diff --git a/.github/labeler.yml b/.github/labeler.yml
index 21890ac..f0974cb 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,12 +1,29 @@
 config:
-  - ./*
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/**/*"
+          - "*.json"
+          - "*.yml"
+          - "*.yaml"
+          - "*.js"
+          - "*.cjs"
 tooling:
-  - tooling/**/*.*
+  - changed-files:
+      - any-glob-to-any-file: "tooling/**/*.*"
 assets:
-  - static/**/*.*
+  - changed-files:
+      - any-glob-to-any-file: "static/**/*.*"
 tests:
-  - any: ["src/**/*.spec.js", "cypress/**/*"]
+  - changed-files:
+      - any-glob-to-any-file:
+          - "src/**/*.spec.js"
+          - "src/**/*.spec.ts"
+          - "cypress/**/*"
 package:
-  - any: ["package.json", "package-lock.json"]
+  - changed-files:
+      - any-glob-to-any-file:
+          - "package.json"
+          - "package-lock.json"
 source:
-  - src/**/*
+  - changed-files:
+      - any-glob-to-any-file: "src/**/*"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f86e5d2..edd7fea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,29 +6,19 @@ on:
 jobs:
   release:
     name: Build and publish
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.3.4
+        uses: actions/checkout@v6
         with:
-          ref: ${{ github.head_ref }}
-          token: ${{ secrets.GH_PAT }}
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GH_PAT || github.token }}
       - name: Setup Node.js
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@v6
         with:
           node-version: 14
-      - name: Cache node modules
-        uses: actions/cache@v2
-        env:
-          cache-name: cache-node-modules
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-
-            ${{ runner.os }}-build-
-            ${{ runner.os }}-
+          cache: npm
       - name: Install dependencies
         run: npm ci
       - name: Build TypeScript
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 8d10a0e..7abfe1c 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -2,17 +2,23 @@ name: Pull Request Labeler
 on:
   - pull_request
   - pull_request_review
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
       - name: Label all PRs
-        uses: actions/labeler@master
+        uses: actions/labeler@v6
         with:
-          repo-token: "${{ secrets.GH_PAT }}"
+          repo-token: "${{ secrets.GH_PAT || github.token }}"
       - name: Label approved PRs
+        if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
         uses: koj-co/label-approved-action@master
         with:
           labels: "merge"
         env:
-          GITHUB_TOKEN: "${{ secrets.GH_PAT }}"
+          GITHUB_TOKEN: "${{ secrets.GH_PAT || github.token }}"
diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml
index efc18b1..570be3e 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/node.yml
@@ -6,26 +6,16 @@ on:
 jobs:
   release:
     name: Build and test
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.3.4
+        uses: actions/checkout@v6
       - name: Setup Node.js
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@v6
         with:
           node-version: 12
-      - name: Cache node modules
-        uses: actions/cache@v2
-        env:
-          cache-name: cache-node-modules
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-
-            ${{ runner.os }}-build-
-            ${{ runner.os }}-
+          cache: npm
       - name: Install dependencies
         run: npm ci
       - name: Build TypeScript
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index b57c7ad..060ba5a 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -4,13 +4,18 @@ on:
     branches-ignore:
       - master
       - production
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   auto-pull-request:
     name: PullRequestAction
     runs-on: ubuntu-latest
     steps:
       - name: Generate branch name
-        uses: actions/github-script@v3
+        uses: actions/github-script@v8
         id: set-branch-name
         with:
           script: |
@@ -32,9 +37,11 @@ jobs:
             )}`;
           result-encoding: string
       - name: Set branch name
-        run: echo "PULL_REQUEST_TITLE=${{steps.set-branch-name.outputs.result}}" >> $GITHUB_ENV
+        env:
+          PULL_REQUEST_TITLE: ${{ steps.set-branch-name.outputs.result }}
+        run: printf 'PULL_REQUEST_TITLE=%s\n' "$PULL_REQUEST_TITLE" >> "$GITHUB_ENV"
       - name: Generate PR body
-        uses: actions/github-script@v3
+        uses: actions/github-script@v8
         id: set-pr-body
         with:
           script: |
@@ -45,29 +52,75 @@ jobs:
             }.`;
           result-encoding: string
       - name: Set PR body
-        run: echo "PULL_REQUEST_BODY=${{steps.set-pr-body.outputs.result}}" >> $GITHUB_ENV
+        env:
+          PULL_REQUEST_BODY: ${{ steps.set-pr-body.outputs.result }}
+        run: printf 'PULL_REQUEST_BODY=%s\n' "$PULL_REQUEST_BODY" >> "$GITHUB_ENV"
       - name: Generate PR draft
-        uses: actions/github-script@v3
+        uses: actions/github-script@v8
         id: set-pr-draft
         with:
           script: |
             return !context.payload.ref.startsWith("refs/heads/hotfix");
       - name: Set PR draft
-        run: echo "PULL_REQUEST_DRAFT=${{steps.set-pr-draft.outputs.result}}" >> $GITHUB_ENV
+        env:
+          PULL_REQUEST_DRAFT: ${{ steps.set-pr-draft.outputs.result }}
+        run: printf 'PULL_REQUEST_DRAFT=%s\n' "$PULL_REQUEST_DRAFT" >> "$GITHUB_ENV"
       - name: Determine whether to merge
-        uses: actions/github-script@v3
+        uses: actions/github-script@v8
         id: should-pr
         with:
-          github-token: ${{ secrets.GH_PAT }}
+          github-token: ${{ secrets.GH_PAT || github.token }}
           script: |
-            return
+            return (
               context.payload.ref.startsWith("refs/heads/feature") ||
               context.payload.ref.startsWith("refs/heads/hotfix") ||
-              context.payload.ref.startsWith("refs/heads/bug");
-      - name: pull-request-action
-        uses: vsoch/pull-request-action@1.0.15
-        if: always() && steps.should-pr.outputs.result
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
-          PULL_REQUEST_BRANCH: "master"
-          PULL_REQUEST_REVIEWERS: "AnandChowdhary"
+              context.payload.ref.startsWith("refs/heads/bug")
+            );
+      - name: Create pull request
+        uses: actions/github-script@v8
+        if: steps.should-pr.outputs.result == 'true'
+        with:
+          github-token: ${{ secrets.GH_PAT || github.token }}
+          script: |
+            const branch = context.payload.ref.replace("refs/heads/", "");
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const title = process.env.PULL_REQUEST_TITLE;
+            const body = process.env.PULL_REQUEST_BODY;
+            const draft = process.env.PULL_REQUEST_DRAFT === "true";
+
+            const { data: existingPulls } = await github.rest.pulls.list({
+              owner,
+              repo,
+              state: "open",
+              head: `${owner}:${branch}`,
+              base: "master",
+            });
+
+            if (existingPulls.length > 0) {
+              core.info(`Pull request already exists: ${existingPulls[0].html_url}`);
+              return existingPulls[0].html_url;
+            }
+
+            const { data: pull } = await github.rest.pulls.create({
+              owner,
+              repo,
+              title,
+              body,
+              head: branch,
+              base: "master",
+              draft,
+            });
+
+            try {
+              await github.rest.pulls.requestReviewers({
+                owner,
+                repo,
+                pull_number: pull.number,
+                reviewers: ["AnandChowdhary"],
+              });
+            } catch (error) {
+              core.warning(`Could not request reviewer: ${error.message}`);
+            }
+
+            return pull.html_url;
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index dcd6e8b..9ab3882 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -2,13 +2,18 @@ name: "Stale Issues CI"
 on:
   schedule:
   - cron: "0 0 * * *"
+
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v3
+    - uses: actions/stale@v10
       with:
-        repo-token: ${{ secrets.GH_PAT }}
+        repo-token: ${{ secrets.GH_PAT || github.token }}
         stale-issue-message: "⚠️ This issue has not seen any activity in the past 2 months so I'm marking it as stale. I'll close it if it doesn't see any activity in the coming week."
         stale-pr-message: "⚠️ This PR has not seen any activity in the past 2 months so I'm marking it as stale. I'll close it if it doesn't see any activity in the coming week."
         days-before-stale: 60