diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index e0df88e..51c8fbc 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -18,10 +18,10 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
       - name: Install npm 12
diff --git a/.github/workflows/security-code-scanner.yml b/.github/workflows/security-code-scanner.yml
index 154f127..9b371f9 100644
--- a/.github/workflows/security-code-scanner.yml
+++ b/.github/workflows/security-code-scanner.yml
@@ -17,11 +17,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install Semgrep OSS
-        run: python -m pip install 'setuptools<81' semgrep==1.136.0
+        run: python -m pip install 'setuptools<81' semgrep==1.183.0
       - name: Scan JavaScript and TypeScript
         run: semgrep scan --error --config p/javascript --config p/typescript --exclude '**/node_modules/**' --exclude '**/dist/**' --exclude '**/build/**' --exclude '**/coverage/**' .
diff --git a/.github/workflows/validate-pr.yml b/.github/workflows/validate-pr.yml
index af11ad0..a0758b2 100644
--- a/.github/workflows/validate-pr.yml
+++ b/.github/workflows/validate-pr.yml
@@ -16,10 +16,10 @@ jobs:
       matrix:
         node: ["24.22.0", "26"]
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node }}
       - name: Install npm 12
diff --git a/package-lock.json b/package-lock.json
index 1243192..3af1b99 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,13 +8,13 @@
         "packages/*"
       ],
       "devDependencies": {
-        "@changesets/cli": "3.0.3",
-        "@lavamoat/harden": "0.8.1",
-        "@types/node": "24.13.6",
+        "@changesets/cli": "^3.0.3",
+        "@lavamoat/harden": "^0.8.1",
+        "@types/node": "^24.13.6",
         "oxlint-plugin-vize": "^0.608.0",
         "oxlint-tailwindcss": "^1.17.0",
-        "typescript": "7.0.2",
-        "vite-plus": "1.4.0"
+        "typescript": "^7.0.2",
+        "vite-plus": "^1.4.0"
       },
       "engines": {
         "node": ">=24.22.0",
diff --git a/package.json b/package.json
index 5288d7b..76dc847 100644
--- a/package.json
+++ b/package.json
@@ -21,13 +21,13 @@
     "fix:styles": "vp fmt --write ."
   },
   "devDependencies": {
-    "@changesets/cli": "3.0.3",
-    "@lavamoat/harden": "0.8.1",
-    "@types/node": "24.13.6",
+    "@changesets/cli": "^3.0.3",
+    "@lavamoat/harden": "^0.8.1",
+    "@types/node": "^24.13.6",
     "oxlint-plugin-vize": "^0.608.0",
     "oxlint-tailwindcss": "^1.17.0",
-    "typescript": "7.0.2",
-    "vite-plus": "1.4.0"
+    "typescript": "^7.0.2",
+    "vite-plus": "^1.4.0"
   },
   "type": "module",
   "devEngines": {