diff --git a/Dockerfile b/Dockerfile
index cf3bbf4..c09aa68 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM esacteksab/go:1.25.0-2025-08-29@sha256:5e653c7be3a00b02c6cc4ac59bebe00a7fb176a2489d7538f9a553ab784b8c34 AS builder
+FROM esacteksab/go:1.25.0-2025-08-30@sha256:db05923e322c5e89c12a879bad4ce76826bab889cf829045beb52b6dda9792d1 AS builder
 
 # Set GOMODCACHE explicitly
 ENV GOMODCACHE=/go/pkg/mod
diff --git a/go.mod b/go.mod
index 37886f9..f7ecb0d 100644
--- a/go.mod
+++ b/go.mod
@@ -39,5 +39,5 @@ require (
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 )
diff --git a/go.sum b/go.sum
index 1c607d7..5779632 100644
--- a/go.sum
+++ b/go.sum
@@ -53,8 +53,8 @@ github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wx
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
 github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
diff --git a/testdata/script/pin_github_actions.txtar b/testdata/script/pin_github_actions.txtar
index 360318e..35711f8 100644
--- a/testdata/script/pin_github_actions.txtar
+++ b/testdata/script/pin_github_actions.txtar
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout v4 (branch/tag)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4
       - name: Setup Go v5 (branch/tag)
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5
       - name: Action with specific SHA (should not change)
diff --git a/testdata/script/pin_github_actions_42.txtar b/testdata/script/pin_github_actions_42.txtar
index 9c438e9..a9a0f36 100644
--- a/testdata/script/pin_github_actions_42.txtar
+++ b/testdata/script/pin_github_actions_42.txtar
@@ -25,4 +25,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Gradle v4 (branch/tag)
-        uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 #v4.4.1
\ No newline at end of file
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 #v4.4.2
\ No newline at end of file
diff --git a/testdata/script/update_github_actions.txtar b/testdata/script/update_github_actions.txtar
index 82e9709..1d58447 100644
--- a/testdata/script/update_github_actions.txtar
+++ b/testdata/script/update_github_actions.txtar
@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout v4 (branch/tag)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
       - name: Setup Go v5 (branch/tag)
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 #v5.5.0
       - name: Action with specific SHA (should not change)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
       - name: Non-existent ref
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0