diff --git a/.github/workflows/build-doc.yml b/.github/workflows/build-doc.yml
index a357f97c17..b94748e234 100644
--- a/.github/workflows/build-doc.yml
+++ b/.github/workflows/build-doc.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           python-version: "3.9"
 
@@ -56,14 +56,14 @@ jobs:
           python check-or-enforce-order.py build/html
 
       - name: Upload HTML docs artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: doc-html
           path: doc/build/html/
 
       - name: Create GitHub App token
         if: github.ref_name == 'doc-prod' && github.event_name == 'push'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.GRAPHING_LIBRARIES_CI_GHAPP_ID }}
diff --git a/.github/workflows/build-package.yml b/.github/workflows/build-package.yml
index 02d65f8ed4..b0cea5da8a 100644
--- a/.github/workflows/build-package.yml
+++ b/.github/workflows/build-package.yml
@@ -21,11 +21,11 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "22"
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: PyPI Build
         run: |
           uv venv
@@ -42,7 +42,7 @@ jobs:
         run: |
           tar czf output.tgz output
       - name: Upload output artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: full-build-output
           path: output.tgz
diff --git a/.github/workflows/check-codegen.yml b/.github/workflows/check-codegen.yml
index 3e882f3882..fd15dca189 100644
--- a/.github/workflows/check-codegen.yml
+++ b/.github/workflows/check-codegen.yml
@@ -22,7 +22,7 @@ jobs:
         python-version: "3.x"
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
     - name: Install dependencies
       run: |
diff --git a/.github/workflows/check-formatting.yml b/.github/workflows/check-formatting.yml
index 8d8f9a1deb..6daa411a4d 100644
--- a/.github/workflows/check-formatting.yml
+++ b/.github/workflows/check-formatting.yml
@@ -21,7 +21,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
diff --git a/.github/workflows/check-js-build.yml b/.github/workflows/check-js-build.yml
index 79353f6efe..9f02af3e7d 100644
--- a/.github/workflows/check-js-build.yml
+++ b/.github/workflows/check-js-build.yml
@@ -37,12 +37,12 @@ jobs:
           echo "✅ Version number $JSPROJECT_VERSION in $PKGJSON_PATH matches version number $PYPROJECT_VERSION in $PYPROJECT_PATH"
         fi
     - name: Install Node
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
       with:
         node-version: '22'
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
     - name: Copy current files to a temporary directory
       run: |
@@ -76,7 +76,7 @@ jobs:
         fi
 
     - name: Store the build artifacts from plotly/labextension
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       if: failure()
       with:
         name: labextension
diff --git a/.github/workflows/run-percy.yml b/.github/workflows/run-percy.yml
index a4c90b2750..3dd072267c 100644
--- a/.github/workflows/run-percy.yml
+++ b/.github/workflows/run-percy.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "22"
       - name: Set up Chrome
@@ -34,7 +34,7 @@ jobs:
         with:
           install-chromedriver: true
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install requirements
         run: |
           uv venv
diff --git a/.github/workflows/run-pytest.yml b/.github/workflows/run-pytest.yml
index 12ab213ca4..ac90147c45 100644
--- a/.github/workflows/run-pytest.yml
+++ b/.github/workflows/run-pytest.yml
@@ -25,7 +25,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
@@ -54,7 +54,7 @@ jobs:
       - name: Set up Chrome for Pytest
         uses: ./.github/actions/setup-chrome-for-pytest
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
@@ -106,7 +106,7 @@ jobs:
       - name: Set up Chrome for browser tests
         uses: ./.github/actions/setup-chrome-for-pytest
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
@@ -151,7 +151,7 @@ jobs:
         with:
           install-chromedriver: true
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
@@ -179,7 +179,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
diff --git a/.github/workflows/test-plotlyjs-dev.yml b/.github/workflows/test-plotlyjs-dev.yml
index 2fc717f448..8102a43e60 100644
--- a/.github/workflows/test-plotlyjs-dev.yml
+++ b/.github/workflows/test-plotlyjs-dev.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       - name: Install dependencies
         run: |
           uv venv
diff --git a/.github/workflows/test-release.yml b/.github/workflows/test-release.yml
index 80fe4daf51..362818a6b0 100644
--- a/.github/workflows/test-release.yml
+++ b/.github/workflows/test-release.yml
@@ -21,12 +21,12 @@ jobs:
         python-version: "3.x"
     
     - name: Install Node
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
       with:
         node-version: '22'
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
     - name: Install npm dependencies
       run: |
@@ -46,7 +46,7 @@ jobs:
     - name: Build a binary wheel and a source tarball
       run: python3 -m build
     - name: Store the distribution packages
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: python-package-distributions
         path: dist/
@@ -66,7 +66,7 @@ jobs:
 
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
       with:
         name: python-package-distributions
         path: dist/