diff --git a/.github/workflows/code-format.yaml b/.github/workflows/code-format.yaml
index 1595eba..096e626 100644
--- a/.github/workflows/code-format.yaml
+++ b/.github/workflows/code-format.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: python-formatter
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e # 26.5.1
diff --git a/.github/workflows/code-lint.yaml b/.github/workflows/code-lint.yaml
index 07d2b61..6c369d3 100644
--- a/.github/workflows/code-lint.yaml
+++ b/.github/workflows/code-lint.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: python-ruff-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
@@ -26,10 +26,10 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
       - run: pip install -e ".[dev]"
diff --git a/.github/workflows/completions.yaml b/.github/workflows/completions.yaml
index 987c9b5..7cc64c7 100644
--- a/.github/workflows/completions.yaml
+++ b/.github/workflows/completions.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: validate-shell-completions
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/eof-newline.yaml b/.github/workflows/eof-newline.yaml
index 04ab5cb..1559d0c 100644
--- a/.github/workflows/eof-newline.yaml
+++ b/.github/workflows/eof-newline.yaml
@@ -18,7 +18,7 @@ jobs:
     name: eof-newline-lint
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Check final newline
diff --git a/.github/workflows/gh-action-lint.yaml b/.github/workflows/gh-action-lint.yaml
index f67cc1c..8335e4e 100644
--- a/.github/workflows/gh-action-lint.yaml
+++ b/.github/workflows/gh-action-lint.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: gh-action-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/ls-lint.yaml b/.github/workflows/ls-lint.yaml
index 79e3f0d..97088f4 100644
--- a/.github/workflows/ls-lint.yaml
+++ b/.github/workflows/ls-lint.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: ls-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/markdown.yaml b/.github/workflows/markdown.yaml
index 016ca3b..1c91243 100644
--- a/.github/workflows/markdown.yaml
+++ b/.github/workflows/markdown.yaml
@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-24.04
     name: markdown-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25 # v24.0.0
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe # v24.1.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: pymarkdown
diff --git a/.github/workflows/pyproject.yaml b/.github/workflows/pyproject.yaml
index 5f16540..61771b0 100644
--- a/.github/workflows/pyproject.yaml
+++ b/.github/workflows/pyproject.yaml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-24.04
     name: validate-pyproject
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 889c3d4..6ce685e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,12 +15,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
@@ -55,7 +55,7 @@ jobs:
         run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             dist/*.whl
@@ -89,4 +89,4 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
index cc8b96b..9330f26 100644
--- a/.github/workflows/shellcheck.yaml
+++ b/.github/workflows/shellcheck.yaml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: shellcheck-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 6009ace..25b7a34 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -20,12 +20,12 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     name: Test Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/typos.yaml b/.github/workflows/typos.yaml
index 6099e5c..9b3fde9 100644
--- a/.github/workflows/typos.yaml
+++ b/.github/workflows/typos.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: typos-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
diff --git a/.github/workflows/yaml.yaml b/.github/workflows/yaml.yaml
index 3d2ad70..0dcbae0 100644
--- a/.github/workflows/yaml.yaml
+++ b/.github/workflows/yaml.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: yaml-lint
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 146da11..ef02002 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -21,12 +21,12 @@ jobs:
     runs-on: ubuntu-24.04
     name: zizmor
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
         with:
           advanced-security: false
           config: .zizmor.yml