diff --git a/.github/workflows/enforce-no-catalog.yaml b/.github/workflows/enforce-no-catalog.yaml
index c81bedbf..e0974ac3 100644
--- a/.github/workflows/enforce-no-catalog.yaml
+++ b/.github/workflows/enforce-no-catalog.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Scan ALL package.json files
         shell: bash
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index a8bd9b9b..5e33d661 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Init nodejs
         uses: ./.github/actions/init-pnpm
@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out TS Project Git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Fetch base branch for turbo
         run: git fetch origin ${{ github.base_ref }} --depth=1
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 240a8257..434ca7c7 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -35,7 +35,7 @@ jobs:
         # 2. Parse the JSON string (e.g. '["packages/a"]') into a real array for the matrix
         path: ${{ fromJson(needs.release-please.outputs.paths_released) }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Init nodejs
         uses: ./.github/actions/init-pnpm
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 97304eaa..f1615dd2 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       # This third party action allows you to download the cache artifact from different workflow runs
       # Note that actions/cache doesn't work well because the cache key would need to be computed from
       # a file within the cache, meaning there would never be any data to restore. With other keys, the
diff --git a/.github/workflows/typedoc.yaml b/.github/workflows/typedoc.yaml
index a2fc98ae..b4966015 100644
--- a/.github/workflows/typedoc.yaml
+++ b/.github/workflows/typedoc.yaml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Init nodejs
         uses: ./.github/actions/init-pnpm
       - name: build docs