diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dd3a033..8248854 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -31,7 +31,7 @@ jobs:
           cache: pip
           cache-dependency-path: 'dev-requirements*'
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
           cache: yarn
@@ -54,13 +54,13 @@ jobs:
           mkdir jsdist
           jlpm pack --filename jsdist/jupyter-offlinenotebook-jlpmpack.tgz
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: dist
           path: dist
           if-no-files-found: error
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: jsdist
           path: jsdist
@@ -91,13 +91,13 @@ jobs:
           cache: pip
           cache-dependency-path: 'dev-requirements*'
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
           cache: yarn
 
       - name: Download artifacts from build
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
 
       - name: Install dependencies
         run: python -mpip install -r dev-requirements-jl${{ matrix.jupyterlab-major }}.*
@@ -123,7 +123,7 @@ jobs:
       id-token: write
     steps:
       - name: Download artifacts from build
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: dist
           path: dist
@@ -139,9 +139,11 @@ jobs:
       - pre-commit
       - test
     runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
     steps:
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
           registry-url: https://registry.npmjs.org
@@ -156,14 +158,13 @@ jobs:
           echo "NPM_TAG=$NPM_TAG" >> "$GITHUB_ENV"
 
       - name: Download artifacts from build
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: jsdist
           path: jsdist
 
       - run: npm publish --tag "$NPM_TAG" --dry-run ./jsdist/jupyter-offlinenotebook-jlpmpack.tgz
 
+      # Uses trusted publisher
       - run: npm publish --tag "$NPM_TAG" ./jsdist/jupyter-offlinenotebook-jlpmpack.tgz
         if: startsWith(github.ref, 'refs/tags')
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/dev-requirements-jl4.txt b/dev-requirements-jl4.txt
index ccc0d3e..955ddcf 100644
--- a/dev-requirements-jl4.txt
+++ b/dev-requirements-jl4.txt
@@ -1,4 +1,4 @@
 -r dev-requirements.txt
-jupyterlab==4.4.9
+jupyterlab==4.4.10
 jupyter_server==2.17.0
 notebook==7.4.7
diff --git a/dev-requirements.txt b/dev-requirements.txt
index bc2dca9..3b1bbc2 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -4,7 +4,7 @@ flaky==3.8.1
 pre-commit==4.3.0
 pytest==8.4.2
 # selenium==4.11.2
-selenium==4.36.0
+selenium==4.38.0
 traitlets==5.14.3
 wheel==0.45.1
 # jupyterlab and jupyter_server are installed separately so we can test multiple versions