diff --git a/.github/actions/cache/action.yml b/.github/actions/cache/action.yml
index abe176f..1e2fe48 100644
--- a/.github/actions/cache/action.yml
+++ b/.github/actions/cache/action.yml
@@ -50,7 +50,7 @@
       shell: bash
     - name: Cache all of cargo
       if: ${{ inputs.use-rust == 'true' }}
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       continue-on-error: true
       with:
         path: ~/.cargo
@@ -60,12 +60,12 @@
         CARGO_CACHE_KEY: ${{ env.CARGO_KEY }}-${{ runner.os }}-${{ runner.arch }}-${{ github.job }}-${{ inputs.extra-key }}
     - name: Cache external dependencies in ext
       id: cache-ext
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ext
         key: ext-${{ runner.os }}-${{ runner.arch }}-${{ github.job }}-${{ inputs.extra-key }}-${{ env.CARGO_KEY }}-${{ env.MESON_KEY }}-${{ hashFiles('.github/actions/**/*', steps.workflow-info.outputs.path, 'ext/*.cmd', 'ext/*.sh') }}
     - name: Cache external dependencies in build/_deps
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: build/_deps
         key: deps-${{ runner.os }}-${{ runner.arch }}-${{ github.job }}-${{ inputs.extra-key }}-${{ env.CARGO_KEY }}-${{ env.MESON_KEY }}-${{ hashFiles('.github/actions/**/*', steps.workflow-info.outputs.path, 'CMakeLists.txt', 'cmake/Modules/*') }}
diff --git a/.github/actions/setup-common/action.yml b/.github/actions/setup-common/action.yml
index 534d7ca..0bf8cd6 100644
--- a/.github/actions/setup-common/action.yml
+++ b/.github/actions/setup-common/action.yml
@@ -17,7 +17,7 @@
   using: "composite"
   steps:
     - name: Set up Python
-      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+      uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: "3.x"
     - name: Set up latest CMake
@@ -38,7 +38,7 @@
       uses: seanmiddleditch/gha-setup-ninja@3b1f8f94a2f8254bd26914c4ab9474d4f0015f67 # v6
     - name: Set up nasm
       if: ${{ inputs.codec-aom == 'LOCAL' || inputs.codec-dav1d == 'LOCAL' }}
-      uses: ilammy/setup-nasm@13cbeb366c45c4379d3478cdcbadd8295feb5028 # v1.5.1
+      uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2
     - name: Set up rust
       if: ${{ inputs.codec-rav1e == 'LOCAL' }}
       uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
diff --git a/.github/workflows/ci-android-emulator-tests.yml b/.github/workflows/ci-android-emulator-tests.yml
index a028280..596f1dc 100644
--- a/.github/workflows/ci-android-emulator-tests.yml
+++ b/.github/workflows/ci-android-emulator-tests.yml
@@ -29,7 +29,7 @@
 
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       # This is needed for faster emulators. See:
       # https://github.com/ReactiveCircus/android-emulator-runner?tab=readme-ov-file#running-hardware-accelerated-emulators-on-linux-runners
       - name: Enable KVM group perms
@@ -50,7 +50,7 @@
           libyuv: "LOCAL"
           oldest-cmake: true
       - name: Setup JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
         with:
           java-version: "17"
           distribution: "temurin"
diff --git a/.github/workflows/ci-android-jni.yml b/.github/workflows/ci-android-jni.yml
index 626f8b3..593b47d 100644
--- a/.github/workflows/ci-android-jni.yml
+++ b/.github/workflows/ci-android-jni.yml
@@ -17,7 +17,7 @@
 
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Download and Setup the Android NDK
         uses: nttld/setup-ndk@afb4c9964b521afb97c864b7d40b11e6911bd410 # v1.5.0
         id: setup-ndk
@@ -30,7 +30,7 @@
           codec-aom: "LOCAL"
           codec-dav1d: "LOCAL"
       - name: Setup JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
         with:
           distribution: "zulu"
           java-version: 17
diff --git a/.github/workflows/ci-c-warnings.yml b/.github/workflows/ci-c-warnings.yml
index 3a77638..ab3871c 100644
--- a/.github/workflows/ci-c-warnings.yml
+++ b/.github/workflows/ci-c-warnings.yml
@@ -24,7 +24,7 @@
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:
diff --git a/.github/workflows/ci-disable-gtest.yml b/.github/workflows/ci-disable-gtest.yml
index 463e168..6c9ce63 100644
--- a/.github/workflows/ci-disable-gtest.yml
+++ b/.github/workflows/ci-disable-gtest.yml
@@ -36,7 +36,7 @@
             gcc: 14
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-format-check.yml b/.github/workflows/ci-format-check.yml
index 775aaf4..820a5c1 100644
--- a/.github/workflows/ci-format-check.yml
+++ b/.github/workflows/ci-format-check.yml
@@ -13,7 +13,7 @@
   clang-format-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: RafikFarhad/clang-format-github-action@bf3713d4b192d5d8f0297bfed74fb3e7de41cf29 # v5
         with:
           style: file
@@ -23,7 +23,7 @@
   cmake-format-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: neg-c/cmake-format-action@v0.1.3
         with:
           exclude: libavif.pc.cmake
diff --git a/.github/workflows/ci-fuzztest.yml b/.github/workflows/ci-fuzztest.yml
index a82a681..afc088e 100644
--- a/.github/workflows/ci-fuzztest.yml
+++ b/.github/workflows/ci-fuzztest.yml
@@ -27,7 +27,7 @@
     name: build-shared-local-fuzztest
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         id: setup
         with:
diff --git a/.github/workflows/ci-linux-artifacts.yml b/.github/workflows/ci-linux-artifacts.yml
index b77cae7..a14672b 100644
--- a/.github/workflows/ci-linux-artifacts.yml
+++ b/.github/workflows/ci-linux-artifacts.yml
@@ -17,7 +17,7 @@
         os: [ubuntu-latest]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-linux-coverage.yml b/.github/workflows/ci-linux-coverage.yml
index 379869e..d70ba1e 100644
--- a/.github/workflows/ci-linux-coverage.yml
+++ b/.github/workflows/ci-linux-coverage.yml
@@ -20,7 +20,7 @@
         os: [ubuntu-latest]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         id: setup
         with:
@@ -52,7 +52,7 @@
 
       # See https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts
       - name: Archive coverage output
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: coverage-output
           path:  |
diff --git a/.github/workflows/ci-linux-golden-tests.yml b/.github/workflows/ci-linux-golden-tests.yml
index 19d5be8..d0ad14d 100644
--- a/.github/workflows/ci-linux-golden-tests.yml
+++ b/.github/workflows/ci-linux-golden-tests.yml
@@ -26,7 +26,7 @@
             gcc: 14
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         id: setup
         with:
@@ -60,7 +60,7 @@
       # See https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts
       - name: Archive golden tests output for debugging
         if: failure()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: golden-tests-output
           path: ${{ runner.temp }}/golden_tests/**/*
diff --git a/.github/workflows/ci-macos-artifacts.yml b/.github/workflows/ci-macos-artifacts.yml
index 3427855..e1e03dc 100644
--- a/.github/workflows/ci-macos-artifacts.yml
+++ b/.github/workflows/ci-macos-artifacts.yml
@@ -17,7 +17,7 @@
         os: [macos-latest]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-macos
         with:
           codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-mingw.yml b/.github/workflows/ci-mingw.yml
index e860976..d1bb21c 100644
--- a/.github/workflows/ci-mingw.yml
+++ b/.github/workflows/ci-mingw.yml
@@ -27,7 +27,7 @@
       run:
         shell: msys2 {0}
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: msys2/setup-msys2@v2
         with:
           msystem: ${{ matrix.sys }}
diff --git a/.github/workflows/ci-unix-shared-installed.yml b/.github/workflows/ci-unix-shared-installed.yml
index 76ffe22..604d2e9 100644
--- a/.github/workflows/ci-unix-shared-installed.yml
+++ b/.github/workflows/ci-unix-shared-installed.yml
@@ -34,7 +34,7 @@
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:
diff --git a/.github/workflows/ci-unix-shared-local.yml b/.github/workflows/ci-unix-shared-local.yml
index abcd067..6d114ed 100644
--- a/.github/workflows/ci-unix-shared-local.yml
+++ b/.github/workflows/ci-unix-shared-local.yml
@@ -29,7 +29,7 @@
     name: build-shared-local (${{ matrix.os }}, libyuv ${{ matrix.libyuv }})
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:
diff --git a/.github/workflows/ci-unix-static-av2.yml b/.github/workflows/ci-unix-static-av2.yml
index 3925882..0407b85 100644
--- a/.github/workflows/ci-unix-static-av2.yml
+++ b/.github/workflows/ci-unix-static-av2.yml
@@ -30,7 +30,7 @@
             gcc: 14
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         with:
           codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-unix-static-sanitized-memory.yml b/.github/workflows/ci-unix-static-sanitized-memory.yml
index 6d2a391..105f1aa 100644
--- a/.github/workflows/ci-unix-static-sanitized-memory.yml
+++ b/.github/workflows/ci-unix-static-sanitized-memory.yml
@@ -19,7 +19,7 @@
       CXX: clang++
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         id: setup_linux
diff --git a/.github/workflows/ci-unix-static-sanitized.yml b/.github/workflows/ci-unix-static-sanitized.yml
index 7d03aab..7e4cd1f 100644
--- a/.github/workflows/ci-unix-static-sanitized.yml
+++ b/.github/workflows/ci-unix-static-sanitized.yml
@@ -27,7 +27,7 @@
       CXX: clang++
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         id: setup_linux
diff --git a/.github/workflows/ci-unix-static.yml b/.github/workflows/ci-unix-static.yml
index cb726cd..3c6cf41 100644
--- a/.github/workflows/ci-unix-static.yml
+++ b/.github/workflows/ci-unix-static.yml
@@ -31,7 +31,7 @@
             gcc: 14
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-linux
         if: runner.os == 'Linux'
         with:
diff --git a/.github/workflows/ci-windows-artifacts.yml b/.github/workflows/ci-windows-artifacts.yml
index 90ccc40..2fdcce7 100644
--- a/.github/workflows/ci-windows-artifacts.yml
+++ b/.github/workflows/ci-windows-artifacts.yml
@@ -17,7 +17,7 @@
         os: [windows-latest]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-windows
         id: setup
         with:
diff --git a/.github/workflows/ci-windows-installed.yml b/.github/workflows/ci-windows-installed.yml
index 3562012..ceef83d 100644
--- a/.github/workflows/ci-windows-installed.yml
+++ b/.github/workflows/ci-windows-installed.yml
@@ -24,7 +24,7 @@
         compiler: [msvc, clang-cl]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-windows
         id: setup
         with:
diff --git a/.github/workflows/ci-windows-shared-local.yml b/.github/workflows/ci-windows-shared-local.yml
index 96c99e5..97e20e5 100644
--- a/.github/workflows/ci-windows-shared-local.yml
+++ b/.github/workflows/ci-windows-shared-local.yml
@@ -28,7 +28,7 @@
         compiler: [msvc, clang-cl]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-windows
         with:
           codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index 002c258..d574c1f 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml
@@ -36,7 +36,7 @@
         generator: [Ninja, "Visual Studio 17 2022"]
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/setup-windows
         id: setup
         with:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d1aa7f3..60c3e1f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -29,7 +29,7 @@
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
@@ -52,7 +52,7 @@
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -60,6 +60,6 @@
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+        uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
         with:
           sarif_file: results.sarif