diff --git a/.github/workflows/autoscript.yml b/.github/workflows/autoscript.yml
index 13d61b0b..49c9c44b 100644
--- a/.github/workflows/autoscript.yml
+++ b/.github/workflows/autoscript.yml
@@ -29,7 +29,7 @@ jobs:
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
           BACKEND_URL:      ${{ secrets.BACKEND_URL }}
         run: python python/codehub.py ${{ github.event.inputs.command || 'all' }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: backups-${{ github.run_number }}
diff --git a/.github/workflows/build-apk.yml b/.github/workflows/build-apk.yml
index 236937df..3f0b1148 100644
--- a/.github/workflows/build-apk.yml
+++ b/.github/workflows/build-apk.yml
@@ -53,7 +53,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           # 8.11.1 = mínimo para AGP 8.9 (compileSdk 36)
           gradle-version: '8.13'
@@ -63,7 +63,7 @@ jobs:
       # trae el SDK pre-instalado (compileSdk 36) en $ANDROID_HOME.
       - name: Setup Android SDK
         id: setup-android
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         continue-on-error: true
 
       - name: Accept SDK licenses
@@ -149,7 +149,7 @@ jobs:
 
       - name: Upload compile log (debug)
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: compile-debug-log
           path: ${{ runner.temp }}/compile-debug.log
@@ -348,7 +348,7 @@ jobs:
 
       - name: Upload release build log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-build-log
           path: ${{ runner.temp }}/release-build.log
@@ -451,7 +451,7 @@ jobs:
 
       - name: Upload APK artifact
         if: always() && hashFiles('apk/android/**/*.apk') != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codehub-apk-build
           path: apk/android/**/*.apk
diff --git a/.github/workflows/dedupe-catalog.yml b/.github/workflows/dedupe-catalog.yml
index faca30be..353ed5c8 100644
--- a/.github/workflows/dedupe-catalog.yml
+++ b/.github/workflows/dedupe-catalog.yml
@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: ⚙️ Setup Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5dc96c26..0de7baab 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
       - name: Instalar dependencias
diff --git a/.github/workflows/echo-build.yml b/.github/workflows/echo-build.yml
index 53083956..ddc893f2 100644
--- a/.github/workflows/echo-build.yml
+++ b/.github/workflows/echo-build.yml
@@ -30,13 +30,13 @@ jobs:
           distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           gradle-version: '8.13'
 
       - name: Setup Android SDK
         id: setup-android
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         continue-on-error: true
 
       - name: Accept SDK licenses
@@ -132,7 +132,7 @@ jobs:
 
       - name: Subir logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: echo-build-logs
           path: |
@@ -143,7 +143,7 @@ jobs:
 
       - name: Subir APK debug (prueba en dispositivo)
         if: success()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codehub-echo-debug-apk
           path: apk/android/app/build/outputs/apk/debug/app-debug.apk
diff --git a/.github/workflows/enrich-app-logos.yml b/.github/workflows/enrich-app-logos.yml
index 387a5995..5000d8f7 100644
--- a/.github/workflows/enrich-app-logos.yml
+++ b/.github/workflows/enrich-app-logos.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: ⚙️ Setup Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/generate-cert-pin.yml b/.github/workflows/generate-cert-pin.yml
index e37b0720..57804207 100644
--- a/.github/workflows/generate-cert-pin.yml
+++ b/.github/workflows/generate-cert-pin.yml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
 
       - name: Descargar APK del release
         env:
diff --git a/.github/workflows/keystore-generate.yml b/.github/workflows/keystore-generate.yml
index c3c4d543..274789b5 100644
--- a/.github/workflows/keystore-generate.yml
+++ b/.github/workflows/keystore-generate.yml
@@ -78,7 +78,7 @@ jobs:
           fi
 
       - name: Subir keystore como artefacto (descargar y guardar fuera)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codehub-release-keystore
           path: |
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 4bd589f0..21287592 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -76,7 +76,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -95,7 +95,7 @@ jobs:
 
       - name: Subir reporte si falla
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report
           path: playwright-report/
@@ -111,7 +111,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -130,7 +130,7 @@ jobs:
 
       - name: Subir reporte Lighthouse
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: lighthouse-report
           path: lighthouse-out/
diff --git a/.github/workflows/rebuild-assets.yml b/.github/workflows/rebuild-assets.yml
index 345fc271..d893016c 100644
--- a/.github/workflows/rebuild-assets.yml
+++ b/.github/workflows/rebuild-assets.yml
@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/seed-foss-catalog.yml b/.github/workflows/seed-foss-catalog.yml
index 361ff446..38fd7fa3 100644
--- a/.github/workflows/seed-foss-catalog.yml
+++ b/.github/workflows/seed-foss-catalog.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: ⚙️ Setup Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/vapid-keys.yml b/.github/workflows/vapid-keys.yml
index 8a016a6d..67201380 100644
--- a/.github/workflows/vapid-keys.yml
+++ b/.github/workflows/vapid-keys.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'