diff --git a/.github/workflows/copy-listing-from-r2.yaml b/.github/workflows/copy-listing-from-r2.yaml
index 279b0e44..095a1515 100644
--- a/.github/workflows/copy-listing-from-r2.yaml
+++ b/.github/workflows/copy-listing-from-r2.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
diff --git a/.github/workflows/daily-data-sync.yaml b/.github/workflows/daily-data-sync.yaml
index f6897c8b..a9012f95 100644
--- a/.github/workflows/daily-data-sync.yaml
+++ b/.github/workflows/daily-data-sync.yaml
@@ -17,7 +17,7 @@ jobs:
     outputs:
       providers: ${{ steps.read-providers.outputs.providers }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -49,7 +49,7 @@ jobs:
       fail-fast: false
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -95,7 +95,7 @@ jobs:
       contents: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
diff --git a/.github/workflows/daily-db-publisher-r2.yaml b/.github/workflows/daily-db-publisher-r2.yaml
index 65b9a53f..254ae162 100644
--- a/.github/workflows/daily-db-publisher-r2.yaml
+++ b/.github/workflows/daily-db-publisher-r2.yaml
@@ -40,7 +40,7 @@ jobs:
       packages: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Read supported schema versions
         id: read-schema-versions
@@ -65,7 +65,7 @@ jobs:
       packages: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           submodules: true
 
@@ -119,7 +119,7 @@ jobs:
     runs-on: ubuntu-22.04-4core-16gb
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           submodules: true
 
diff --git a/.github/workflows/daily-db-publisher.yaml b/.github/workflows/daily-db-publisher.yaml
index 899bca74..c169c160 100644
--- a/.github/workflows/daily-db-publisher.yaml
+++ b/.github/workflows/daily-db-publisher.yaml
@@ -40,7 +40,7 @@ jobs:
       packages: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Read supported schema versions
         id: read-schema-versions
@@ -65,7 +65,7 @@ jobs:
       packages: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           submodules: true
 
@@ -119,7 +119,7 @@ jobs:
   #   runs-on: ubuntu-22.04-4core-16gb
   #   steps:
 
-  #     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+  #     - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
   #       with:
   #         submodules: true
 
@@ -151,7 +151,7 @@ jobs:
     needs: generate-and-publish-dbs
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
         if: failure() && env.SLACK_NOTIFICATIONS == 'true'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fe9ee315..402d59a2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -12,7 +12,7 @@ jobs:
     environment: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Check if tag already exists
         # note: this will fail if the tag already exists
@@ -81,7 +81,7 @@ jobs:
       schema-versions: ${{ steps.read-schema-versions.outputs.schema-versions }}
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Read supported schema versions
         id: read-schema-versions
@@ -122,7 +122,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/staging-db-publisher.yaml b/.github/workflows/staging-db-publisher.yaml
index 0e022ac6..32fafff7 100644
--- a/.github/workflows/staging-db-publisher.yaml
+++ b/.github/workflows/staging-db-publisher.yaml
@@ -53,7 +53,7 @@ jobs:
       contents: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           submodules: true
 
diff --git a/.github/workflows/update-bootstrap-tools.yml b/.github/workflows/update-bootstrap-tools.yml
index a026aa59..c68335fb 100644
--- a/.github/workflows/update-bootstrap-tools.yml
+++ b/.github/workflows/update-bootstrap-tools.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/grype-db' # only run for main repo
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 #v5.0.2
         with:
diff --git a/.github/workflows/update-grype-release.yml b/.github/workflows/update-grype-release.yml
index e90c82d8..72e26898 100644
--- a/.github/workflows/update-grype-release.yml
+++ b/.github/workflows/update-grype-release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/grype-db' # only run for main repo
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 #v5.0.2
         with:
diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml
index b8a94f32..9369e433 100644
--- a/.github/workflows/validations.yaml
+++ b/.github/workflows/validations.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -64,7 +64,7 @@ jobs:
     name: "Build snapshot artifacts"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -96,7 +96,7 @@ jobs:
       schema-versions: ${{ steps.read-schema-versions.outputs.schema-versions }}
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Read supported schema versions
         id: read-schema-versions
@@ -118,7 +118,7 @@ jobs:
       packages: read
     steps:
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           submodules: true
 
@@ -144,7 +144,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -171,7 +171,7 @@ jobs:
     name: "CLI tests (Python)"
     runs-on: ubuntu-22.04-4core-16gb
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
         with:
           submodules: true