diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml
index 43831a3..183e043 100644
--- a/.github/workflows/ai-code-review.yml
+++ b/.github/workflows/ai-code-review.yml
@@ -236,7 +236,7 @@ jobs:
         if: steps.validate_providers.outputs.skip_review != 'true' && env.BEDROCK_CONFIGURED == 'true'
         id: bedrock_review
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           use_bedrock: "true"
@@ -333,7 +333,7 @@ jobs:
           (env.BEDROCK_CONFIGURED != 'true' || steps.bedrock_review.outcome != 'success')
         id: anthropic_review
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -433,7 +433,7 @@ jobs:
           needs.preflight.outputs.should_consensus == 'true' &&
           steps.check_pal.outputs.configured == 'false'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -499,7 +499,7 @@ jobs:
           needs.preflight.outputs.should_consensus == 'true' &&
           steps.check_pal.outputs.configured == 'true'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -596,7 +596,7 @@ jobs:
         if: steps.security.outputs.safe == 'true' && env.BEDROCK_CONFIGURED == 'true'
         id: bedrock_fix
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           use_bedrock: "true"
@@ -629,7 +629,7 @@ jobs:
           (env.BEDROCK_CONFIGURED != 'true' || steps.bedrock_fix.outcome != 'success')
         id: anthropic_fix
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -698,7 +698,7 @@ jobs:
       - name: Create Draft Pull Request
         if: steps.validate.outputs.has_changes == 'true'
         id: create_pr
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: |
@@ -736,7 +736,7 @@ jobs:
       - name: Comment on original PR
         if: steps.create_pr.outputs.pull-request-number
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/ai-issue-triage.yml b/.github/workflows/ai-issue-triage.yml
index fe40603..6c2ea78 100644
--- a/.github/workflows/ai-issue-triage.yml
+++ b/.github/workflows/ai-issue-triage.yml
@@ -54,7 +54,7 @@ jobs:
         id: bedrock
         if: env.BEDROCK_CONFIGURED == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           use_bedrock: "true"
@@ -93,7 +93,7 @@ jobs:
           env.ANTHROPIC_KEY_SET == 'true' &&
           (env.BEDROCK_CONFIGURED != 'true' || steps.bedrock.outcome != 'success')
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/ai-review-cost-monitor.yml b/.github/workflows/ai-review-cost-monitor.yml
index 50e8ec6..ab2ac10 100644
--- a/.github/workflows/ai-review-cost-monitor.yml
+++ b/.github/workflows/ai-review-cost-monitor.yml
@@ -172,7 +172,7 @@ jobs:
 
       - name: Create budget alert issue
         if: steps.budget.outputs.daily_exceeded == 'true' || steps.budget.outputs.monthly_exceeded == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -206,7 +206,7 @@ jobs:
 
       - name: Close budget alert if resolved
         if: steps.budget.outputs.daily_exceeded == 'false' && steps.budget.outputs.monthly_exceeded == 'false'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -235,7 +235,7 @@ jobs:
 
       - name: Create issue on workflow failure
         if: failure()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/autonomous-code-scanner.yml b/.github/workflows/autonomous-code-scanner.yml
index 1205eb3..1788662 100644
--- a/.github/workflows/autonomous-code-scanner.yml
+++ b/.github/workflows/autonomous-code-scanner.yml
@@ -115,7 +115,7 @@ jobs:
           echo "- **Total**: $TOTAL files" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload scannable file lists
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: scannable-files
           path: |
@@ -208,7 +208,7 @@ jobs:
 
       - name: Upload formatting summary and patch
         if: steps.detect-changes.outputs.has_changes == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: formatting-changes
           path: |
@@ -345,7 +345,7 @@ jobs:
 
       - name: Upload security findings
         if: steps.analyze-findings.outputs.has_findings == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: security-findings
           path: |
@@ -579,7 +579,7 @@ jobs:
 
       - name: Upload type hints suggestions
         if: steps.analyze.outputs.has_suggestions == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: type-hints-suggestions
           path: |
@@ -754,7 +754,7 @@ jobs:
 
       - name: Upload documentation suggestions
         if: steps.analyze.outputs.has_suggestions == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: documentation-suggestions
           path: |
@@ -892,7 +892,7 @@ jobs:
         if: |
           needs.scan-formatting.outputs.has_changes == 'true' &&
           github.event.inputs.dry_run != 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: scanner/formatting-${{ github.run_id }}
@@ -933,7 +933,7 @@ jobs:
         if: |
           needs.scan-security.outputs.has_findings == 'true' &&
           github.event.inputs.dry_run != 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: scanner/security-${{ github.run_id }}
@@ -998,7 +998,7 @@ jobs:
           needs.scan-type-hints.result == 'success' &&
           needs.scan-type-hints.outputs.has_changes == 'true' &&
           github.event.inputs.dry_run != 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: scanner/type-hints-${{ github.run_id }}
@@ -1067,7 +1067,7 @@ jobs:
           needs.scan-documentation.result == 'success' &&
           needs.scan-documentation.outputs.has_changes == 'true' &&
           github.event.inputs.dry_run != 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: scanner/documentation-${{ github.run_id }}
@@ -1182,7 +1182,7 @@ jobs:
 
       - name: Create issue on workflow failure
         if: failure()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -1324,7 +1324,7 @@ jobs:
         if: |
           always() &&
           steps.final-summary.outputs.pr_count == '0'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04ebd50..8e2ce01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -135,7 +135,7 @@ jobs:
         if: steps.validate_providers.outputs.skip_review != 'true' && env.BEDROCK_CONFIGURED == 'true'
         id: bedrock_review
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           use_bedrock: "true"
@@ -204,7 +204,7 @@ jobs:
       - name: Claude Review (Anthropic API - Fallback)
         if: steps.validate_providers.outputs.skip_review != 'true' && env.ANTHROPIC_KEY_SET == 'true' && (env.BEDROCK_CONFIGURED != 'true' || steps.bedrock_review.outcome != 'success')
         id: anthropic_review
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -332,7 +332,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: matrix.python-version == '3.10'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: coverage-report
           path: coverage.xml
@@ -417,7 +417,7 @@ jobs:
         run: twine check dist/*
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: dist
           path: dist/
@@ -609,7 +609,7 @@ jobs:
       - name: SonarCloud Scan
         if: steps.check-token.outputs.skip != 'true'
         continue-on-error: true
-        uses: SonarSource/sonarqube-scan-action@299e4b793aaa83bf2aba7c9c14bedbb485688ec4  # v7
+        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432  # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_HOST_URL: https://sonarcloud.io
@@ -625,7 +625,7 @@ jobs:
       - name: SonarCloud Quality Gate
         if: steps.check-token.outputs.skip != 'true' && success()
         continue-on-error: true
-        uses: SonarSource/sonarqube-quality-gate-action@d304d050d930b02a896b0f85935344f023928496  # v1
+        uses: SonarSource/sonarqube-quality-gate-action@cf038b0e0cdecfa9e56c198bbb7d21d751d62c3b  # v1.2.0
         timeout-minutes: 5
         env:
           SONAR_HOST_URL: https://sonarcloud.io
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index a834726..5c7641c 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -31,7 +31,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           
diff --git a/.github/workflows/e2e-app-generation.yml b/.github/workflows/e2e-app-generation.yml
index 03c6e66..0be8a84 100644
--- a/.github/workflows/e2e-app-generation.yml
+++ b/.github/workflows/e2e-app-generation.yml
@@ -144,7 +144,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.language == 'node'
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
         with:
           node-version: '20'
 
@@ -200,7 +200,7 @@ jobs:
           fi
 
       - name: Upload result artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: result-${{ matrix.app }}-run${{ matrix.run }}
           path: artifacts/e2e/result-${{ matrix.app }}-run${{ matrix.run }}/
@@ -208,7 +208,7 @@ jobs:
 
       - name: Upload workdir on failure
         if: steps.e2e.outputs.passed == 'false'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: workdir-${{ matrix.app }}-run${{ matrix.run }}
           path: /tmp/e2e_test_${{ matrix.app }}*/
@@ -270,7 +270,7 @@ jobs:
           echo "all_passed=$ALL_PASSED" >> $GITHUB_OUTPUT
 
       - name: Upload aggregated results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: e2e-aggregated-results
           path: results.json
diff --git a/.github/workflows/gitnexus-impact.yml b/.github/workflows/gitnexus-impact.yml
index 9c7c6e1..ffc98c4 100644
--- a/.github/workflows/gitnexus-impact.yml
+++ b/.github/workflows/gitnexus-impact.yml
@@ -25,12 +25,12 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
         with:
           node-version: '20'
 
       - name: Cache GitNexus index
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: .gitnexus
           key: gitnexus-${{ runner.os }}-${{ github.base_ref }}
@@ -53,7 +53,7 @@ jobs:
           echo "$REPORT" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Post or update PR comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/issue-to-pr.yml b/.github/workflows/issue-to-pr.yml
index 981fc7d..df9dd98 100644
--- a/.github/workflows/issue-to-pr.yml
+++ b/.github/workflows/issue-to-pr.yml
@@ -89,7 +89,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Verify actor permissions
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
@@ -104,7 +104,7 @@ jobs:
             core.info(`Actor ${context.actor} verified with '${data.permission}' permission`);
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
         with:
           node-version: 20
 
@@ -198,7 +198,7 @@ jobs:
 
       - name: Upload patch artifact
         if: steps.detect.outputs.has_changes == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: issue-fix-patch
           path: /tmp/patch/issue-fix.patch
@@ -341,7 +341,7 @@ jobs:
 
       - name: Upload clean patch
         if: steps.final.outputs.passed == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: issue-fix-clean-patch
           path: /tmp/clean-patch/issue-fix-clean.patch
@@ -382,7 +382,7 @@ jobs:
       - name: Create Draft PR
         id: create
         if: needs.guardrails.outputs.passed == 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: issue-fix/${{ github.event.issue.number }}-${{ github.run_id }}
diff --git a/.github/workflows/nightly-docs-update.yml b/.github/workflows/nightly-docs-update.yml
index 69bd35f..8c1720c 100644
--- a/.github/workflows/nightly-docs-update.yml
+++ b/.github/workflows/nightly-docs-update.yml
@@ -158,7 +158,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
         with:
           node-version: 20
 
@@ -288,7 +288,7 @@ jobs:
 
       - name: Create Draft Pull Request
         if: steps.changes.outputs.has_updates == 'true' && inputs.dry_run != true
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: |
diff --git a/.github/workflows/nightly-review.yml b/.github/workflows/nightly-review.yml
index 4458dd1..8631c60 100644
--- a/.github/workflows/nightly-review.yml
+++ b/.github/workflows/nightly-review.yml
@@ -189,7 +189,7 @@ jobs:
 
       - name: Upload scope selection
         if: steps.scope_selector.outputs.skip != 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: scope-selection
           path: scope-selection.json
@@ -265,7 +265,7 @@ jobs:
         if: |
           steps.scope_selector.outputs.skip != 'true' &&
           steps.check_providers.outputs.bedrock_available == 'true'
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         env:
           AWS_REGION: ${{ secrets.AWS_REGION }}
           AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
@@ -398,7 +398,7 @@ jobs:
           steps.scope_selector.outputs.skip != 'true' &&
           steps.consensus_review_bedrock.outcome != 'success' &&
           steps.check_providers.outputs.anthropic_available == 'true'
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         # MCP provider may be unavailable -- suggestion PR is still generated from cached findings
         continue-on-error: true
         with:
@@ -555,7 +555,7 @@ jobs:
            steps.consensus_review_bedrock.outcome == 'failure' ||
            steps.consensus_review_anthropic.outcome == 'success' ||
            steps.consensus_review_anthropic.outcome == 'failure')
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: review-findings
           path: review-findings.json
@@ -583,7 +583,7 @@ jobs:
 
       - name: Upload fix plans
         if: steps.normalize.outcome == 'success'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: fix-plans
           path: fix-plans/
@@ -622,7 +622,7 @@ jobs:
 
       - name: Upload autofix results
         if: steps.autofix.outcome == 'success' || steps.autofix.outcome == 'failure'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: autofix-results
           path: autofix-results.json
@@ -701,7 +701,7 @@ jobs:
 
       - name: Upload autofix PR content
         if: steps.autofix_pr_content.outcome == 'success'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: pr-content-autofix
           path: pr-content-autofix/
@@ -755,7 +755,7 @@ jobs:
           steps.classify_llm.outputs.has_llm_fixes == 'true' &&
           github.event.inputs.dry_run != 'true' &&
           (steps.check_providers.outputs.bedrock_available == 'true' || steps.check_providers.outputs.anthropic_available == 'true')
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         continue-on-error: true
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -852,7 +852,7 @@ jobs:
 
       - name: Upload LLM fix results
         if: steps.llm_fixes.outcome == 'success' || steps.llm_fixes.outcome == 'failure'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: llm-fix-results
           path: |
@@ -873,7 +873,7 @@ jobs:
 
       - name: Upload PR content
         if: steps.suggestions.outcome == 'success'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: pr-content
           path: pr-content/
diff --git a/.github/workflows/package-publish.yml b/.github/workflows/package-publish.yml
index ce7935c..0e4fa86 100644
--- a/.github/workflows/package-publish.yml
+++ b/.github/workflows/package-publish.yml
@@ -37,7 +37,7 @@ jobs:
       run: python -m build
 
     - name: Store the distribution packages
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
       with:
         name: python-package-distributions
         path: dist/
diff --git a/.github/workflows/package-test.yml b/.github/workflows/package-test.yml
index 66e4fea..b859186 100644
--- a/.github/workflows/package-test.yml
+++ b/.github/workflows/package-test.yml
@@ -64,7 +64,7 @@ jobs:
 
     - name: Upload coverage reports (Linux only)
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
       with:
         name: coverage-report
         path: htmlcov/
diff --git a/.github/workflows/pal-consensus-review.yml b/.github/workflows/pal-consensus-review.yml
index a0825d4..25f8b17 100644
--- a/.github/workflows/pal-consensus-review.yml
+++ b/.github/workflows/pal-consensus-review.yml
@@ -75,7 +75,7 @@ jobs:
           echo "PAL MCP secrets validated successfully"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
 
       - name: Create PAL MCP Config
         run: |
@@ -104,7 +104,7 @@ jobs:
         id: bedrock_review
         if: env.BEDROCK_CONFIGURED == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           use_bedrock: "true"
@@ -141,7 +141,7 @@ jobs:
           env.ANTHROPIC_KEY_SET == 'true' &&
           (env.BEDROCK_CONFIGURED != 'true' || steps.bedrock_review.outcome != 'success')
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/readme-quality-check.yml b/.github/workflows/readme-quality-check.yml
index a5c90c1..7de25c5 100644
--- a/.github/workflows/readme-quality-check.yml
+++ b/.github/workflows/readme-quality-check.yml
@@ -41,7 +41,7 @@ jobs:
 
     - name: Upload quality report
       if: always()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
       with:
         name: readme-quality-report
         path: readme-quality-report.json
@@ -49,7 +49,7 @@ jobs:
 
     - name: Comment PR (if applicable)
       if: github.event_name == 'pull_request' && always()
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       with:
         script: |
           const fs = require('fs');
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index c6b76c4..de3a1f2 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -57,7 +57,7 @@ jobs:
         id: bedrock
         if: env.BEDROCK_CONFIGURED == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           use_bedrock: "true"
@@ -131,7 +131,7 @@ jobs:
           env.ANTHROPIC_KEY_SET == 'true' &&
           (env.BEDROCK_CONFIGURED != 'true' || steps.bedrock.outcome != 'success')
         continue-on-error: true
-        uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c  # v1
+        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa  # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 47aecd9..1989bb7 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -41,16 +41,16 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13  # v4
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7  # v4
         with:
           languages: python
           queries: +security-extended,security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13  # v4
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7  # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13  # v4
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7  # v4
         with:
           category: "/language:python"
 
@@ -84,7 +84,7 @@ jobs:
           cat audit-report.md >> $GITHUB_STEP_SUMMARY
 
       - name: Upload audit report
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: pip-audit-report
           path: audit-report.md
@@ -116,7 +116,7 @@ jobs:
           bandit -c pyproject.toml -r SuperClaude/ -f txt
 
       - name: Upload Bandit report
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: bandit-report
           path: bandit-report.json
diff --git a/.github/workflows/stochastic-evals.yml b/.github/workflows/stochastic-evals.yml
index d59ac4e..1165b84 100644
--- a/.github/workflows/stochastic-evals.yml
+++ b/.github/workflows/stochastic-evals.yml
@@ -166,7 +166,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
         with:
           node-version: '20'
 
@@ -355,7 +355,7 @@ jobs:
           cat eval-result.json
 
       - name: Upload result artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: result-${{ matrix.agent }}-run${{ matrix.run }}
           path: eval-result.json
@@ -363,7 +363,7 @@ jobs:
 
       - name: Upload full response (for debugging)
         if: failure() || github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: response-${{ matrix.agent }}-run${{ matrix.run }}
           path: result.json
@@ -426,7 +426,7 @@ jobs:
             --output "$GITHUB_STEP_SUMMARY" || true
 
       - name: Upload aggregated results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: aggregated-results
           path: results.json
diff --git a/.github/workflows/update-architecture.yml b/.github/workflows/update-architecture.yml
index 9a4ae02..c51c076 100644
--- a/.github/workflows/update-architecture.yml
+++ b/.github/workflows/update-architecture.yml
@@ -32,12 +32,12 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
         with:
           node-version: '20'
 
       - name: Cache GitNexus index
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: .gitnexus
           key: gitnexus-${{ runner.os }}-main-${{ github.sha }}
@@ -64,7 +64,7 @@ jobs:
 
       - name: Create pull request
         if: steps.changes.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'docs: update ARCHITECTURE.md [skip ci]'