diff --git a/.github/workflows/bench-base.yml b/.github/workflows/bench-base.yml
index 21101c0..94f2176 100644
--- a/.github/workflows/bench-base.yml
+++ b/.github/workflows/bench-base.yml
@@ -42,7 +42,7 @@ jobs:
       CCACHE_MAXSIZE: 1G
       CCACHE_NOHASHDIR: 'true'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.sha || inputs.ref || github.sha }}
           persist-credentials: false
@@ -55,7 +55,7 @@ jobs:
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           sha="$(git rev-parse HEAD:assimp)"
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: restore
         with:
           path: src/wasm/libassimp.*
@@ -72,7 +72,7 @@ jobs:
             echo "CCACHE_COMPILERCHECK=string:$(cat emsdk-image.txt)"
           } >> "$GITHUB_ENV"
       # Restore only: ci.yml's build-wasm job owns these entries.
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.restore.outputs.cache-matched-key == ''
         with:
           path: .ccache
@@ -85,12 +85,12 @@ jobs:
         env:
           LIBASSIMP_EMSDK: host
         run: node scripts/build-wasm.mjs
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.restore.outputs.cache-hit != 'true'
         with:
           path: src/wasm/libassimp.*
           key: ${{ steps.restore.outputs.cache-primary-key }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bench-base-wasm
           path: src/wasm/libassimp.*
@@ -102,7 +102,7 @@ jobs:
     # Origin: the same ceiling as ci.yml's native-build job, which this mirrors.
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.sha || inputs.ref || github.sha }}
           persist-credentials: false
@@ -119,7 +119,7 @@ jobs:
         run: |
           manifest="$(node -p "const p=require('./package.json');const h=require('node:crypto').createHash('sha256');h.update(JSON.stringify([p.version,p.binary,p.devDependencies['node-addon-api'],p.devDependencies['cmake-js'],process.versions.node.split('.')[0]]));h.digest('hex').slice(0,16)")"
           echo "key=addon-v1-linux-x64-gnu-manylinux-$manifest-$INPUTS-$(git rev-parse HEAD:assimp)" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: restore
         with:
           path: native-artifacts
@@ -134,12 +134,12 @@ jobs:
           scripts/build-manylinux.sh "${inc%%;*}" native-output
           mkdir -p native-artifacts
           cp native-output/libassimp.node native-artifacts/libassimp.linux-x64-gnu.node
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.restore.outputs.cache-hit != 'true'
         with:
           path: native-artifacts
           key: ${{ steps.restore.outputs.cache-primary-key }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bench-base-native
           path: native-artifacts/libassimp.linux-x64-gnu.node
@@ -160,7 +160,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: ${{ matrix.tier == 'small' }}
@@ -191,7 +191,7 @@ jobs:
           node bench/matrix.mjs --backend "$BACKEND" --tier "$TIER" --inputs "$RUNNER_TEMP/matrix-inputs" \
             --build "build=$entry,addon=/tmp/build/native/libassimp.linux-x64-gnu.node,rev=$revision" \
             --out "/tmp/format-matrix/$BACKEND-$TIER.json"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: format-matrix-${{ matrix.backend }}-${{ matrix.tier }}
           path: /tmp/format-matrix/*.json
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 5d2f3f7..a6936e8 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -21,7 +21,7 @@ jobs:
     container:
       image: emscripten/emsdk:6.0.8@sha256:f174124ff798a3ead1abef247d9a849c270b642d552fea500a42565ff210f765
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -30,7 +30,7 @@ jobs:
       - name: Record the engine submodule commit
         id: engine
         run: echo "sha=$(git -C assimp rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .ccache
           key: ccache-${{ runner.os }}-${{ hashFiles('emsdk-image.txt', 'assimp-builds.json', 'CMakeLists.txt', 'CMakePresets.json', 'src/cpp/**', '.gitmodules') }}-${{ steps.engine.outputs.sha }}
@@ -38,7 +38,7 @@ jobs:
         env:
           LIBASSIMP_EMSDK: host
         run: node scripts/build-wasm.mjs
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wasm
           path: src/wasm/libassimp.*
@@ -48,13 +48,13 @@ jobs:
     needs: build-wasm
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
         with:
           node-version: '26'
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: wasm
           path: src/wasm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c93f4b..86991c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
       smoke-matrix: ${{ steps.smoke-matrix.outputs.matrix }}
       version: ${{ steps.release.outputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -65,7 +65,7 @@ jobs:
       CCACHE_MAXSIZE: 1G
       CCACHE_NOHASHDIR: 'true'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -77,7 +77,7 @@ jobs:
       # The artifacts are a pure function of these inputs, and determinism tests
       # prove the outputs are reproducible. No restore key is allowed: a near miss
       # is a wrong binary, and validate-pack checks the image and engine SHA.
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: wasm-cache
         with:
           path: src/wasm/libassimp.*
@@ -92,7 +92,7 @@ jobs:
             echo "CCACHE_BASEDIR=$GITHUB_WORKSPACE"
             echo "CCACHE_COMPILERCHECK=string:$(cat emsdk-image.txt)"
           } >> "$GITHUB_ENV"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.wasm-cache.outputs.cache-hit != 'true'
         with:
           path: .ccache
@@ -108,7 +108,7 @@ jobs:
           ccache --zero-stats
           node scripts/build-wasm.mjs
           ccache --show-stats
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wasm
           path: src/wasm/libassimp.*
@@ -119,7 +119,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       # The format matrix reads the engine's own fixture corpus.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: true
@@ -170,7 +170,7 @@ jobs:
         node: ['22.14.0', '24', '26']
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -197,7 +197,7 @@ jobs:
         usd-core: ['25.8', '26.11']
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -222,7 +222,7 @@ jobs:
           mapfile -t layers < <(node scripts/export-usd-matrix.mjs /tmp/usd-matrix)
           /tmp/usd/bin/python scripts/usd-strict-check.py "${layers[@]}"
       - if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: usd-matrix-${{ matrix.usd-core }}
           path: /tmp/usd-matrix
@@ -249,7 +249,7 @@ jobs:
       CCACHE_NOHASHDIR: 'true'
       MACOSX_DEPLOYMENT_TARGET: '11.0'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -271,7 +271,7 @@ jobs:
           engine="$(git -C assimp rev-parse HEAD)"
           echo "engine=$engine" >> "$GITHUB_OUTPUT"
           echo "key=addon-v1-${{ matrix.suffix }}-$toolchain-$manifest-$INPUTS-$engine" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: addon-cache
         if: needs.preflight.outputs.npm-publish != 'true'
         with:
@@ -286,7 +286,7 @@ jobs:
           scripts/install-ci-tool.sh --tool ccache
           echo "$GITHUB_WORKSPACE/.ci-tools/bin" >> "$GITHUB_PATH"
           echo "LIBASSIMP_COMPILER_LAUNCHER=ccache" >> "$GITHUB_ENV"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.addon-cache.outputs.cache-hit != 'true' && matrix.recipe == 'host'
         with:
           path: .ccache
@@ -331,7 +331,7 @@ jobs:
           if(files.length!==1)throw Error('expected one libassimp.node, found '+files.length);
           f.mkdirSync('native-artifacts',{recursive:true});
           f.copyFileSync(p.join('native-output',files[0]),p.join('native-artifacts','libassimp.'+process.env.NATIVE_SUFFIX+'.node'))"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bindings-${{ matrix.target }}
           path: native-artifacts/libassimp.*.node
@@ -364,7 +364,7 @@ jobs:
       LIBASSIMP_COMPILER_LAUNCHER: ccache
       LIBASSIMP_NATIVE_BUILD_DIR: build/native-${{ matrix.gate }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -375,7 +375,7 @@ jobs:
       - name: Record the engine submodule commit
         id: engine
         run: echo "sha=$(git -C assimp rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .ccache
           key: ccache-v1-${{ matrix.gate }}-${{ steps.engine.outputs.sha }}
@@ -405,7 +405,7 @@ jobs:
       sha256: ${{ steps.freeze.outputs.sha256 }}
       version: ${{ steps.freeze.outputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -443,7 +443,7 @@ jobs:
         run: |
           node scripts/generate-sbom.mjs --check
           node scripts/generate-sbom.mjs --out sbom
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom
           path: sbom/libassimp.cdx.json
@@ -472,14 +472,14 @@ jobs:
             echo "sha256=$(cut -d' ' -f1 < "$archive.sha256")"
             echo "version=$version"
           } >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: prepared-release
           path: |
             prepared-release-*.tgz
             prepared-release-*.tgz.sha256
           if-no-files-found: error
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-tarballs
           path: tarballs/
@@ -497,7 +497,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -530,7 +530,7 @@ jobs:
           LIBASSIMP_FINGERPRINTS_OUT: ${{ runner.temp }}/native-fingerprints
         run: pnpm exec vitest run --config vitest.native.config.ts
       - if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-fingerprints-${{ matrix.suffix }}
           path: ${{ runner.temp }}/native-fingerprints
@@ -581,7 +581,7 @@ jobs:
             os: macos-15
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -597,7 +597,7 @@ jobs:
         id: playwright
         shell: bash
         run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cache/ms-playwright
@@ -622,7 +622,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
@@ -636,11 +636,11 @@ jobs:
       - name: Record the Playwright version
         id: playwright
         run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}-chromium
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: npm-bundlers-${{ hashFiles('tests/bundlers/package-lock.json') }}
@@ -662,7 +662,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: true
@@ -718,7 +718,7 @@ jobs:
       - name: Restore main's Wasm from its CI cache
         id: base-wasm
         if: steps.base-checkout.outcome == 'success'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: src/wasm/libassimp.*
           key: wasm-${{ hashFiles('.bench-base/emsdk-image.txt', '.bench-base/assimp-builds.json', '.bench-base/CMakeLists.txt', '.bench-base/CMakePresets.json', '.bench-base/src/cpp/**', '.bench-base/.gitmodules', '.bench-base/scripts/build-wasm.mjs') }}-${{ steps.base-checkout.outputs.engine }}
@@ -823,7 +823,7 @@ jobs:
           writeFileSync('/tmp/benchmark.md', `${marker}\n${body || '### Benchmark\n\nBenchmark did not complete.'}\n`);
           NODE
       - if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-wasm-benchmark
           path: |
@@ -832,7 +832,7 @@ jobs:
             /tmp/*regression*.json
           if-no-files-found: error
       - if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('node:fs');
@@ -876,7 +876,7 @@ jobs:
           - { backend: native, tier: large, shard: '2/2' }
     steps:
       # The small tier reads the engine's fixture corpus; the large tier generates its inputs.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: ${{ matrix.tier == 'small' }}
@@ -925,7 +925,7 @@ jobs:
           mkdir -p /tmp/format-matrix
           node bench/matrix.mjs "${args[@]}" --out "/tmp/format-matrix/$name.json"
       - if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: format-matrix-${{ strategy.job-index }}
           path: /tmp/format-matrix/*.json
@@ -941,13 +941,13 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: format-matrix-*
           path: /tmp/format-matrix
@@ -972,13 +972,13 @@ jobs:
           fi
           exit "$status"
       - if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: format-matrix-report
           path: /tmp/format-matrix.md
           if-no-files-found: warn
       - if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('node:fs');
@@ -996,7 +996,7 @@ jobs:
     needs: preflight
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
@@ -1013,7 +1013,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
@@ -1034,7 +1034,7 @@ jobs:
           --json preview.json
           --no-template
           './preview-packages/*'
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pkg-pr-new-preview
           path: preview.json
@@ -1047,10 +1047,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
       - uses: ./.github/actions/download-verified-artifact
@@ -1058,7 +1058,7 @@ jobs:
           name: test-tarballs
           path: tarballs
           expect: test-tarballs.json
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pkg-pr-new-preview
           path: preview
@@ -1075,7 +1075,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/download-verified-artifact
@@ -1094,7 +1094,7 @@ jobs:
         with:
           subject-path: tarballs/*.tgz
           sbom-path: sbom/libassimp.cdx.json
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
           registry-url: https://registry.npmjs.org
@@ -1129,7 +1129,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/download-verified-artifact
@@ -1137,7 +1137,7 @@ jobs:
           name: test-tarballs
           path: tarballs
           expect: test-tarballs.json
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
           registry-url: https://registry.npmjs.org
@@ -1161,10 +1161,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22.14.0'
           registry-url: https://registry.npmjs.org
@@ -1182,7 +1182,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/download-verified-artifact
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 23043a7..af0842b 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -25,7 +25,7 @@ jobs:
       issues: write
     steps:
       - name: Post approval needed comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const requester = context.payload.comment.user.login;
@@ -72,14 +72,14 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 20
           persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@833fb0f8c9f6686b33d963a8bae0a94f4936ab2a # v1.0.211
+        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # The workflow token replaces the OIDC exchange for an app token, so
@@ -142,14 +142,14 @@ jobs:
               ;;
           esac
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 20
           persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@833fb0f8c9f6686b33d963a8bae0a94f4936ab2a # v1.0.211
+        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # The workflow token replaces the OIDC exchange for an app token, so
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 38f54ea..1eb68bd 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -63,11 +63,11 @@ jobs:
       SECONDS_BUDGET: ${{ github.event_name == 'pull_request' && '120' || github.event_name == 'push' && '600' || inputs.seconds || '3600' }}
       STRICT: ${{ github.event_name != 'pull_request' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
       - name: Require the checked-in corpus to match its generator
@@ -76,7 +76,7 @@ jobs:
       - name: Record the engine submodule commit
         id: engine
         run: echo "sha=$(git -C assimp rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .ccache
           key: ccache-v1-fuzz-${{ steps.engine.outputs.sha }}
@@ -126,7 +126,7 @@ jobs:
             exit 1
           fi
       - if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-findings
           path: |
diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml
index ff89a9b..ba9fba3 100644
--- a/.github/workflows/osv-scan.yml
+++ b/.github/workflows/osv-scan.yml
@@ -21,7 +21,7 @@ jobs:
   scan-pr:
     name: OSV scan (report-only)
     if: github.event_name == 'pull_request'
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
     with:
       scan-args: |-
         --lockfile=pnpm-lock.yaml
@@ -36,7 +36,7 @@ jobs:
   scan-main:
     name: OSV scan (blocking)
     if: github.event_name != 'pull_request'
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
     with:
       scan-args: |-
         --lockfile=pnpm-lock.yaml
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 29ed6a9..68462c1 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -54,7 +54,7 @@ jobs:
     steps:
       - name: Mint tau-release-bot token
         id: bot
-        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2.0.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}
@@ -64,7 +64,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.workflow_run.head_sha || 'main' }}