diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 008fe31..4184cb7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -2,6 +2,10 @@ version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
+    groups:
+      codeql:
+        patterns:
+          - "github/codeql-action/*"
     schedule:
       interval: weekly
     cooldown:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92f28d3..4a3b280 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           ruby-version: "4.0"
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           ruby-version: "4.0"
@@ -75,7 +75,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           ruby-version: "4.0"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 040ad71..f6be817 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,11 +26,11 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ruby
           build-mode: none
           queries: security-extended
 
       - name: Analyze
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
diff --git a/.github/workflows/publish-gem.yml b/.github/workflows/publish-gem.yml
index dec7aac..c5b4d17 100644
--- a/.github/workflows/publish-gem.yml
+++ b/.github/workflows/publish-gem.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           ruby-version: "4.0"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 073a08d..ce60069 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif
diff --git a/Gemfile.lock b/Gemfile.lock
index f787470..552bba0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -60,7 +60,7 @@ GEM
     fileutils (1.8.0)
     hashdiff (1.2.1)
     io-event (1.11.2)
-    json (2.21.1)
+    json (2.21.2)
     language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     listen (3.10.0)
@@ -97,7 +97,7 @@ GEM
     rbi (0.3.10)
       prism (~> 1.0)
       rbs (>= 4.0.1)
-    rbs (4.0.3)
+    rbs (4.1.3)
       logger
       prism (>= 1.6.0)
       tsort
@@ -125,15 +125,15 @@ GEM
     rubydex (0.2.9-x86_64-darwin)
     rubydex (0.2.9-x86_64-linux)
     securerandom (0.4.1)
-    sorbet (0.6.13344)
-      sorbet-static (= 0.6.13344)
-    sorbet-runtime (0.6.13344)
-    sorbet-static (0.6.13344-aarch64-linux)
-    sorbet-static (0.6.13344-universal-darwin)
-    sorbet-static (0.6.13344-x86_64-linux)
-    sorbet-static-and-runtime (0.6.13344)
-      sorbet (= 0.6.13344)
-      sorbet-runtime (= 0.6.13344)
+    sorbet (0.6.13421)
+      sorbet-static (= 0.6.13421)
+    sorbet-runtime (0.6.13421)
+    sorbet-static (0.6.13421-aarch64-linux)
+    sorbet-static (0.6.13421-universal-darwin)
+    sorbet-static (0.6.13421-x86_64-linux)
+    sorbet-static-and-runtime (0.6.13421)
+      sorbet (= 0.6.13421)
+      sorbet-runtime (= 0.6.13421)
     spoom (1.7.16)
       erubi (>= 1.10.0)
       prism (>= 0.28.0)