diff --git a/.github/labeler-areas.yml b/.github/labeler-areas.yml
index 98f2f825285b..2f8ec3fcec36 100644
--- a/.github/labeler-areas.yml
+++ b/.github/labeler-areas.yml
@@ -4,89 +4,129 @@
 # see how this config file is used.
 
 "area: build":
-  - ".github/*"
-  - ".github/workflows/**"
-  - "build-tools/**"
-  - "common/build/**"
-  - "tools/markdown-magic/**"
-  - "tools/pipelines/**"
+  changed-files:
+    - any-glob-to-any-file:
+      - ".github/*"
+      - ".github/workflows/**"
+      - "build-tools/**"
+      - "common/build/**"
+      - "tools/markdown-magic/**"
+      - "tools/pipelines/**"
 
 "area: contributor experience":
-  - ".vscode/**"
+  changed-files:
+    - any-glob-to-any-file: ".vscode/**"
 
 "area: dds":
-  - experimental/dds/**
-  - packages/dds/**
+  changed-files:
+    - any-glob-to-any-file:
+      - experimental/dds/**
+      - packages/dds/**
 
 "area: dds: tree":
-  - experimental/dds/tree/**
-  - experimental/dds/tree2/**
-  - packages/dds/tree/**
+  changed-files:
+    - any-glob-to-any-file:
+      - experimental/dds/tree/**
+      - experimental/dds/tree2/**
+      - packages/dds/tree/**
 
 "area: dds: propertydds":
-  - experimental/PropertyDDS/**
+  changed-files:
+    - any-glob-to-any-file: experimental/PropertyDDS/**
 
 "area: dds: sharedstring":
-  - packages/dds/sequence/**
+  changed-files:
+    - any-glob-to-any-file: packages/dds/sequence/**
 
 "area: definitions":
-  - common/lib/container-definitions/**
-  - common/lib/core-interfaces/**
-  - common/lib/driver-definitions/**
+  changed-files:
+    - any-glob-to-any-file:
+      - common/lib/container-definitions/**
+      - common/lib/core-interfaces/**
+      - common/lib/driver-definitions/**
 
 "area: dev experience":
-  - experimental/framework/**
+  changed-files:
+    - any-glob-to-any-file: experimental/framework/**
 
 "area: driver":
-  - packages/drivers/**
+  changed-files:
+    - any-glob-to-any-file: packages/drivers/**
 
 "area: examples":
-  - examples/**
-  - experimental/examples/**
+  changed-files:
+    - any-glob-to-any-file:
+      - examples/**
+      - experimental/examples/**
 
 "area: framework":
-  - packages/framework/**
+  changed-files:
+    - any-glob-to-any-file: packages/framework/**
 
 "area: loader":
-  - packages/loader/**
+  changed-files:
+    - any-glob-to-any-file: packages/loader/**
 
 "area: odsp-driver":
-  - packages/drivers/*odsp*/**
-  - packages/utils/odsp-doclib-utils/**
+  changed-files:
+    - any-glob-to-any-file:
+      - packages/drivers/*odsp*/**
+      - packages/utils/odsp-doclib-utils/**
 
 # Add "area: repo" label to any root or .github changes
 "area: repo":
-  - any: ["*", ".github/**", "!BREAKING.md"]
+  changed-files:
+    - any-glob-to-any-file:
+      - "*"
+      - ".github/**"
+      - "!BREAKING.md"
 
 "area: runtime":
-  - packages/runtime/**
+  changed-files:
+    - any-glob-to-any-file: packages/runtime/**
 
 "area: server":
-  - server/**
+  changed-files:
+    - any-glob-to-any-file: server/**
 
 "area: tests":
-  - packages/test/**
+  changed-files:
+    - any-glob-to-any-file: packages/test/**
 
 "area: tools":
-  - any: ["common/build/**", "tools/**", "!tools/markdown-magic/**"]
+  changed-files:
+    - any-glob-to-any-file:
+      - common/build/**
+      - tools/**
+      - "!tools/markdown-magic/**"
 
 "area: website":
-  - any: ["docs/**", "!docs/content/**"]
+  changed-files:
+    - any-glob-to-any-file:
+      - docs/**
+      - "!docs/content/**"
 
 "breaking change":
-  - BREAKING.md
+  changed-files:
+    - any-glob-to-any-file: BREAKING.md
 
 "changeset-present":
-  - .changeset/**
-  - server/routerlicious/.changeset/**
+  changed-files:
+    - any-glob-to-any-file:
+      - .changeset/**
+      - server/routerlicious/.changeset/**
 
 dependencies:
-  - package-lock.json
-  - pnpm-lock.yaml
+  changed-files:
+    - any-glob-to-any-file:
+      - package-lock.json
+      - pnpm-lock.yaml
 
 documentation:
-  - docs/content/**
+  changed-files:
+    - any-glob-to-any-file: docs/content/**
 
 # flag changes to public APIs so they can be reviewed to see if they're breaking
 "public api change":
-  - "**/api-report/**"
+  changed-files:
+    - any-glob-to-any-file: "**/api-report/**"
diff --git a/.github/labeler-changesets.yml b/.github/labeler-changesets.yml
index a6a7f1264ad7..01ca3ef8a108 100644
--- a/.github/labeler-changesets.yml
+++ b/.github/labeler-changesets.yml
@@ -5,4 +5,5 @@
 
 # Require changesets for server public API changes
 "changeset-required":
-  - "**/routerlicious/api-report/**"
+  changed-files:
+    - any-glob-to-any-file: "**/routerlicious/api-report/**"
diff --git a/.github/workflows/changeset-reporter.yml b/.github/workflows/changeset-reporter.yml
index c627236b3242..fac438bfcbc6 100644
--- a/.github/workflows/changeset-reporter.yml
+++ b/.github/workflows/changeset-reporter.yml
@@ -26,7 +26,8 @@ jobs:
           persist-credentials: false
 
       - name: Download results
-        uses: dawidd6/action-download-artifact@bd10f381a96414ce2b13a11bfa89902ba7cea07f # ratchet:dawidd6/action-download-artifact@v2.24.3
+        # release notes: https://github.com/dawidd6/action-download-artifact/releases/tag/v11
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # ratchet:dawidd6/action-download-artifact@v11
         with:
           workflow: pr-check-changeset.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -38,8 +39,8 @@ jobs:
 
       - name: Required but missing
         if: fromJson(steps.changeset.outputs.CHANGESET).required == true && fromJson(steps.changeset.outputs.CHANGESET).changesetFound == false
-        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.0
-        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # ratchet:marocchino/sticky-pull-request-comment@v2.9.0
+        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # ratchet:marocchino/sticky-pull-request-comment@v2
         with:
           header: changeset
           number: ${{ fromJson(steps.changeset.outputs.CHANGESET).pr }}
@@ -47,8 +48,8 @@ jobs:
 
       - name: Required and present
         if: fromJson(steps.changeset.outputs.CHANGESET).required == true && fromJson(steps.changeset.outputs.CHANGESET).changesetFound == true
-        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.0
-        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # ratchet:marocchino/sticky-pull-request-comment@v2.9.0
+        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # ratchet:marocchino/sticky-pull-request-comment@v2
         with:
           header: changeset
           number: ${{ fromJson(steps.changeset.outputs.CHANGESET).pr }}
@@ -58,8 +59,8 @@ jobs:
 
       - name: Changeset not required
         if: fromJson(steps.changeset.outputs.CHANGESET).required == false && fromJson(steps.changeset.outputs.CHANGESET).changesetFound == true
-        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.0
-        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # ratchet:marocchino/sticky-pull-request-comment@v2.9.0
+        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # ratchet:marocchino/sticky-pull-request-comment@v2
         with:
           header: changeset
           number: ${{ fromJson(steps.changeset.outputs.CHANGESET).pr }}
diff --git a/.github/workflows/linkcheck-reporter.yml b/.github/workflows/linkcheck-reporter.yml
index 1731b7d682de..56ba96321be7 100644
--- a/.github/workflows/linkcheck-reporter.yml
+++ b/.github/workflows/linkcheck-reporter.yml
@@ -7,16 +7,17 @@ on:
 
 permissions:
   contents: read
-  actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+  actions: read # for dawidd6/action-download-artifact to query and download artifacts
 
 jobs:
   load_report:
     permissions:
-      pull-requests: write  # for marocchino/sticky-pull-request-comment to create or update PR comment
+      pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
     runs-on: ubuntu-latest
     steps:
       - name: Download results
-        uses: dawidd6/action-download-artifact@bd10f381a96414ce2b13a11bfa89902ba7cea07f # ratchet:dawidd6/action-download-artifact@v2.24.3
+        # release notes: https://github.com/dawidd6/action-download-artifact/releases/tag/v11
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # ratchet:dawidd6/action-download-artifact@v11
         with:
           workflow: website-validation.yml
           # workflow_conclusion: completed
@@ -28,8 +29,8 @@ jobs:
         run: echo "pr=$(cat pr)" >> $GITHUB_OUTPUT
         working-directory: ./results
       - name: Post report in comment
-        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.0
-        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # ratchet:marocchino/sticky-pull-request-comment@v2.9.0
+        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # ratchet:marocchino/sticky-pull-request-comment@v2
         with:
           header: linkreport
           recreate: true
diff --git a/.github/workflows/pr-changeset-review.yml b/.github/workflows/pr-changeset-review.yml
index def4ac2c1122..19f2a5ae72fe 100644
--- a/.github/workflows/pr-changeset-review.yml
+++ b/.github/workflows/pr-changeset-review.yml
@@ -30,7 +30,9 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: errata-ai/vale-action@d89dee975228ae261d22c15adcd03578634d429c # ratchet:errata-ai/vale-action@v2.1.1
+
+      # release notes: https://github.com/errata-ai/vale-action/releases/tag/v2.1.1
+      - uses: errata-ai/vale-action@d89dee975228ae261d22c15adcd03578634d429c # ratchet:errata-ai/vale-action@v2
         with:
           files: .changeset
           vale_flags: "--glob=*-*-*.md"
diff --git a/.github/workflows/pr-check-changeset.yml b/.github/workflows/pr-check-changeset.yml
index 779ebcc4c076..9554f7122757 100644
--- a/.github/workflows/pr-check-changeset.yml
+++ b/.github/workflows/pr-check-changeset.yml
@@ -76,8 +76,8 @@ jobs:
           echo $(jq -c '. += {required: false}' changeset-metadata.json) > changeset-metadata.json
 
       - name: Upload changeset metadata
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: changeset-metadata
           path: ./changeset-metadata.json
@@ -102,8 +102,8 @@ jobs:
           echo $(jq -c '. += { pr: "${{ github.event.number }}" }' changeset-metadata.json) > changeset-metadata.json
 
       - name: Upload changeset metadata
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: changeset-metadata
           path: ./changeset-metadata.json
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index 33dcb85385e9..d38c31ed7a13 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -5,12 +5,12 @@ on:
     branches: [main, next, release/**/*]
 
 permissions:
-  contents: read  # for actions/labeler to determine modified files
+  contents: read # for actions/labeler to determine modified files
 
 jobs:
   areas_label:
     permissions:
-      pull-requests: write  # for actions/labeler to add labels to PRs
+      pull-requests: write # for actions/labeler to add labels to PRs
     runs-on: ubuntu-latest
     name: Label areas
     # Skip labeling main-next merge PRs. The area labels are noisy and distracting for main-next PRs because they can
@@ -20,7 +20,8 @@ jobs:
     # This is implemented by comparing the PR title because at creation time, the PR has no labels (and the GItHub API
     # does not have a way to set labels at creation either), so skipping based on labels does not work.
     steps:
-      - uses: actions/labeler@5c7539237e04b714afd8ad9b4aed733815b9fab4 # ratchet:actions/labeler@v4.0.2
+      # release notes: https://github.com/actions/labeler/releases/tag/v6.0.1
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # ratchet:actions/labeler@v6
         if: "github.event.pull_request.title != 'Automation: main-next integrate'"
         with:
           configuration-path: ".github/labeler-areas.yml"
@@ -30,21 +31,23 @@ jobs:
   # this CI job calls the labeler action wuth sync-labels=false, so the label won't be removed automatically.
   changesets_label:
     permissions:
-      pull-requests: write  # for actions/labeler to add labels to PRs
+      pull-requests: write # for actions/labeler to add labels to PRs
     runs-on: ubuntu-latest
     name: Label changeset-required
     steps:
-      - uses: actions/labeler@5c7539237e04b714afd8ad9b4aed733815b9fab4 # ratchet:actions/labeler@v4.0.2
+      # release notes: https://github.com/actions/labeler/releases/tag/v6.0.1
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # ratchet:actions/labeler@v6
         with:
           configuration-path: ".github/labeler-changesets.yml"
           repo-token: "${{ github.token }}"
           sync-labels: false # The changeset-required label is often added manually, so don't remove it.
   branches_label:
     permissions:
-      pull-requests: write  # for actions/labeler to add labels to PRs
+      pull-requests: write # for actions/labeler to add labels to PRs
     runs-on: ubuntu-latest
     name: Label base branches and external contributors
     steps:
-      - uses: srvaroa/labeler@9c29ad1ef33d169f9ef33c52722faf47a566bcf3 # ratchet:srvaroa/labeler@v1
+      # release notes: https://github.com/srvaroa/labeler/releases/tag/v1.13.0
+      - uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # ratchet:srvaroa/labeler@v1
         env:
           GITHUB_TOKEN: "${{ github.token }}"
diff --git a/.github/workflows/pr-release-branch-warning.yml b/.github/workflows/pr-release-branch-warning.yml
index 9b2ce800ee01..eda6ae3002c3 100644
--- a/.github/workflows/pr-release-branch-warning.yml
+++ b/.github/workflows/pr-release-branch-warning.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   warning:
     permissions:
-      pull-requests: write  # for marocchino/sticky-pull-request-comment to create or update PR comment
+      pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
     runs-on: ubuntu-latest
     steps:
       # release notes: https://github.com/actions/checkout/releases/tag/v5.0.0
@@ -28,8 +28,8 @@ jobs:
           submodules: false
 
       - name: Post warning in comment
-        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.0
-        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # ratchet:marocchino/sticky-pull-request-comment@v2.9.0
+        # release notes: https://github.com/marocchino/sticky-pull-request-comment/releases/tag/v2.9.4
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # ratchet:marocchino/sticky-pull-request-comment@v2
         with:
           header: release-warning
           path: ${{ github.workspace }}/.github/workflows/data/release-branch-warning.md
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 73208834526e..a86e28287598 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -23,7 +23,9 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f # ratchet:mszostok/codeowners-validator@v0.7.4
+
+      # release notes: https://github.com/mszostok/codeowners-validator/releases/tag/v0.7.4
+      - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f # ratchet:mszostok/codeowners-validator@v0
         with:
           github_access_token: "${{ secrets.GITHUB_TOKEN }}"
           checks: "files,duppatterns,syntax"
@@ -35,7 +37,8 @@ jobs:
     name: PR template placeholder content
     runs-on: ubuntu-latest
     steps:
-      - uses: sitezen/pr-comment-checker@f1e956fac00c6d1163d15841886ae80b7ae58ecb # ratchet:sitezen/pr-comment-checker@v1.0.1
+      # release notes: https://github.com/sitezen/pr-comment-checker/releases/tag/v1.0.1
+      - uses: sitezen/pr-comment-checker@f1e956fac00c6d1163d15841886ae80b7ae58ecb # ratchet:sitezen/pr-comment-checker@v1
         with:
           pr_description_should_not_contain: |
             Feel free to remove or alter parts of this template that do not offer value for your specific change
diff --git a/.github/workflows/push-tag-create-release.yml b/.github/workflows/push-tag-create-release.yml
index 40e3d7326fc6..5a289c86fe74 100644
--- a/.github/workflows/push-tag-create-release.yml
+++ b/.github/workflows/push-tag-create-release.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   create-release:
     permissions:
-      contents: write  # for ncipollo/release-action to create a release
+      contents: write # for ncipollo/release-action to create a release
     name: Create GitHub release
     runs-on: ubuntu-latest
     steps:
@@ -76,8 +76,8 @@ jobs:
         run: |
           flub release fromTag $TAG_NAME --json | jq -c > release-metadata.json
       - name: Upload release metadata JSON
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: release-metadata
           path: release-metadata.json
@@ -116,8 +116,8 @@ jobs:
           mkdir reports
           flub release report -g ${{ fromJson(env.RELEASE_JSON).packageOrReleaseGroup }} -o reports
       - name: Upload release reports
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: release-reports
           path: reports
@@ -152,7 +152,8 @@ jobs:
       # Only creates GH releases for client, server, and build-tools releases.
       - name: Create GH release
         if: fromJson(env.RELEASE_JSON).packageOrReleaseGroup == 'client' || fromJson(env.RELEASE_JSON).packageOrReleaseGroup == 'build-tools' || fromJson(env.RELEASE_JSON).packageOrReleaseGroup == 'server'
-        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # ratchet:ncipollo/release-action@v1
+        # release notes: https://github.com/ncipollo/release-action/releases/tag/v1.20.0
+        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # ratchet:ncipollo/release-action@v1
         with:
           # Allow updates to existing releases.
           allowUpdates: true
diff --git a/.github/workflows/release-approval.yml b/.github/workflows/release-approval.yml
index 86f3327fe220..42e47f0effa8 100644
--- a/.github/workflows/release-approval.yml
+++ b/.github/workflows/release-approval.yml
@@ -21,8 +21,8 @@ on:
         required: true
 
 permissions:
-  actions: read  # Needed to download artifacts from the release-branches workflow
-  pull-requests: read  # Needed to read the PR details, such as the head commit SHA and the PR number.
+  actions: read # Needed to download artifacts from the release-branches workflow
+  pull-requests: read # Needed to read the PR details, such as the head commit SHA and the PR number.
 
 jobs:
   metadata:
@@ -37,8 +37,8 @@ jobs:
       ### These steps run on workflow_run event only ###
       - name: Download metadata
         if: github.event_name == 'workflow_run'
-        # release notes: https://github.com/dawidd6/action-download-artifact/releases/tag/v6
-        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # ratchet:dawidd6/action-download-artifact@v6
+        # release notes: https://github.com/dawidd6/action-download-artifact/releases/tag/v11
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # ratchet:dawidd6/action-download-artifact@v11
         with:
           workflow: release-branches.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -79,8 +79,8 @@ jobs:
       - name: "workflow_dispatch: Load commit_sha"
         id: workflow_dispatch_load_commit_sha
         if: github.event_name == 'workflow_dispatch'
-        # release notes: https://github.com/actions/github-script/releases/tag/v7.0.1
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # ratchet:actions/github-script@v7.0.1
+        # release notes: https://github.com/actions/github-script/releases/tag/v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # ratchet:actions/github-script@v8
         env:
           PR_NUMBER: ${{ steps.workflow_dispatch_load_pr.outputs.pr_num }}
         with:
@@ -107,7 +107,7 @@ jobs:
       # workflow is not directly triggered by the PR.
       - name: Set commit status as pending
         # release notes: https://github.com/myrotvorets/set-commit-status-action/releases/tag/v2.0.1
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # ratchet:myrotvorets/set-commit-status-action@v2.0.1
+        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # ratchet:myrotvorets/set-commit-status-action@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           sha: ${{ needs.metadata.outputs.commit_sha }}
@@ -169,7 +169,7 @@ jobs:
       - name: Set commit status as success
         if: steps.check-pr.outcome == 'success'
         # release notes: https://github.com/myrotvorets/set-commit-status-action/releases/tag/v2.0.1
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # ratchet:myrotvorets/set-commit-status-action@v2.0.1
+        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # ratchet:myrotvorets/set-commit-status-action@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           sha: ${{ needs.metadata.outputs.commit_sha }}
@@ -179,7 +179,7 @@ jobs:
       - name: Set commit status as failure
         if: steps.check-pr.outcome != 'success'
         # release notes: https://github.com/myrotvorets/set-commit-status-action/releases/tag/v2.0.1
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # ratchet:myrotvorets/set-commit-status-action@v2.0.1
+        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # ratchet:myrotvorets/set-commit-status-action@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           sha: ${{ needs.metadata.outputs.commit_sha }}
diff --git a/.github/workflows/release-branches.yml b/.github/workflows/release-branches.yml
index 3393142ceebe..09484caf0cbd 100644
--- a/.github/workflows/release-branches.yml
+++ b/.github/workflows/release-branches.yml
@@ -79,8 +79,8 @@ jobs:
         run: echo ${{ github.event.pull_request.head.sha }} > ./artifacts/commit_sha
 
       - name: Upload artifact
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: release-branch-pr-metadata
           path: ./artifacts
diff --git a/.github/workflows/release-notes-issue.yml b/.github/workflows/release-notes-issue.yml
index 3aca946814eb..43283b0cf689 100644
--- a/.github/workflows/release-notes-issue.yml
+++ b/.github/workflows/release-notes-issue.yml
@@ -87,8 +87,8 @@ jobs:
       # Read the issue intro from a data file and put it in an output variable.
       - name: Read issue intro template
         id: intro
-        # release notes: https://github.com/Lehoczky/render-nunjucks-template-action/releases/tag/v1.0.0
-        uses: Lehoczky/render-nunjucks-template-action@9e23a64f080194d15347e881438ee53201e25c25 # ratchet:Lehoczky/render-nunjucks-template-action@v1.0.0
+        # release notes: https://github.com/Lehoczky/render-nunjucks-template-action/releases/tag/v1.1.0
+        uses: Lehoczky/render-nunjucks-template-action@2012ccb3cdcd8503fa86dd9007255c25139b8f44 # ratchet:Lehoczky/render-nunjucks-template-action@v1
         with:
           template-path: .github/workflows/data/release-notes-issue-intro.njk
           vars: |
diff --git a/.github/workflows/stale-branches.yml b/.github/workflows/stale-branches.yml
index 3af7095a379b..c1e4e1cf14b5 100644
--- a/.github/workflows/stale-branches.yml
+++ b/.github/workflows/stale-branches.yml
@@ -23,8 +23,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # ratchet:actions/checkout@v2
+
       - name: Run delete-old-branches-action
-        uses: beatlabs/delete-old-branches-action@db61ade054731e37b5740e23336445fbc75ccd7b # ratchet:beatlabs/delete-old-branches-action@v0.0.9
+        # release notes: https://github.com/beatlabs/delete-old-branches-action/releases/tag/v0.0.11
+        uses: beatlabs/delete-old-branches-action@4eeeb8740ff8b3cb310296ddd6b43c3387734588 # ratchet:beatlabs/delete-old-branches-action@v0
         with:
           repo_token: ${{ github.token }}
           date: '6 months ago'
diff --git a/.github/workflows/website-validation.yml b/.github/workflows/website-validation.yml
index d7aa4a7286d9..9c934f5fba4c 100644
--- a/.github/workflows/website-validation.yml
+++ b/.github/workflows/website-validation.yml
@@ -48,8 +48,8 @@ jobs:
         run: |
           ./validateHashes.sh
       - name: Upload site artifact
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: fluidframework-site
           path: docs/build
@@ -101,8 +101,8 @@ jobs:
           cache-dependency-path: docs/pnpm-lock.yaml
 
       - name: Download site artifact
-         # release notes: https://github.com/actions/download-artifact/releases/tag/v4.1.8
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # ratchet:actions/download-artifact@v4
+        # release notes: https://github.com/actions/download-artifact/releases/tag/v5.0.0
+        uses: actions/download-artifact@a1b6e7e2e2e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1 # ratchet:actions/download-artifact@v5
         with:
           name: fluidframework-site
           path: docs/build
@@ -136,8 +136,8 @@ jobs:
         run: mkdir -p ./results
 
       - name: Download site artifact
-         # release notes: https://github.com/actions/download-artifact/releases/tag/v4.1.8
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # ratchet:actions/download-artifact@v4
+        # release notes: https://github.com/actions/download-artifact/releases/tag/v5.0.0
+        uses: actions/download-artifact@a1b1c6e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2 # ratchet:actions/download-artifact@v5
         with:
           name: fluidframework-site
           path: docs/build
@@ -159,8 +159,8 @@ jobs:
           cat ./results/linkcheck-output.txt | tee -a ./results/linkcheck
           echo -e "\n\`\`\`" | tee -a ./results/linkcheck
       - name: Upload results artifact
-        # release notes: https://github.com/actions/upload-artifact/releases/tag/v4.4.3
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4
+        # release notes: https://github.com/actions/upload-artifact/releases/tag/v5.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # ratchet:actions/upload-artifact@v5
         with:
           name: website-validation-results
           path: ./docs/results