diff --git a/.github/workflows/ecosystem-ci.yml b/.github/workflows/ecosystem-ci.yml
index c38f2e78bb65..c81d1ff5a15d 100644
--- a/.github/workflows/ecosystem-ci.yml
+++ b/.github/workflows/ecosystem-ci.yml
@@ -342,7 +342,7 @@ jobs:
 
       - name: Publish History
         if: ${{ success() }}
-        uses: JamesIves/github-pages-deploy-action@4a3abc783e1a24aeb44c16e869ad83caf6b4cc23 # v4.7.4
+        uses: JamesIves/github-pages-deploy-action@9d877eea73427180ae43cf98e8914934fe157a1a # v4.7.6
         with:
           branch: data
           folder: data-artifacts
diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml
index 9e645fa3f1ae..4377d7676978 100644
--- a/.github/workflows/issue-close-require.yml
+++ b/.github/workflows/issue-close-require.yml
@@ -15,7 +15,7 @@ jobs:
     if: github.repository_owner == 'web-infra-dev'
     steps:
       - name: need reproduce
-        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3
+        uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3
         with:
           actions: "close-issues"
           labels: "need reproduction"
@@ -24,7 +24,7 @@ jobs:
             Since the issue was labeled with `need reproduction`, but no response in 14 days. This issue will be closed. Feel free to comment and reopen it if you have any further questions.
 
       - name: need more info
-        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3
+        uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3
         with:
           actions: "close-issues"
           labels: "need more info"
@@ -33,7 +33,7 @@ jobs:
             Since the issue was labeled with `need more info`, but no response in 14 days. This issue will be closed. Feel free to comment and reopen it if you have any further questions.
 
       - name: awaiting feedback
-        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3
+        uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3
         with:
           actions: "close-issues"
           labels: "awaiting more feedback"
diff --git a/.github/workflows/label-auto-comment.yml b/.github/workflows/label-auto-comment.yml
index 2674b390e910..2ec590ecd6bc 100644
--- a/.github/workflows/label-auto-comment.yml
+++ b/.github/workflows/label-auto-comment.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: 🤔 Need Reproduce
         if: github.event.label.name == 'need reproduction'
-        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3.7.2
+        uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3.7.4
         with:
           actions: "create-comment"
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -28,7 +28,7 @@ jobs:
             Hello @${{ github.event.issue.user.login }}, sorry we can't investigate the problem further without reproduction demo, please provide a repro demo by forking [rspack-repro](https://github.com/web-infra-dev/rspack-repro), or provide a minimal GitHub repository by yourself. Issues labeled by `need reproduction` will be closed if no activities in 14 days.
       - name: invalid
         if: github.event.label.name == 'invalid'
-        uses: actions-cool/issues-helper@9861779a695cf1898bd984c727f685f351cfc372 # v3.7.2
+        uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3.7.4
         with:
           actions: "create-comment,close-issue"
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-build-bench.yml b/.github/workflows/reusable-build-bench.yml
index c3893bbd752e..16b473a3a1ea 100644
--- a/.github/workflows/reusable-build-bench.yml
+++ b/.github/workflows/reusable-build-bench.yml
@@ -42,7 +42,7 @@ jobs:
           key: build-bench-${{ inputs.target }}
 
       - name: Install cargo-codspeed binary
-        uses: taiki-e/install-action@92e6dd1c202153a204d471a3c509bf1e03dcfa44 # v2
+        uses: taiki-e/install-action@d850aa816998e5cf15f67a78c7b933f2a5033f8a # v2
         with:
           tool: cargo-codspeed@2.10.1
 
diff --git a/.github/workflows/reusable-build-codspeed.yml b/.github/workflows/reusable-build-codspeed.yml
index 0e241dd7ab71..910d252f2570 100644
--- a/.github/workflows/reusable-build-codspeed.yml
+++ b/.github/workflows/reusable-build-codspeed.yml
@@ -30,7 +30,7 @@ jobs:
           key: build-bench-${{ inputs.target }}
 
       - name: Install cargo-codspeed binary
-        uses: taiki-e/install-action@92e6dd1c202153a204d471a3c509bf1e03dcfa44 # v2
+        uses: taiki-e/install-action@d850aa816998e5cf15f67a78c7b933f2a5033f8a # v2
         with:
           tool: cargo-codspeed@2.10.1
 
diff --git a/.github/workflows/reusable-release-crates.yml b/.github/workflows/reusable-release-crates.yml
index ec0d429d5f8c..d8d8e07e7c37 100644
--- a/.github/workflows/reusable-release-crates.yml
+++ b/.github/workflows/reusable-release-crates.yml
@@ -42,7 +42,7 @@ jobs:
           save-if: true
           key: release
 
-      - uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+      - uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
 
       - name: Install cargo-workspaces
         run: cargo binstall --no-confirm cargo-workspaces@0.4.0 --force
diff --git a/.github/workflows/reusable-rust-test.yml b/.github/workflows/reusable-rust-test.yml
index 772ec526fe59..f47684d64a5d 100644
--- a/.github/workflows/reusable-rust-test.yml
+++ b/.github/workflows/reusable-rust-test.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Install cargo-binstall
         if: ${{ inputs.cargo-check-strategy == 'separated' }}
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
 
       - name: Install cargo-workspaces
         if: ${{ inputs.cargo-check-strategy == 'separated' }}
@@ -95,7 +95,7 @@ jobs:
         run: cargo codegen
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@92e6dd1c202153a204d471a3c509bf1e03dcfa44 # v2
+        uses: taiki-e/install-action@d850aa816998e5cf15f67a78c7b933f2a5033f8a # v2
         with:
           tool: cargo-deny@0.18.3
       - name: Check licenses
@@ -103,7 +103,7 @@ jobs:
           cargo deny --all-features check license bans
           cargo xtask deny-ext
 
-      - uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+      - uses: cargo-bins/cargo-binstall@ea60fcf749c6a52a729e0eaabb5eb33391d44823 # v1.16.4
       - run: cargo binstall --no-confirm cargo-shear@1.1.12 --force
       - run: cargo shear