diff --git a/.github/workflows/__call-ci-node.yml b/.github/workflows/__call-ci-node.yml
index 9a9dbbd4..13f2b5fa 100644
--- a/.github/workflows/__call-ci-node.yml
+++ b/.github/workflows/__call-ci-node.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Release
         id: setup_release
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
diff --git a/.github/workflows/__call-codeql.yml b/.github/workflows/__call-codeql.yml
index 59dc799f..0f60a594 100644
--- a/.github/workflows/__call-codeql.yml
+++ b/.github/workflows/__call-codeql.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ${{ (inputs && inputs.runner && fromJson(inputs.runner)) || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Get repo languages
         id: lang
@@ -239,7 +239,7 @@ jobs:
     timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 60 }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           submodules: recursive
 
diff --git a/.github/workflows/__call-common-lint.yml b/.github/workflows/__call-common-lint.yml
index ab006d5d..4651d402 100644
--- a/.github/workflows/__call-common-lint.yml
+++ b/.github/workflows/__call-common-lint.yml
@@ -32,7 +32,7 @@ jobs:
       CLANG_FORMAT_VERSION: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Download problem matchers
         shell: bash
diff --git a/.github/workflows/__call-docker.yml b/.github/workflows/__call-docker.yml
index f83c7eec..ce1b727d 100644
--- a/.github/workflows/__call-docker.yml
+++ b/.github/workflows/__call-docker.yml
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Find dockerfiles
         id: find
@@ -151,7 +151,7 @@ jobs:
           clean-all: true
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           submodules: recursive
 
@@ -345,7 +345,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           sparse-checkout: |
             DOCKER_README.md
diff --git a/.github/workflows/__call-release-notifier.yml b/.github/workflows/__call-release-notifier.yml
index 44521643..9970d632 100644
--- a/.github/workflows/__call-release-notifier.yml
+++ b/.github/workflows/__call-release-notifier.yml
@@ -68,7 +68,7 @@ jobs:
         if: >-
           steps.check-label.outputs.hasTopic == 'true' &&
           steps.check-release.outputs.isLatestRelease == 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: ${{ env.BLOG_REPO }}
 
diff --git a/.github/workflows/__call-update-flathub-repo.yml b/.github/workflows/__call-update-flathub-repo.yml
index 2b89a3a4..684e4484 100644
--- a/.github/workflows/__call-update-flathub-repo.yml
+++ b/.github/workflows/__call-update-flathub-repo.yml
@@ -66,13 +66,13 @@ jobs:
         if: >-
           steps.check-label.outputs.hasTopic == 'true' &&
           steps.check-release.outputs.isLatestRelease == 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Checkout flathub-repo
         if: >-
           steps.check-label.outputs.hasTopic == 'true' &&
           steps.check-release.outputs.isLatestRelease == 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: "flathub/${{ env.FLATHUB_PKG }}"
           path: "flathub/${{ env.FLATHUB_PKG }}"
diff --git a/.github/workflows/__call-update-npm.yml b/.github/workflows/__call-update-npm.yml
index 83b38f2a..7e84bf02 100644
--- a/.github/workflows/__call-update-npm.yml
+++ b/.github/workflows/__call-update-npm.yml
@@ -32,7 +32,7 @@ jobs:
             extra-args: "--provenance --access public"
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup token
         env:
diff --git a/.github/workflows/__call-update-pacman-repo.yml b/.github/workflows/__call-update-pacman-repo.yml
index b7e3a4ac..3c3fed42 100644
--- a/.github/workflows/__call-update-pacman-repo.yml
+++ b/.github/workflows/__call-update-pacman-repo.yml
@@ -67,7 +67,7 @@ jobs:
         if: >-
           steps.check-label.outputs.hasTopic == 'true' &&
           steps.check-release.outputs.isLatestRelease == 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: ${{ env.PACMAN_REPO }}
 
diff --git a/.github/workflows/__cla-gist-replicator.yml b/.github/workflows/__cla-gist-replicator.yml
index 4773f91f..d25c4e4e 100644
--- a/.github/workflows/__cla-gist-replicator.yml
+++ b/.github/workflows/__cla-gist-replicator.yml
@@ -24,7 +24,7 @@ jobs:
       url: https://gist.github.com/${{ vars.CLA_GIST_ID }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Deploy CLA (indivdual)
         uses: exuanbo/actions-deploy-gist@47697fceaeea2006a90594ee24eb9cd0a1121ef8  # v1.1.4
diff --git a/.github/workflows/__global-replicator.yml b/.github/workflows/__global-replicator.yml
index 2eb875b8..8f4161a9 100644
--- a/.github/workflows/__global-replicator.yml
+++ b/.github/workflows/__global-replicator.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Removing files
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -89,7 +89,7 @@ jobs:
       # checkout between each step to ensure we have a clean GitHub workspace
       # see https://github.com/derberg/manage-files-in-multiple-repositories/issues/61#issuecomment-1747013728
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (general)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -114,7 +114,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (docs)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -134,7 +134,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (flathub)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -154,7 +154,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (homebrew)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -174,7 +174,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (pacman)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -194,7 +194,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (winget)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -214,7 +214,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (node)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -235,7 +235,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (python)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -255,7 +255,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (docker)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -275,7 +275,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (c, cpp)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
@@ -295,7 +295,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (custom issues)
         # GitHub will not show the global issue config if there are any custom templates in the repo
@@ -316,7 +316,7 @@ jobs:
           destination: ''
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Replicating files (release/changelog workflows)
         uses: derberg/manage-files-in-multiple-repositories@beecbe897cf5ed7f3de5a791a3f2d70102fe7c25  # v2.1.0
diff --git a/.github/workflows/__update-cpm-cmake.yml b/.github/workflows/__update-cpm-cmake.yml
index 75903ec2..7779e567 100644
--- a/.github/workflows/__update-cpm-cmake.yml
+++ b/.github/workflows/__update-cpm-cmake.yml
@@ -64,7 +64,7 @@ jobs:
       max-parallel: 1  # run one at a time to attempt to avoid GitHub api rate limits
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: ${{ github.repository_owner }}/${{ matrix.repo }}
           token: ${{ secrets.GH_BOT_TOKEN }}
diff --git a/.github/workflows/__update_license_years.yml b/.github/workflows/__update_license_years.yml
index 7175eb46..b051d83c 100644
--- a/.github/workflows/__update_license_years.yml
+++ b/.github/workflows/__update_license_years.yml
@@ -46,7 +46,7 @@ jobs:
       max-parallel: 5  # run only a few at a time to attempt to avoid GitHub api rate limits
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: ${{ github.repository_owner }}/${{ matrix.repo }}
           fetch-depth: 0
diff --git a/.github/workflows/__validate-dependabot-config.yml b/.github/workflows/__validate-dependabot-config.yml
index 753267eb..5c5f984b 100644
--- a/.github/workflows/__validate-dependabot-config.yml
+++ b/.github/workflows/__validate-dependabot-config.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
diff --git a/.github/workflows/__validate-renovate-config.yml b/.github/workflows/__validate-renovate-config.yml
index 24768d0b..2ba62bfa 100644
--- a/.github/workflows/__validate-renovate-config.yml
+++ b/.github/workflows/__validate-renovate-config.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Find additional files
         id: find-files