diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 85793ed..376653d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,8 +16,8 @@ jobs:
     name: Python quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: python -m pip install ruff mypy numpy pillow zstandard
@@ -43,8 +43,8 @@ jobs:
           - os: macos-latest
             python: "3.12"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python }}
           cache: pip
@@ -68,8 +68,8 @@ jobs:
     name: Legacy decode compatibility
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -93,7 +93,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Configure MSVC
         if: runner.os == 'Windows'
         uses: ilammy/msvc-dev-cmd@v1
@@ -146,7 +146,7 @@ jobs:
     name: WebAssembly core conformance
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install Emscripten
         run: |
           sudo apt-get update
@@ -161,8 +161,8 @@ jobs:
     name: Visual codec report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: python -m pip install pytest pybind11 numpy pillow zstandard setuptools wheel
@@ -192,8 +192,8 @@ jobs:
     name: Package metadata and source distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: python -m pip install build twine
@@ -204,7 +204,7 @@ jobs:
     name: Native parser sanitizers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build parser mutation test with ASan and UBSan
         run: |
           cc -O1 -g -fno-omit-frame-pointer -fsanitize=address,undefined -Ithird_party/zstd -c third_party/zstd/zstd.c -o zstd.o
@@ -222,8 +222,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ce8a47a..11adb40 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,12 +29,12 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     # Setup Python and build dependencies for C++ compilation tracing
     - name: Set up Python
       if: matrix.language == 'c-cpp'
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: "3.12"
         cache: pip
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 5e6f313..0d49b0e 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -19,10 +19,10 @@ jobs:
     outputs:
       version: ${{ steps.package.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Validate package version and release tag
@@ -74,11 +74,11 @@ jobs:
             label: macOS Apple Silicon
             artifact: macos-arm64
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Build and test installed wheels
-        uses: pypa/cibuildwheel@v4.1.1
+        uses: pypa/cibuildwheel@v4.2.0
         with:
           output-dir: wheelhouse
         env:
@@ -96,10 +96,10 @@ jobs:
     needs: preflight
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -147,15 +147,15 @@ jobs:
     needs: [preflight, wheels, sdist]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
           path: dist
           merge-multiple: true
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           name: sdist
           path: dist
@@ -244,12 +244,12 @@ jobs:
             echo "wimf $VERSION already exists on PyPI; bump the version instead of overwriting it"
             exit 1
           fi
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
           path: dist
           merge-multiple: true
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           name: sdist
           path: dist
@@ -273,10 +273,10 @@ jobs:
           - os: macos-latest
             label: macOS Apple Silicon
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install published wheel
diff --git a/.github/workflows/signpath.yml b/.github/workflows/signpath.yml
index f3834a0..a97c07c 100644
--- a/.github/workflows/signpath.yml
+++ b/.github/workflows/signpath.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: windows-latest
     environment: signpath
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
       - name: Validate release tag and project version
diff --git a/.github/workflows/testpypi-publish.yml b/.github/workflows/testpypi-publish.yml
index c91b5e3..e451e95 100644
--- a/.github/workflows/testpypi-publish.yml
+++ b/.github/workflows/testpypi-publish.yml
@@ -11,14 +11,14 @@ jobs:
     name: Build TestPyPI distributions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Build and test representative native wheel
-        uses: pypa/cibuildwheel@v4.1.1
+        uses: pypa/cibuildwheel@v4.2.0
         with:
           output-dir: dist
         env:
@@ -44,7 +44,7 @@ jobs:
       name: testpypi
       url: https://test.pypi.org/p/wimf
     steps:
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           name: testpypi-distributions
           path: dist