diff --git a/.github/workflows/test_docs.yml b/.github/workflows/test_docs.yml
index 9e9562b2f2..42d0d9692c 100644
--- a/.github/workflows/test_docs.yml
+++ b/.github/workflows/test_docs.yml
@@ -9,7 +9,7 @@ jobs:
         name: Build Sphinx documentation
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
             - uses: prefix-dev/setup-pixi@d3f436a425481402e6a95a1d1fc10331c708cd9e # v0.10.2
diff --git a/.github/workflows/test_planemo.yml b/.github/workflows/test_planemo.yml
index 1d04441953..286d3e05e6 100644
--- a/.github/workflows/test_planemo.yml
+++ b/.github/workflows/test_planemo.yml
@@ -40,7 +40,7 @@ jobs:
                     - plotPCA
                     - plotProfiler
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
             - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1
diff --git a/.github/workflows/test_pytest.yml b/.github/workflows/test_pytest.yml
index 10459403af..b4e1477ffa 100644
--- a/.github/workflows/test_pytest.yml
+++ b/.github/workflows/test_pytest.yml
@@ -9,10 +9,10 @@ jobs:
         name: Check deeptools/galaxy/Rust versions stay in sync
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: "3.x"
             - name: Check version sync
@@ -24,7 +24,7 @@ jobs:
             matrix:
                 pixi-env: [py312, py313, py314]
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
             - uses: prefix-dev/setup-pixi@d3f436a425481402e6a95a1d1fc10331c708cd9e # v0.10.2
@@ -45,7 +45,7 @@ jobs:
             matrix:
                 pixi-env: [py312, py313, py314]
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
             - uses: prefix-dev/setup-pixi@d3f436a425481402e6a95a1d1fc10331c708cd9e # v0.10.2
diff --git a/.github/workflows/test_rust.yml b/.github/workflows/test_rust.yml
index 0f2b757d02..15ed31703b 100644
--- a/.github/workflows/test_rust.yml
+++ b/.github/workflows/test_rust.yml
@@ -14,7 +14,7 @@ jobs:
         name: run cargo test
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
             - run: rustup update stable && rustup default stable
diff --git a/.github/workflows/wheels-preview.yml b/.github/workflows/wheels-preview.yml
index f9a1a4739b..b797dabd12 100644
--- a/.github/workflows/wheels-preview.yml
+++ b/.github/workflows/wheels-preview.yml
@@ -20,10 +20,10 @@ jobs:
                     - runner: ubuntu-22.04
                       target: aarch64
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Set preview version
@@ -62,7 +62,7 @@ jobs:
                           gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross crossbuild-essential-arm64
                       fi
             - name: Upload wheels
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-linux-${{ matrix.platform.target }}
                   path: dist
@@ -77,10 +77,10 @@ jobs:
                     - runner: ubuntu-22.04
                       target: aarch64
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Set preview version
@@ -110,7 +110,7 @@ jobs:
                         apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
                       fi
             - name: Upload wheels
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-musllinux-${{ matrix.platform.target }}
                   path: dist
@@ -125,10 +125,10 @@ jobs:
                     - runner: macos-latest
                       target: aarch64
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Set preview version
@@ -151,7 +151,7 @@ jobs:
                   target: ${{ matrix.platform.target }}
                   args: --release --out dist --find-interpreter
             - name: Upload wheels
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-macos-${{ matrix.platform.target }}
                   path: dist
@@ -159,10 +159,10 @@ jobs:
     sdist:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Set preview version
@@ -185,7 +185,7 @@ jobs:
                   command: sdist
                   args: --out dist
             - name: Upload sdist
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-sdist
                   path: dist
@@ -195,7 +195,7 @@ jobs:
         runs-on: ubuntu-latest
         needs: [linux, musllinux, macos, sdist]
         steps:
-            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
               with:
                   pattern: wheels-*
                   path: dist
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 214f6629ac..bf23d7e42a 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -19,10 +19,10 @@ jobs:
                     - runner: ubuntu-22.04
                       target: aarch64
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Build wheels
@@ -62,7 +62,7 @@ jobs:
                       # fi
                       # env | grep SSL  # for debugging when rust crate fails to find headers
             - name: Upload wheels
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-linux-${{ matrix.platform.target }}
                   path: dist
@@ -77,10 +77,10 @@ jobs:
                     - runner: ubuntu-22.04
                       target: aarch64
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Build wheels
@@ -97,7 +97,7 @@ jobs:
                         apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
                       fi
             - name: Upload wheels
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-musllinux-${{ matrix.platform.target }}
                   path: dist
@@ -112,10 +112,10 @@ jobs:
                     - runner: macos-latest
                       target: aarch64
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: 3.x
             - name: Build wheels
@@ -124,7 +124,7 @@ jobs:
                   target: ${{ matrix.platform.target }}
                   args: --release --out dist --find-interpreter
             - name: Upload wheels
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-macos-${{ matrix.platform.target }}
                   path: dist
@@ -132,7 +132,7 @@ jobs:
     sdist:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                 persist-credentials: false
             - name: Build sdist
@@ -141,7 +141,7 @@ jobs:
                   command: sdist
                   args: --out dist
             - name: Upload sdist
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: wheels-sdist
                   path: dist
@@ -156,13 +156,13 @@ jobs:
             contents: write
             attestations: write
         steps:
-            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
               with:
                   pattern: wheels-*
                   path: dist
                   merge-multiple: true
             - name: Generate artifact attestation
-              uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
+              uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
               with:
                   subject-path: "dist/*"
             - name: Publish to PyPI