diff --git a/.github/workflows/apply-version.yml b/.github/workflows/apply-version.yml
index 49ed2469..eeda494c 100644
--- a/.github/workflows/apply-version.yml
+++ b/.github/workflows/apply-version.yml
@@ -19,11 +19,11 @@ jobs:
     name: Apply Version Bump
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c51ecac3..069573d3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -39,12 +39,12 @@ jobs:
       RUSTC_WRAPPER: "sccache"
       SCCACHE_CACHE_SIZE: "50G"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: recursive
     - uses: dtolnay/rust-toolchain@stable
     - name: Install sccache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@v0.0.11
     - name: Run deterministic adversarial + fuzz smoke tests
       run: cargo test --test security --release
       env:
@@ -70,7 +70,7 @@ jobs:
           # - x86_64-unknown-netbsd
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         submodules: recursive
 
@@ -107,7 +107,7 @@ jobs:
           - armv7-linux-androideabi
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up Rust
       uses: dtolnay/rust-toolchain@stable
@@ -117,13 +117,13 @@ jobs:
       run: rustup target add ${{ matrix.target }}
 
     - name: Setup Java
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@v6
       with:
         distribution: 'temurin'
         java-version: '17'
 
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      uses: android-actions/setup-android@v4
 
     - name: Setup Android NDK
       uses: arqu/setup-ndk@main
@@ -151,7 +151,7 @@ jobs:
           - i686-unknown-linux-gnu
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         submodules: recursive
 
@@ -178,7 +178,7 @@ jobs:
           RUSTFLAGS: '--cfg getrandom_backend="wasm_js"'
       steps:
         - name: Checkout sources
-          uses: actions/checkout@v6
+          uses: actions/checkout@v7
   
         - name: Install stable toolchain
           uses: dtolnay/rust-toolchain@stable
@@ -205,11 +205,11 @@ jobs:
       RUSTC_WRAPPER: "sccache"
       SCCACHE_GHA_ENABLED: "on"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       - name: Setup Environment (PR)
         if: ${{ github.event_name == 'pull_request' }}
@@ -236,11 +236,11 @@ jobs:
       RUSTC_WRAPPER: "sccache"
       SCCACHE_GHA_ENABLED: "on"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@stable
       with:
         components: rustfmt
-    - uses: mozilla-actions/sccache-action@v0.0.9
+    - uses: mozilla-actions/sccache-action@v0.0.11
     - uses: taiki-e/install-action@cargo-make
     - run: cargo make format-check
 
@@ -256,10 +256,10 @@ jobs:
       # rustdoc::broken_intra_doc_links at the crate root (src/lib.rs).
       RUSTDOCFLAGS: -Dwarnings
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       - name: Build docs (all features, no deps)
         # --all-features matches [package.metadata.docs.rs] (all-features = true)
@@ -316,12 +316,12 @@ jobs:
       RUSTC_WRAPPER: "sccache"
       SCCACHE_GHA_ENABLED: "on"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@stable
       with:
         components: clippy
     - name: Install sccache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@v0.0.11
 
     - name: clippy (${{ matrix.name }})
       run: cargo clippy ${{ matrix.clippy_args }}
@@ -335,12 +335,12 @@ jobs:
       RUSTC_WRAPPER: "sccache"
       SCCACHE_GHA_ENABLED: "on"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@master
       with:
         toolchain: ${{ env.MSRV }}
     - name: Install sccache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@v0.0.11
 
     - name: Check MSRV all features
       run: |
@@ -351,7 +351,7 @@ jobs:
     name: cargo deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           arguments: --workspace --all-features
@@ -362,7 +362,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - run: pip install --user codespell[toml]
     - run: codespell --ignore-words-list=ans,atmost,crate,inout,ratatui,ser,stayin,swarmin,worl --skip=docs/CHANGELOG.md
 
@@ -375,6 +375,6 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Report architectural growth and enforce curated caps
       run: ./scripts/check-module-size.sh --enforce
diff --git a/.github/workflows/cleanup.yaml b/.github/workflows/cleanup.yaml
index c5f32712..a2a882e5 100644
--- a/.github/workflows/cleanup.yaml
+++ b/.github/workflows/cleanup.yaml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: generated-docs-preview
       - name: Clean docs branch
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 36394e3f..15444466 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,9 +15,9 @@ jobs:
       security-events: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: rust
 
@@ -29,4 +29,4 @@ jobs:
       - name: Build
         run: cargo build --features gui --bin boru
 
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 89957829..ddcfe020 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -29,12 +29,12 @@ jobs:
       PREVIEW_PATH: pr/${{ github.event.pull_request.number || inputs.pr_number }}/docs
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@master
       with:
         toolchain: nightly-2025-10-09
     - name: Install sccache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@v0.0.11
 
     - name: Generate Docs
       run: cargo doc --workspace --all-features --no-deps
diff --git a/.github/workflows/flaky.yaml b/.github/workflows/flaky.yaml
index 59611bf5..4780d78a 100644
--- a/.github/workflows/flaky.yaml
+++ b/.github/workflows/flaky.yaml
@@ -59,7 +59,7 @@ jobs:
           echo TESTS_RESULT=$result
           echo "TESTS_RESULT=$result" >>"$GITHUB_ENV"
       - name: download nextest reports
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: libtest_run_${{ github.run_number }}-${{ github.run_attempt }}-*
           merge-multiple: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 12de2b9a..ac5e63a0 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -39,7 +39,7 @@ jobs:
             features: gui
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Validate release version
         run: python3 scripts/release-validate.py "${{ github.event.inputs.release_version }}"
@@ -150,7 +150,7 @@ jobs:
           fi
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}
           path: |
@@ -161,7 +161,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Validate release version
         run: python3 scripts/release-validate.py "${{ github.event.inputs.release_version }}"
@@ -169,7 +169,7 @@ jobs:
         run: |
           cargo metadata --locked --format-version 1 > cargo-metadata.json
           python3 scripts/generate-spdx-sbom.py cargo-metadata.json boru-cargo-sbom.spdx.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: boru-cargo-sbom
           path: boru-cargo-sbom.spdx.json
@@ -182,8 +182,8 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
       - name: Assemble and verify release payloads
         shell: bash
         run: |
@@ -198,7 +198,7 @@ jobs:
           BORU_LINUX_SIGNING_PUBLIC_KEY: ${{ secrets.BORU_LINUX_SIGNING_PUBLIC_KEY }}
         run: bash scripts/release-sign.sh linux release-assets/SHA256SUMS
       - name: Attest release payload provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: release-assets/*
 
@@ -212,7 +212,7 @@ jobs:
           fi
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: ${{ steps.version.outputs.tag }}
diff --git a/.github/workflows/simulation.yaml b/.github/workflows/simulation.yaml
index 2b0c18f8..2d46c117 100644
--- a/.github/workflows/simulation.yaml
+++ b/.github/workflows/simulation.yaml
@@ -10,7 +10,7 @@ jobs:
       SCCACHE_GHA_ENABLED: "on"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -18,7 +18,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       - name: Install mold linker
         # .cargo/config.toml links x86_64-unknown-linux-gnu with mold
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 1b56505a..f7ba2242 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -32,7 +32,7 @@ jobs:
     runs-on: [self-hosted, linux, X64]
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         ref: ${{ inputs.git-ref }}
     - name: Install ${{ inputs.rust-version }} rust
@@ -69,7 +69,7 @@ jobs:
       RUSTC_WRAPPER: "sccache"
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         ref: ${{ inputs.git-ref }}
 
@@ -84,7 +84,7 @@ jobs:
         tool: nextest@0.9.80
 
     - name: Install sccache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@v0.0.11
 
     - name: Select features
       run: |
@@ -137,7 +137,7 @@ jobs:
 
     - name: upload results
       if: ${{ failure() && inputs.flaky }}
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: libtest_run_${{ github.run_number }}-${{ github.run_attempt }}-${{ matrix.name }}_${{ matrix.features }}_${{ matrix.rust }}.json
         path: output
@@ -176,7 +176,7 @@ jobs:
       RUSTC_WRAPPER: "sccache"
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         ref: ${{ inputs.git-ref }}
 
@@ -214,7 +214,7 @@ jobs:
         }
 
     - name: Install sccache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@v0.0.11
 
     - uses: msys2/setup-msys2@v2
 
@@ -236,7 +236,7 @@ jobs:
   
     - name: upload results
       if: ${{ failure() && inputs.flaky }}
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: libtest_run_${{ github.run_number }}-${{ github.run_attempt }}-${{ matrix.name }}_${{ matrix.features }}_${{ matrix.rust }}.json
         path: output
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index d0915902..03c94af1 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -21,12 +21,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"