diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 0cda7b7..43f1c8c 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -159,7 +159,7 @@ jobs:
         run: gh pr review --approve "$PR_URL"
       -
         name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ env.GH_TOKEN }}
diff --git a/.github/workflows/bump-release-monorepo.yml b/.github/workflows/bump-release-monorepo.yml
index 80f1a49..cb41d85 100644
--- a/.github/workflows/bump-release-monorepo.yml
+++ b/.github/workflows/bump-release-monorepo.yml
@@ -136,7 +136,7 @@ jobs:
       -
         name: Detect go mono-repo
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
 
   bump-release-single:
     name: Bump release (single module)
@@ -195,7 +195,7 @@ jobs:
       -
         name: Determine next tag
         id: bump-release
-        uses: go-openapi/gh-actions/ci-jobs/next-tag@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/next-tag@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         with:
           bump-patch: ${{ steps.bump-check.outputs.bump-patch }}
           bump-minor: ${{ steps.bump-check.outputs.bump-minor }}
@@ -307,7 +307,7 @@ jobs:
       -
         name: Configure bot credentials
         if: ${{ inputs.enable-tag-signing == 'true' }}
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         # This is using the GPG signature of bot-go-openapi.
         #
         # For go-openapi repos (using secrets: inherit):
diff --git a/.github/workflows/bump-release.yml b/.github/workflows/bump-release.yml
index 6cfe382..51849ba 100644
--- a/.github/workflows/bump-release.yml
+++ b/.github/workflows/bump-release.yml
@@ -114,7 +114,7 @@ jobs:
       -
         name: Determine next tag
         id: bump-release
-        uses: go-openapi/gh-actions/ci-jobs/next-tag@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/next-tag@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         with:
           bump-patch: ${{ steps.bump-check.outputs.bump-patch }}
           bump-minor: ${{ steps.bump-check.outputs.bump-minor }}
@@ -122,7 +122,7 @@ jobs:
       -
         name: Configure bot credentials
         if: ${{ inputs.enable-tag-signing == 'true' }}
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         # This is using the GPG signature of bot-go-openapi.
         #
         # For go-openapi repos (using secrets: inherit):
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7696f6c..5c35fcb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,9 +26,9 @@ jobs:
     -
       # Initializes the CodeQL tools for scanning.
       name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
       with:
         languages: ${{ matrix.language }}
     -
       name: Analyze ${{ matrix.language }}
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
diff --git a/.github/workflows/collect-reports.yml b/.github/workflows/collect-reports.yml
index 4d3b666..993735b 100644
--- a/.github/workflows/collect-reports.yml
+++ b/.github/workflows/collect-reports.yml
@@ -48,7 +48,7 @@ jobs:
           path: reports/
       -
         name: Install go-junit-report
-        uses: go-openapi/gh-actions/install/go-junit-report@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/install/go-junit-report@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: Convert test reports to a merged JUnit XML
         # NOTE: codecov test reports only support JUnit format at this moment. See https://docs.codecov.com/docs/test-analytics.
@@ -73,7 +73,7 @@ jobs:
           verbose: true
       -
         name: Install go-ctrf-json-reporter
-        uses: go-openapi/gh-actions/install/go-ctrf-json-reporter@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/install/go-ctrf-json-reporter@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: Convert test reports to CTRF JSON
         # description: |
@@ -127,7 +127,7 @@ jobs:
       # They also handle the storage of past test reports, so as to assess flaky tests.
       -
         name: Publish Test Summary Results
-        uses: ctrf-io/github-test-reporter@9ad85b91f851ff39e7da5f82981d30b9e637e163 # v1.1.1
+        uses: ctrf-io/github-test-reporter@7974087018bf4857cf5a9d78723e152038c3fa31 # v1.3.0
         with:
           report-path: 'reports/ctrf_report_*.json'
           use-suite-name: true
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 8c82e42..71f261d 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -118,7 +118,7 @@ jobs:
             } > "${file}"
           done
       - name: Configure bot credentials
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         id: bot-credentials
         # For go-openapi repos (using secrets: inherit):
         #   Falls back to: CI_BOT_APP_ID, CI_BOT_APP_PRIVATE_KEY, CI_BOT_GPG_PRIVATE_KEY, etc.
@@ -183,7 +183,7 @@ jobs:
       - name: Auto-approve PR
         run: gh pr review --approve "$PR_URL"
       - name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/go-test-monorepo.yml b/.github/workflows/go-test-monorepo.yml
index 8df264c..3a45820 100644
--- a/.github/workflows/go-test-monorepo.yml
+++ b/.github/workflows/go-test-monorepo.yml
@@ -96,7 +96,7 @@ jobs:
       -
         name: Detect go mono-repo
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: golangci-lint [monorepo]
         # golangci-action v9.1+ has an experimental built-in mono repo detection setup.
@@ -190,10 +190,10 @@ jobs:
       -
         name: Detect go version capabilities
         id: detect-go-version
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-version@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-version@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: Install gotestsum
-        uses: go-openapi/gh-actions/install/gotestsum@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/install/gotestsum@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: Ensure TMP is created on windows runners
         # On windows, some tests require testing.TempDir to reside on the same drive as the code.
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index 744eb1b..8293298 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -137,7 +137,7 @@ jobs:
           cache: true
       -
         name: Install gotestsum
-        uses: go-openapi/gh-actions/install/gotestsum@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/install/gotestsum@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: Ensure TMP is created on windows runners
         # On windows, some tests require testing.TempDir to reside on the same drive as the code.
diff --git a/.github/workflows/prepare-release-monorepo.yml b/.github/workflows/prepare-release-monorepo.yml
index 0f6d1c4..4ab5502 100644
--- a/.github/workflows/prepare-release-monorepo.yml
+++ b/.github/workflows/prepare-release-monorepo.yml
@@ -108,7 +108,7 @@ jobs:
           cache-dependency-path: "**/go.sum"
       - name: Detect go mono-repo
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       - name: Update go.mod files for new release
         env:
           TARGET_TAG: ${{ inputs.target-tag }}
@@ -295,7 +295,7 @@ jobs:
           echo "::notice title=changes::Git status after updates"
           git status --short
       - name: Configure bot credentials
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         id: bot-credentials
         # For go-openapi repos (using secrets: inherit):
         #   Falls back to: CI_BOT_APP_ID, CI_BOT_APP_PRIVATE_KEY, CI_BOT_GPG_PRIVATE_KEY, etc.
@@ -378,7 +378,7 @@ jobs:
         run: gh pr review --approve "$PR_URL"
       - name: Wait for all workflow runs to complete
         if: ${{ needs.prepare-modules.outputs.pull-request-url != '' }}
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52935b0..ed3727e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -91,10 +91,10 @@ jobs:
         name: Detect go mono-repo
         if: ${{ inputs.is-monorepo == 'true' }}
         id: detect-monorepo
-        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@768e1ac7e37ab6586242b03a8023615dfc8da6a2 # v1.4.17
+        uses: go-openapi/gh-actions/ci-jobs/detect-go-monorepo@22efe2037645eed0102229f2488f22aee042b2a4 # v1.4.18
       -
         name: Install git-cliff
-        uses: taiki-e/install-action@5b4d68e2e660441203ab128a23676f1e4faf1532 # v2.86.3
+        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
         with:
           tool: git-cliff
       -
diff --git a/.github/workflows/scanner.yml b/.github/workflows/scanner.yml
index f71271d..397e860 100644
--- a/.github/workflows/scanner.yml
+++ b/.github/workflows/scanner.yml
@@ -49,7 +49,7 @@ jobs:
           exit-code: 0
       -
         name: Upload trivy findings to code scanning dashboard
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: trivy
           sarif_file: trivy-code-report.sarif
@@ -69,7 +69,7 @@ jobs:
           output-file: govulnscan-report.sarif
       -
         name: Upload govulnscan findings to code scanning dashboard
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: govulnscan
           sarif_file: govulnscan-report.sarif