diff --git a/.github/workflows/api.yaml b/.github/workflows/api.yaml
index 9141b429138..3c8d4582ae8 100644
--- a/.github/workflows/api.yaml
+++ b/.github/workflows/api.yaml
@@ -48,11 +48,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -62,14 +62,14 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-api
       - name: Run tests
         run: ./run_tests.sh --coverage --skip_flakey_fails -api lib/galaxy_test/api -- --num-shards=2 --shard-id=${{ matrix.chunk }}
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: api
           working-directory: 'galaxy root'
diff --git a/.github/workflows/bioblend.yaml b/.github/workflows/bioblend.yaml
index 9048f7f23c9..e076cfd6c60 100644
--- a/.github/workflows/bioblend.yaml
+++ b/.github/workflows/bioblend.yaml
@@ -36,13 +36,13 @@ jobs:
         galaxy_python_version: ['3.10']
     steps:
       - name: Checkout Galaxy
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 1
           path: galaxy
           persist-credentials: false
       - name: Checkout Bioblend
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           repository: galaxyproject/bioblend
           path: bioblend
@@ -51,7 +51,7 @@ jobs:
         id: get_bioblend_python_version
         run: echo "bioblend_python_version=$(echo "${{ matrix.tox_env }}" | sed -e 's/^py\([3-9]\)\([0-9]\+\)/\1.\2/')" >> $GITHUB_OUTPUT
       - name: Set up Python for BioBlend
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ steps.get_bioblend_python_version.outputs.bioblend_python_version }}
       - name: Install uv
@@ -59,7 +59,7 @@ jobs:
       - name: Install tox
         run: uv tool install tox --with tox-uv
       - name: Set up Python for Galaxy
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.galaxy_python_version }}
       - name: Run tests
diff --git a/.github/workflows/build_client.yaml b/.github/workflows/build_client.yaml
index eebb018eabc..caa7fa0c70c 100644
--- a/.github/workflows/build_client.yaml
+++ b/.github/workflows/build_client.yaml
@@ -11,7 +11,7 @@ jobs:
     outputs:
       commit-id: ${{ steps.client-commit.outputs.commit }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
@@ -31,7 +31,7 @@ jobs:
         run: echo "commit=$(git rev-parse HEAD 2>/dev/null)" >> $GITHUB_OUTPUT
         working-directory: 'galaxy root'
       - name: cache client build
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         id: cache
         with:
           key: galaxy-static-${{ steps.client-commit.outputs.commit }}
diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml
index 5f8b07e9ff5..368e5a55162 100644
--- a/.github/workflows/build_container_image.yaml
+++ b/.github/workflows/build_container_image.yaml
@@ -15,7 +15,7 @@ jobs:
     name: Build container image for GHCR
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
@@ -80,10 +80,10 @@ jobs:
       tag: ${{ steps.branch.outputs.name }}
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.12'
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
@@ -260,7 +260,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Checkout Galaxy Helm chart
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           repository: galaxyproject/galaxy-helm
           persist-credentials: false
diff --git a/.github/workflows/cff-validator.yaml b/.github/workflows/cff-validator.yaml
index 8c9bb67d8be..0c4efc41dad 100644
--- a/.github/workflows/cff-validator.yaml
+++ b/.github/workflows/cff-validator.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Validate CITATION.cff
diff --git a/.github/workflows/check_test_class_names.yaml b/.github/workflows/check_test_class_names.yaml
index 77313031fc7..12ee3ca7cde 100644
--- a/.github/workflows/check_test_class_names.yaml
+++ b/.github/workflows/check_test_class_names.yaml
@@ -17,10 +17,10 @@ jobs:
       matrix:
         python-version: ['3.10']
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/client-api-test.yaml b/.github/workflows/client-api-test.yaml
index 6da62e81ae1..d377b50528d 100644
--- a/.github/workflows/client-api-test.yaml
+++ b/.github/workflows/client-api-test.yaml
@@ -22,7 +22,7 @@ jobs:
   client-api-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Read Node.js version
diff --git a/.github/workflows/client-unit.yaml b/.github/workflows/client-unit.yaml
index 655a6443be0..e77f3d62303 100644
--- a/.github/workflows/client-unit.yaml
+++ b/.github/workflows/client-unit.yaml
@@ -16,7 +16,7 @@ jobs:
   client-unit-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Read Node.js version
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1528078f330..dca9e142ee0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/converter_tests.yaml b/.github/workflows/converter_tests.yaml
index 48f037ab106..9fd50b83cda 100644
--- a/.github/workflows/converter_tests.yaml
+++ b/.github/workflows/converter_tests.yaml
@@ -31,17 +31,17 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
       - name: Clone galaxyproject/galaxy-test-data
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           repository: galaxyproject/galaxy-test-data
           path: galaxy-test-data
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/cwl_conformance.yaml b/.github/workflows/cwl_conformance.yaml
index 5d163d4a63c..454f7e6ad87 100644
--- a/.github/workflows/cwl_conformance.yaml
+++ b/.github/workflows/cwl_conformance.yaml
@@ -40,11 +40,11 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -54,14 +54,14 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-api
       - name: Run tests
         run: ./run_tests.sh --coverage --skip_flakey_fails -cwl lib/galaxy_test/api/cwl -- -m "${{ matrix.marker }} and ${{ matrix.conformance-version }}"
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: cwl-conformance
           working-directory: 'galaxy root'
diff --git a/.github/workflows/db_indexes.yaml b/.github/workflows/db_indexes.yaml
index 47da5d6362f..569390ab9d6 100644
--- a/.github/workflows/db_indexes.yaml
+++ b/.github/workflows/db_indexes.yaml
@@ -41,11 +41,11 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml
index dde27e4945c..198981a2fdd 100644
--- a/.github/workflows/dependencies.yaml
+++ b/.github/workflows/dependencies.yaml
@@ -10,10 +10,10 @@ jobs:
     if: github.repository_owner == 'galaxyproject'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.10'
       - name: Install uv
diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml
index 27f56bd0a45..899e3be57e6 100644
--- a/.github/workflows/deployment.yaml
+++ b/.github/workflows/deployment.yaml
@@ -32,11 +32,11 @@ jobs:
       matrix:
         python-version: ['3.10']
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 7d680d24797..0efeee93b28 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -29,11 +29,11 @@ jobs:
         run: echo "TARGET_BRANCH=$GITHUB_BASE_REF" >> $GITHUB_ENV
       - name: Show target branch name
         run: echo $TARGET_BRANCH
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/first_startup.yaml b/.github/workflows/first_startup.yaml
index da41088b6c2..a0b47f06431 100644
--- a/.github/workflows/first_startup.yaml
+++ b/.github/workflows/first_startup.yaml
@@ -31,12 +31,12 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -46,7 +46,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Restore client cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/framework_tools.yaml b/.github/workflows/framework_tools.yaml
index e1a848b65c3..a850b26b4cb 100644
--- a/.github/workflows/framework_tools.yaml
+++ b/.github/workflows/framework_tools.yaml
@@ -44,11 +44,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -58,14 +58,14 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-framework
       - name: Run tests
         run: GALAXY_TEST_USE_LEGACY_TOOL_API="${{ matrix.use-legacy-api }}" ./run_tests.sh --coverage --framework-tools
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: framework
           working-directory: 'galaxy root'
diff --git a/.github/workflows/framework_workflows.yaml b/.github/workflows/framework_workflows.yaml
index d2b3119d7b3..de9c35daafb 100644
--- a/.github/workflows/framework_workflows.yaml
+++ b/.github/workflows/framework_workflows.yaml
@@ -44,11 +44,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -58,14 +58,14 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-framework
       - name: Run tests
         run: ./run_tests.sh --coverage --framework-workflows
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: framework-workflows
           working-directory: 'galaxy root'
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index 814c5db7939..1c263522176 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -53,11 +53,11 @@ jobs:
           kubernetes-version: '1.28.0'
       - name: Check pods
         run: kubectl get pods -A
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -67,7 +67,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-integration
@@ -78,7 +78,7 @@ jobs:
           . .ci/minikube-test-setup/start_services.sh
           ./run_tests.sh --coverage -integration test/integration -- --num-shards=4 --shard-id=${{ matrix.chunk }}
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: integration
           working-directory: 'galaxy root'
diff --git a/.github/workflows/integration_selenium.yaml b/.github/workflows/integration_selenium.yaml
index 11d86a26ffa..7dd926f2ef2 100644
--- a/.github/workflows/integration_selenium.yaml
+++ b/.github/workflows/integration_selenium.yaml
@@ -55,11 +55,11 @@ jobs:
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
       - name: Prune unused docker image, volumes and containers
         run: docker system prune -a -f
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -69,12 +69,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-integration-selenium
       - name: Restore client cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
@@ -82,7 +82,7 @@ jobs:
       - name: Run tests
         run: ./run_tests.sh --coverage -integration test/integration_selenium
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: integration-selenium
           working-directory: 'galaxy root'
diff --git a/.github/workflows/js_lint.yaml b/.github/workflows/js_lint.yaml
index eba61e16694..56cd8edfebd 100644
--- a/.github/workflows/js_lint.yaml
+++ b/.github/workflows/js_lint.yaml
@@ -16,7 +16,7 @@ jobs:
   client-unit-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Read Node.js version
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index c20366f78de..af263e75bdf 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -37,10 +37,10 @@ jobs:
       TYPE_PATH: 'lib/galaxy/dependencies/pinned-typecheck-requirements.txt'
       CORE_PATH: 'lib/galaxy/dependencies/pinned-requirements.txt'
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/lint_openapi_schema.yml b/.github/workflows/lint_openapi_schema.yml
index 481550dbaf8..eac684b3839 100644
--- a/.github/workflows/lint_openapi_schema.yml
+++ b/.github/workflows/lint_openapi_schema.yml
@@ -25,7 +25,7 @@ jobs:
       matrix:
         python-version: ['3.10', '3.14']
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
@@ -39,7 +39,7 @@ jobs:
         uses: pnpm/action-setup@v6
         with:
           package_json_file: 'galaxy root/client/package.json'
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -49,7 +49,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-api
diff --git a/.github/workflows/main_tools.yaml b/.github/workflows/main_tools.yaml
index 6b6425b68aa..a357c9e6bfe 100644
--- a/.github/workflows/main_tools.yaml
+++ b/.github/workflows/main_tools.yaml
@@ -36,11 +36,11 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -50,14 +50,14 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-framework
       - name: Run tests
         run: ./run_tests.sh --coverage --main_tools
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: main-tools
           working-directory: 'galaxy root'
diff --git a/.github/workflows/mulled.yaml b/.github/workflows/mulled.yaml
index 375ad84aecc..b5cd867863c 100644
--- a/.github/workflows/mulled.yaml
+++ b/.github/workflows/mulled.yaml
@@ -25,11 +25,11 @@ jobs:
       matrix:
         python-version: ['3.10']
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/osx_startup.yaml b/.github/workflows/osx_startup.yaml
index f09fe20d37a..023c81d5a81 100644
--- a/.github/workflows/osx_startup.yaml
+++ b/.github/workflows/osx_startup.yaml
@@ -29,7 +29,7 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
@@ -39,7 +39,7 @@ jobs:
           miniforge-version: latest
           activate-environment: ''
       - name: Restore client cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/performance.yaml b/.github/workflows/performance.yaml
index 9244c792560..e875d9d6ffd 100644
--- a/.github/workflows/performance.yaml
+++ b/.github/workflows/performance.yaml
@@ -42,11 +42,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -56,7 +56,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-performance
diff --git a/.github/workflows/playwright.yaml b/.github/workflows/playwright.yaml
index 77f9b3e7a2d..89b776ed20c 100644
--- a/.github/workflows/playwright.yaml
+++ b/.github/workflows/playwright.yaml
@@ -54,11 +54,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -68,12 +68,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-playwright
       - name: Restore client cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
@@ -81,7 +81,7 @@ jobs:
       - name: Run tests
         run: ./run_tests.sh --coverage -playwright lib/galaxy_test/selenium -- --num-shards=3 --shard-id=${{ matrix.chunk }}
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: playwright
           working-directory: 'galaxy root'
diff --git a/.github/workflows/publish_artifacts.yaml b/.github/workflows/publish_artifacts.yaml
index 660b01fc5d3..bcca8a56218 100644
--- a/.github/workflows/publish_artifacts.yaml
+++ b/.github/workflows/publish_artifacts.yaml
@@ -41,11 +41,11 @@ jobs:
     name: Build Python packages for PyPI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || '' }}
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.10'
       - name: Install uv
@@ -97,7 +97,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || '' }}
           persist-credentials: false
diff --git a/.github/workflows/selenium.yaml b/.github/workflows/selenium.yaml
index 4d8ff179ffb..5d00a6721ee 100644
--- a/.github/workflows/selenium.yaml
+++ b/.github/workflows/selenium.yaml
@@ -55,11 +55,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -69,12 +69,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-selenium
       - name: Restore client cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
@@ -82,7 +82,7 @@ jobs:
       - name: Run tests
         run: ./run_tests.sh --coverage -selenium lib/galaxy_test/selenium -- --num-shards=3 --shard-id=${{ matrix.chunk }}
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: selenium
           working-directory: 'galaxy root'
diff --git a/.github/workflows/test_galaxy_packages.yaml b/.github/workflows/test_galaxy_packages.yaml
index 055ba9cd286..42556cb9697 100644
--- a/.github/workflows/test_galaxy_packages.yaml
+++ b/.github/workflows/test_galaxy_packages.yaml
@@ -21,11 +21,11 @@ jobs:
       matrix:
         python-version: ['3.10', '3.14']
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/test_galaxy_packages_for_pulsar.yaml b/.github/workflows/test_galaxy_packages_for_pulsar.yaml
index 93ad8db7901..f9c00a582df 100644
--- a/.github/workflows/test_galaxy_packages_for_pulsar.yaml
+++ b/.github/workflows/test_galaxy_packages_for_pulsar.yaml
@@ -23,11 +23,11 @@ jobs:
       matrix:
         python-version: ['3.8']  # don't upgrade, see https://github.com/galaxyproject/galaxy/pull/16649
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/test_galaxy_release.yaml b/.github/workflows/test_galaxy_release.yaml
index 308d518bf2b..c774ef78b57 100644
--- a/.github/workflows/test_galaxy_release.yaml
+++ b/.github/workflows/test_galaxy_release.yaml
@@ -23,7 +23,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/tool_form_harness.yaml b/.github/workflows/tool_form_harness.yaml
index e750041e045..45f82fc1f02 100644
--- a/.github/workflows/tool_form_harness.yaml
+++ b/.github/workflows/tool_form_harness.yaml
@@ -64,11 +64,11 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -78,7 +78,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-playwright
@@ -91,7 +91,7 @@ jobs:
           playwright install chromium --with-deps
         working-directory: 'galaxy root'
       - name: Restore client cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
@@ -99,7 +99,7 @@ jobs:
       - name: Run tests
         run: ./run_tests.sh --coverage -playwright lib/galaxy_test/selenium/test_tool_form_harness.py
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: tool-form-harness
           working-directory: 'galaxy root'
diff --git a/.github/workflows/toolshed.yaml b/.github/workflows/toolshed.yaml
index de5194d929f..4d767584846 100644
--- a/.github/workflows/toolshed.yaml
+++ b/.github/workflows/toolshed.yaml
@@ -36,11 +36,11 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -50,7 +50,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-toolshed
diff --git a/.github/workflows/unit-postgres.yaml b/.github/workflows/unit-postgres.yaml
index 3af7ba9bf30..cf0cd63e579 100644
--- a/.github/workflows/unit-postgres.yaml
+++ b/.github/workflows/unit-postgres.yaml
@@ -36,11 +36,11 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -50,7 +50,7 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache galaxy venv
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-unit-postgres
diff --git a/.github/workflows/unit.yaml b/.github/workflows/unit.yaml
index 6a466052a9e..739fd2c99fe 100644
--- a/.github/workflows/unit.yaml
+++ b/.github/workflows/unit.yaml
@@ -25,11 +25,11 @@ jobs:
       matrix:
         python-version: ['3.10', '3.14']
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           path: 'galaxy root'
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
@@ -45,7 +45,7 @@ jobs:
       - name: Run tests
         run: tox -e unit-coverage
         working-directory: 'galaxy root'
-      - uses: codecov/codecov-action@v6.0.1
+      - uses: codecov/codecov-action@v7.0.0
         with:
           flags: py-unit
           working-directory: 'galaxy root'
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 84c709b172d..072b146ff78 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -20,7 +20,7 @@ jobs:
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false