diff --git a/.github/workflows/auto-response.yml b/.github/workflows/auto-response.yml
index a230800d..58628912 100644
--- a/.github/workflows/auto-response.yml
+++ b/.github/workflows/auto-response.yml
@@ -25,7 +25,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
diff --git a/.github/workflows/catalog-feed-schema-version-guard.yml b/.github/workflows/catalog-feed-schema-version-guard.yml
index 8ab826dd..64924284 100644
--- a/.github/workflows/catalog-feed-schema-version-guard.yml
+++ b/.github/workflows/catalog-feed-schema-version-guard.yml
@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Test schema-version parser
         run: node --test .github/scripts/catalog-feed-schema-version-guard.test.cjs
diff --git a/.github/workflows/ci-check-testbox.yml b/.github/workflows/ci-check-testbox.yml
index 30ad5759..4b54980b 100644
--- a/.github/workflows/ci-check-testbox.yml
+++ b/.github/workflows/ci-check-testbox.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           testbox_id: ${{ inputs.testbox_id }}
 
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 50
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3af65249..e0013260 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 45
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -120,7 +120,7 @@ jobs:
     timeout-minutes: 25
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
@@ -182,7 +182,7 @@ jobs:
             specs: e2e/local-auth/old-cli-publish-compat.pw.test.ts
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
diff --git a/.github/workflows/clawhub-cli-github-release.yml b/.github/workflows/clawhub-cli-github-release.yml
index 6b45dbd4..0180f74a 100644
--- a/.github/workflows/clawhub-cli-github-release.yml
+++ b/.github/workflows/clawhub-cli-github-release.yml
@@ -43,13 +43,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout release tooling
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.ref }}
           path: release-tools
 
       - name: Checkout release tag
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
diff --git a/.github/workflows/clawhub-cli-npm-release.yml b/.github/workflows/clawhub-cli-npm-release.yml
index e847639a..4ad9a461 100644
--- a/.github/workflows/clawhub-cli-npm-release.yml
+++ b/.github/workflows/clawhub-cli-npm-release.yml
@@ -42,13 +42,13 @@ jobs:
           exit 1
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Checkout release tooling
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.ref }}
           path: release-tools
@@ -207,13 +207,13 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Checkout release tooling
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.ref }}
           path: release-tools
diff --git a/.github/workflows/clawhub-rescan-guidance.yml b/.github/workflows/clawhub-rescan-guidance.yml
index eacf5e06..ef0f2f4f 100644
--- a/.github/workflows/clawhub-rescan-guidance.yml
+++ b/.github/workflows/clawhub-rescan-guidance.yml
@@ -26,7 +26,7 @@ jobs:
       CLAWHUB_RESCAN_GUIDANCE_APPLY: "1"
       ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue }}
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
diff --git a/.github/workflows/codeql-light.yml b/.github/workflows/codeql-light.yml
index fcc3aee3..8cff47bf 100644
--- a/.github/workflows/codeql-light.yml
+++ b/.github/workflows/codeql-light.yml
@@ -82,7 +82,7 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: false
 
diff --git a/.github/workflows/deploy-test.yml b/.github/workflows/deploy-test.yml
index e4362c7b..cb246646 100644
--- a/.github/workflows/deploy-test.yml
+++ b/.github/workflows/deploy-test.yml
@@ -31,7 +31,7 @@ jobs:
       deploy_sha: ${{ steps.revision.outputs.deploy_sha }}
       fixture_version: ${{ steps.revision.outputs.fixture_version }}
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 845dca03..300b7426 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -104,7 +104,7 @@ jobs:
           echo "Deploy target: ${{ needs.validate-deploy-request.outputs.target }}"
           echo "Allow deleting large Convex indexes: ${{ inputs.allow_deleting_large_indexes }}"
 
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
@@ -234,7 +234,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/design-system-audit.yml b/.github/workflows/design-system-audit.yml
index d5b534a8..967ca227 100644
--- a/.github/workflows/design-system-audit.yml
+++ b/.github/workflows/design-system-audit.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout current main
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: main
diff --git a/.github/workflows/package-publish.yml b/.github/workflows/package-publish.yml
index 91be4065..c9b71e6e 100644
--- a/.github/workflows/package-publish.yml
+++ b/.github/workflows/package-publish.yml
@@ -111,7 +111,7 @@ jobs:
       publish_json: ${{ steps.capture.outputs.publish_json }}
       release_id: ${{ steps.capture.outputs.release_id }}
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.sha }}
 
@@ -172,7 +172,7 @@ jobs:
               fh.write(f"ref={workflow_sha}\n")
           PY
 
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           repository: ${{ steps.clawhub_source.outputs.repository }}
           ref: ${{ steps.clawhub_source.outputs.ref }}
@@ -578,7 +578,7 @@ jobs:
 
       - name: Checkout publish source for plugin inspector
         if: steps.resolve_publish.outputs.inspect_checkout_repository != ''
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           repository: ${{ steps.resolve_publish.outputs.inspect_checkout_repository }}
           ref: ${{ steps.resolve_publish.outputs.inspect_checkout_ref }}
diff --git a/.github/workflows/plugin-inspector-bulk-scan.yml b/.github/workflows/plugin-inspector-bulk-scan.yml
index ab015b56..5b2a0bc5 100644
--- a/.github/workflows/plugin-inspector-bulk-scan.yml
+++ b/.github/workflows/plugin-inspector-bulk-scan.yml
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/plugin-inspector-pin-bump-dispatch.yml b/.github/workflows/plugin-inspector-pin-bump-dispatch.yml
index f8c83bc7..a280ea5c 100644
--- a/.github/workflows/plugin-inspector-pin-bump-dispatch.yml
+++ b/.github/workflows/plugin-inspector-pin-bump-dispatch.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout main commit
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/prepublication-publish-checks.yml b/.github/workflows/prepublication-publish-checks.yml
index 088a2d36..c86cd311 100644
--- a/.github/workflows/prepublication-publish-checks.yml
+++ b/.github/workflows/prepublication-publish-checks.yml
@@ -73,7 +73,7 @@ jobs:
       PREPUBLICATION_TRUFFLEHOG_IMAGE: ${{ vars.PREPUBLICATION_TRUFFLEHOG_IMAGE || 'ghcr.io/trufflesecurity/trufflehog:3.95.6@sha256:96f8429082cb2d4ae73b1096dcdb2f5aa139881d97042b0c5e5fa226a392e056' }}
       PREPUBLICATION_WORKER_ID: "github-actions:${{ github.run_id }}:${{ github.run_attempt }}:${{ matrix.shard }}"
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
diff --git a/.github/workflows/preview-proof.yml b/.github/workflows/preview-proof.yml
index b96ca918..42e32f30 100644
--- a/.github/workflows/preview-proof.yml
+++ b/.github/workflows/preview-proof.yml
@@ -54,7 +54,7 @@ jobs:
       name: Test
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.checkout_ref || github.sha }}
 
diff --git a/.github/workflows/publish-catalog-feed.yml b/.github/workflows/publish-catalog-feed.yml
index abe74f23..b65fe3ff 100644
--- a/.github/workflows/publish-catalog-feed.yml
+++ b/.github/workflows/publish-catalog-feed.yml
@@ -41,7 +41,7 @@ jobs:
     env:
       EXPIRES_IN_DAYS: ${{ inputs.expires_in_days || '7' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
diff --git a/.github/workflows/scheduled-live-checks.yml b/.github/workflows/scheduled-live-checks.yml
index cc8a033d..2832a285 100644
--- a/.github/workflows/scheduled-live-checks.yml
+++ b/.github/workflows/scheduled-live-checks.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 1f26f5d0..370e3bdc 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read # Required to scan the code in the PR
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0 # necessary to support the scoping requirements below
 
diff --git a/.github/workflows/security-dataset-snapshot.yml b/.github/workflows/security-dataset-snapshot.yml
index 608c092a..a36918d0 100644
--- a/.github/workflows/security-dataset-snapshot.yml
+++ b/.github/workflows/security-dataset-snapshot.yml
@@ -87,7 +87,7 @@ jobs:
       SNAPSHOT_HARD_MAX_SHARDS_PER_SOURCE: "64"
       SNAPSHOT_HARD_MAX_MATRIX_JOBS: "128"
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
@@ -204,7 +204,7 @@ jobs:
       SNAPSHOT_PAGE_TIMEOUT_MS: ${{ inputs['page-timeout-ms'] || '600000' }}
       SANITIZED_OUT_DIR: /tmp/clawhub-security-dataset/shard
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
@@ -266,11 +266,11 @@ jobs:
       SANITIZED_OUT_DIR: /tmp/clawhub-security-dataset/sanitized
       WORK_DIR: /tmp/clawhub-security-dataset
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ env.HF_UPLOAD == 'true' }}
         with:
           python-version: "3.12"
@@ -352,11 +352,11 @@ jobs:
       SOURCE_SHARDS_RUN_ID: ${{ inputs['reuse-shards-run-id'] }}
       WORK_DIR: /tmp/clawhub-security-dataset
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ env.HF_UPLOAD == 'true' }}
         with:
           python-version: "3.12"
diff --git a/.github/workflows/security-scan-codex.yml b/.github/workflows/security-scan-codex.yml
index 639d82e5..8e0b5c15 100644
--- a/.github/workflows/security-scan-codex.yml
+++ b/.github/workflows/security-scan-codex.yml
@@ -72,11 +72,11 @@ jobs:
       CODEX_SECURITY_SCAN_WORKER_ID: "github-actions:${{ github.run_id }}:${{ github.run_attempt }}:${{ matrix.shard }}"
       SKILLSPECTOR_PROVIDER: openai
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: ./.github/actions/setup-bun
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/skill-card-worker.yml b/.github/workflows/skill-card-worker.yml
index 23fd1aa7..17381a09 100644
--- a/.github/workflows/skill-card-worker.yml
+++ b/.github/workflows/skill-card-worker.yml
@@ -43,7 +43,7 @@ jobs:
       SKILL_CARD_WORKER_ID: "github-actions:${{ github.run_id }}:${{ github.run_attempt }}:${{ matrix.shard }}"
       NVIDIA_TRUSTWORTHY_AI_DIR: ${{ github.workspace }}/.artifacts/nvidia-trustworthy-ai
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - name: Check configuration
         run: |
@@ -53,7 +53,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           repository: NVIDIA/Trustworthy-AI
           ref: fb5867e9070b4080d28818242e20334e10ac55fc
diff --git a/.github/workflows/skill-publish.yml b/.github/workflows/skill-publish.yml
index 8411abc3..18c3bb2e 100644
--- a/.github/workflows/skill-publish.yml
+++ b/.github/workflows/skill-publish.yml
@@ -66,7 +66,7 @@ jobs:
     outputs:
       publish_json: ${{ steps.capture.outputs.publish_json }}
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref || github.sha }}
 
@@ -123,7 +123,7 @@ jobs:
               fh.write(f"ref={workflow_sha}\n")
           PY
 
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
         with:
           repository: ${{ steps.clawhub_source.outputs.repository }}
           ref: ${{ steps.clawhub_source.outputs.ref }}
diff --git a/.github/workflows/update-convex-ai-files.yml b/.github/workflows/update-convex-ai-files.yml
index d4e9f444..f2aeebbc 100644
--- a/.github/workflows/update-convex-ai-files.yml
+++ b/.github/workflows/update-convex-ai-files.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/update-skills.yml b/.github/workflows/update-skills.yml
index 53640038..7b0669a3 100644
--- a/.github/workflows/update-skills.yml
+++ b/.github/workflows/update-skills.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0