diff --git a/.github/workflows/agents-publish.yml b/.github/workflows/agents-publish.yml
index e3f1b84c2c..c891c2a90d 100644
--- a/.github/workflows/agents-publish.yml
+++ b/.github/workflows/agents-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -59,8 +59,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm --filter agents... build && pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/blake3-wasm-publish.yml b/.github/workflows/blake3-wasm-publish.yml
index 0b994c9147..ea6fb79d3c 100644
--- a/.github/workflows/blake3-wasm-publish.yml
+++ b/.github/workflows/blake3-wasm-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/blob-publish.yml b/.github/workflows/blob-publish.yml
index 866b240aaf..530724a1fe 100644
--- a/.github/workflows/blob-publish.yml
+++ b/.github/workflows/blob-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/dduf-publish.yml b/.github/workflows/dduf-publish.yml
index 1ac61a34e5..880beabfd9 100644
--- a/.github/workflows/dduf-publish.yml
+++ b/.github/workflows/dduf-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -59,8 +59,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/gearhash-wasm-publish.yml b/.github/workflows/gearhash-wasm-publish.yml
index 7629d788ee..e65abd2c5f 100644
--- a/.github/workflows/gearhash-wasm-publish.yml
+++ b/.github/workflows/gearhash-wasm-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/gguf-publish.yml b/.github/workflows/gguf-publish.yml
index 067ed163a7..21b8aa764b 100644
--- a/.github/workflows/gguf-publish.yml
+++ b/.github/workflows/gguf-publish.yml
@@ -32,7 +32,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -40,7 +40,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -64,8 +64,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/hub-publish.yml b/.github/workflows/hub-publish.yml
index 5026bb01c8..05f847bc5e 100644
--- a/.github/workflows/hub-publish.yml
+++ b/.github/workflows/hub-publish.yml
@@ -32,7 +32,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -40,7 +40,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -69,7 +69,7 @@ jobs:
       - run: pnpm publish --no-git-checks .
 
       # hack - reuse actions/setup-node@v3 just to set a new registry
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/inference-publish.yml b/.github/workflows/inference-publish.yml
index 73ef927de6..3b2078348b 100644
--- a/.github/workflows/inference-publish.yml
+++ b/.github/workflows/inference-publish.yml
@@ -32,7 +32,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -40,7 +40,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -68,8 +68,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/jinja-publish.yml b/.github/workflows/jinja-publish.yml
index 28569e780a..9df07c7a38 100644
--- a/.github/workflows/jinja-publish.yml
+++ b/.github/workflows/jinja-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/languages-publish.yml b/.github/workflows/languages-publish.yml
index 1b8b650941..be8cbc8c6e 100644
--- a/.github/workflows/languages-publish.yml
+++ b/.github/workflows/languages-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3b10e3b8dc..33378d1485 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           # Could use something like rmacklin/fetch-through-merge-base@v0 instead when the repo gets bigger
           fetch-depth: 0
@@ -31,7 +31,7 @@ jobs:
 
       - run: npm install -g corepack@latest && corepack enable
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "pnpm"
diff --git a/.github/workflows/mcp-client-publish.yml b/.github/workflows/mcp-client-publish.yml
index 8e809d3e7c..d6c7da269e 100644
--- a/.github/workflows/mcp-client-publish.yml
+++ b/.github/workflows/mcp-client-publish.yml
@@ -32,11 +32,11 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -64,8 +64,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/ollama-template-update.yml b/.github/workflows/ollama-template-update.yml
index 0f896a0314..fe6c7d59e1 100644
--- a/.github/workflows/ollama-template-update.yml
+++ b/.github/workflows/ollama-template-update.yml
@@ -14,7 +14,7 @@ jobs:
   update-ollama-templates:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         if: github.repository == 'huggingface/huggingface.js'
 
       - name: Prepare
@@ -76,7 +76,7 @@ jobs:
 
       - name: Create PR
         if: steps.changes.outputs.HAS_CHANGES == 'true' && github.repository == 'huggingface/huggingface.js'
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
         env:
           CURRENT_DATE: ${{ steps.prepare.outputs.CURRENT_DATE }}
           NEW_BRANCH: ${{ steps.changes.outputs.NEW_BRANCH }}
diff --git a/.github/workflows/ollama-utils-publish.yml b/.github/workflows/ollama-utils-publish.yml
index f65d386dce..c2c7f6b55b 100644
--- a/.github/workflows/ollama-utils-publish.yml
+++ b/.github/workflows/ollama-utils-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -59,8 +59,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/space-header-publish.yml b/.github/workflows/space-header-publish.yml
index 3e368f325f..118d0ea700 100644
--- a/.github/workflows/space-header-publish.yml
+++ b/.github/workflows/space-header-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/splitmix64-wasm-publish.yml b/.github/workflows/splitmix64-wasm-publish.yml
index 1d9f742c70..757ec50bf0 100644
--- a/.github/workflows/splitmix64-wasm-publish.yml
+++ b/.github/workflows/splitmix64-wasm-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/tasks-publish.yml b/.github/workflows/tasks-publish.yml
index d90bb4d9e9..5c082688a2 100644
--- a/.github/workflows/tasks-publish.yml
+++ b/.github/workflows/tasks-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e99f6377f9..98152c84f5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           # Could use something like rmacklin/fetch-through-merge-base@v0 instead when the repo gets bigger
           fetch-depth: 0
@@ -30,7 +30,7 @@ jobs:
 
       - run: npm install -g corepack@latest && corepack enable
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "pnpm"
@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           # Could use something like rmacklin/fetch-through-merge-base@v0 instead when the repo gets bigger
           fetch-depth: 0
@@ -70,7 +70,7 @@ jobs:
 
       - run: npm install -g corepack@latest && corepack enable
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: "pnpm"
@@ -90,11 +90,11 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
       - run: npm install -g corepack@latest && corepack enable
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "pnpm"
diff --git a/.github/workflows/tiny-agents-publish.yml b/.github/workflows/tiny-agents-publish.yml
index 70382189d7..cdb42a4145 100644
--- a/.github/workflows/tiny-agents-publish.yml
+++ b/.github/workflows/tiny-agents-publish.yml
@@ -32,11 +32,11 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -64,8 +64,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
index c1b045b124..596a2a6905 100644
--- a/.github/workflows/trufflehog.yml
+++ b/.github/workflows/trufflehog.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Secret Scanning
diff --git a/.github/workflows/update-specs.yml b/.github/workflows/update-specs.yml
index 1dc53e45e5..a1221c7804 100644
--- a/.github/workflows/update-specs.yml
+++ b/.github/workflows/update-specs.yml
@@ -18,8 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Setup
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
       - name: Install pnpm
diff --git a/.github/workflows/xetchunk-wasm-publish.yml b/.github/workflows/xetchunk-wasm-publish.yml
index e5061b9223..636eedaf66 100644
--- a/.github/workflows/xetchunk-wasm-publish.yml
+++ b/.github/workflows/xetchunk-wasm-publish.yml
@@ -28,7 +28,7 @@ jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Needed to push the tag and the commit on the main branch, otherwise we get:
           # > Run git push --follow-tags
@@ -36,7 +36,7 @@ jobs:
           # remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
       - run: npm install -g corepack@latest && corepack enable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: "pnpm"
@@ -56,8 +56,8 @@ jobs:
       - run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
 
       - run: pnpm publish --no-git-checks .
-      # hack - reuse actions/setup-node@v4 just to set a new registry
-      - uses: actions/setup-node@v4
+      # hack - reuse actions/setup-node@v6 just to set a new registry
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"