diff --git a/.github/workflows/__call-codeql.yml b/.github/workflows/__call-codeql.yml
index 1d946aac..bcdda8b3 100644
--- a/.github/workflows/__call-codeql.yml
+++ b/.github/workflows/__call-codeql.yml
@@ -31,7 +31,7 @@ jobs:
 
       - name: Get repo languages
         id: lang
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           RUNNER_INPUT: ${{ inputs.runner }}
         with:
@@ -210,7 +210,7 @@ jobs:
 
       - name: Continue
         id: continue
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             // if matrix['include'] is an empty list return false, otherwise true
diff --git a/.github/workflows/__call-release-notifier.yml b/.github/workflows/__call-release-notifier.yml
index 0dfd46f6..02233ed9 100644
--- a/.github/workflows/__call-release-notifier.yml
+++ b/.github/workflows/__call-release-notifier.yml
@@ -34,7 +34,7 @@ jobs:
         env:
           TOPIC: replicator-release-notifications
         id: check-label
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const topic = process.env.TOPIC;
@@ -54,7 +54,7 @@ jobs:
       - name: Check if latest GitHub release
         id: check-release
         if: steps.check-label.outputs.hasTopic == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const latestRelease = await github.rest.repos.getLatestRelease({
diff --git a/.github/workflows/__call-update-docs.yml b/.github/workflows/__call-update-docs.yml
index e788159f..0ac66929 100644
--- a/.github/workflows/__call-update-docs.yml
+++ b/.github/workflows/__call-update-docs.yml
@@ -62,7 +62,7 @@ jobs:
         if: >-
           github.event_name == 'release' &&
           github.event.action == 'edited'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const latestRelease = await github.rest.repos.getLatestRelease({
diff --git a/.github/workflows/__call-update-flathub-repo.yml b/.github/workflows/__call-update-flathub-repo.yml
index bdfea876..70bd0826 100644
--- a/.github/workflows/__call-update-flathub-repo.yml
+++ b/.github/workflows/__call-update-flathub-repo.yml
@@ -32,7 +32,7 @@ jobs:
         id: check-label
         env:
           TOPIC: flathub-pkg
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const topic = process.env.TOPIC;
@@ -52,7 +52,7 @@ jobs:
       - name: Check if latest GitHub release
         id: check-release
         if: steps.check-label.outputs.hasTopic == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const latestRelease = await github.rest.repos.getLatestRelease({
diff --git a/.github/workflows/__call-update-homebrew-repo.yml b/.github/workflows/__call-update-homebrew-repo.yml
index 74831736..8956fba9 100644
--- a/.github/workflows/__call-update-homebrew-repo.yml
+++ b/.github/workflows/__call-update-homebrew-repo.yml
@@ -30,7 +30,7 @@ jobs:
         id: check-label
         env:
           TOPIC: homebrew-pkg
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const topic = process.env.TOPIC;
diff --git a/.github/workflows/__call-update-pacman-repo.yml b/.github/workflows/__call-update-pacman-repo.yml
index 168096fe..04d84409 100644
--- a/.github/workflows/__call-update-pacman-repo.yml
+++ b/.github/workflows/__call-update-pacman-repo.yml
@@ -32,7 +32,7 @@ jobs:
         id: check-label
         env:
           TOPIC: pacman-pkg
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const topic = process.env.TOPIC;
@@ -53,7 +53,7 @@ jobs:
         id: check-release
         if: >-
           steps.check-label.outputs.hasTopic == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const latestRelease = await github.rest.repos.getLatestRelease({
diff --git a/.github/workflows/__call-update-winget-repo.yml b/.github/workflows/__call-update-winget-repo.yml
index 29318226..b34ac094 100644
--- a/.github/workflows/__call-update-winget-repo.yml
+++ b/.github/workflows/__call-update-winget-repo.yml
@@ -35,7 +35,7 @@ jobs:
         id: check-label
         env:
           TOPIC: winget-pkg
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const topic = process.env.TOPIC;
diff --git a/.github/workflows/__issues-stale.yml b/.github/workflows/__issues-stale.yml
index ce6b4e3b..31213a3b 100644
--- a/.github/workflows/__issues-stale.yml
+++ b/.github/workflows/__issues-stale.yml
@@ -24,7 +24,7 @@ jobs:
       # get all repos in this org
       - name: Get repos
         id: set-matrix
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const opts = github.rest.repos.listForOrg.endpoint.merge({ org: context.repo.owner });
diff --git a/.github/workflows/__update-cpm-cmake.yml b/.github/workflows/__update-cpm-cmake.yml
index 2907e911..ee38b9b3 100644
--- a/.github/workflows/__update-cpm-cmake.yml
+++ b/.github/workflows/__update-cpm-cmake.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Get repos
         id: set-matrix
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const opts = github.rest.repos.listForOrg.endpoint.merge({ org: context.repo.owner });
diff --git a/.github/workflows/__update_license_years.yml b/.github/workflows/__update_license_years.yml
index d3ff3ac1..3c3677b9 100644
--- a/.github/workflows/__update_license_years.yml
+++ b/.github/workflows/__update_license_years.yml
@@ -20,7 +20,7 @@ jobs:
       # get all repos in this org
       - name: Get repos
         id: set-matrix
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const opts = github.rest.repos.listForOrg.endpoint.merge({ org: context.repo.owner });