'alpha') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'rc')"
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 2ea68e6..1db2b66 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -18,7 +18,7 @@ jobs:
         name: Rust Security Audit
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - uses: dtolnay/rust-toolchain@stable
               with:
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index fcbe45a..8ed62cf 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           # Issue Configuration
           days-before-issue-stale: 60