diff --git a/.github/workflows/build-and-store-wasm.yml b/.github/workflows/build-and-store-wasm.yml
index 36e83473fe..5925927b6e 100644
--- a/.github/workflows/build-and-store-wasm.yml
+++ b/.github/workflows/build-and-store-wasm.yml
@@ -9,8 +9,8 @@ jobs:
   build-and-upload:
     runs-on: namespace-profile-ubuntu-8-cores
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -36,7 +36,7 @@ jobs:
 
 
       # Upload the WASM bundle as an artifact
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wasm-bundle
           path: rust/kcl-wasm-lib/pkg
diff --git a/.github/workflows/build-apps.yml b/.github/workflows/build-apps.yml
index fafacd0731..db4c5b74c2 100644
--- a/.github/workflows/build-apps.yml
+++ b/.github/workflows/build-apps.yml
@@ -23,9 +23,9 @@ jobs:
       version: ${{ steps.export_version.outputs.version }}
       notes: ${{ steps.export_notes.outputs.notes }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -34,7 +34,7 @@ jobs:
 
       - id: filter
         name: Check for Rust changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: |
             rust:
@@ -43,7 +43,7 @@ jobs:
       - name: Download Wasm Cache
         id: download-wasm
         if: ${{ github.event_name == 'pull_request' && steps.filter.outputs.rust == 'false' }}
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@v20
         continue-on-error: true
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -112,7 +112,7 @@ jobs:
           npm run files:set-version
           npm run files:set-windows-codesign-config
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: prepared-files
           path: |
@@ -147,9 +147,9 @@ jobs:
     env:
       VERSION_NO_V: ${{ needs.prepare-files.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         name: prepared-files
 
       - name: Copy prepared files
@@ -165,7 +165,7 @@ jobs:
           cp prepared-files/assets/icon.png assets/icon.png
 
       - name: Sync node version and setup cache
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm' # Set this to npm, npm or pnpm.
@@ -227,7 +227,7 @@ jobs:
       - name: List artifacts in out/
         run: ls -R out
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: out-arm64-${{ matrix.platform }}
           # first two will pick both Zoo Design Studio-$VERSION-arm64-win.exe and Zoo Design Studio-$VERSION-win.exe
@@ -237,7 +237,7 @@ jobs:
             out/*-arm64-mac.*
             out/*-arm64-linux.*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: out-x64-${{ matrix.platform }}
           path: |
@@ -245,7 +245,7 @@ jobs:
             out/*-x64-mac.*
             out/*-x86_64-linux.*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: ${{ env.IS_RELEASE == 'true' || env.IS_STAGING == 'true' }}
         with:
           name: out-yml-${{ matrix.platform }}
@@ -266,49 +266,49 @@ jobs:
       VERSION: ${{ format('v{0}', needs.prepare-files.outputs.version) }}
     needs: [prepare-files, build-apps]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-arm64-windows
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-x64-windows
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-yml-windows
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-arm64-macos
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-x64-macos
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-yml-macos
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-arm64-linux
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-x64-linux
           path: out
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-yml-linux
           path: out
@@ -358,7 +358,7 @@ jobs:
             }' > out/last_download.json
             cat out/last_download.json
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: out-download-json
           path: out/last_download.json
@@ -368,13 +368,13 @@ jobs:
 
       - name: Authenticate to Google Cloud
         if: ${{ env.IS_STAGING == 'true' }}
-        uses: 'google-github-actions/auth@v2.1.10'
+        uses: 'google-github-actions/auth@v3.0.0'
         with:
           credentials_json: '${{ secrets.GOOGLE_CLOUD_DL_SA }}'
 
       - name: Set up Google Cloud SDK
         if: ${{ env.IS_STAGING == 'true' }}
-        uses: google-github-actions/setup-gcloud@v2.1.4
+        uses: google-github-actions/setup-gcloud@v3.0.1
         with:
           project_id: ${{ env.GOOGLE_CLOUD_PROJECT_ID }}
 
diff --git a/.github/workflows/build-wasm.yml b/.github/workflows/build-wasm.yml
index f2bada2423..451f8f21d7 100644
--- a/.github/workflows/build-wasm.yml
+++ b/.github/workflows/build-wasm.yml
@@ -10,9 +10,9 @@ jobs:
   npm-build-wasm:
     runs-on: namespace-profile-ubuntu-8-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -43,13 +43,13 @@ jobs:
         shell: bash
         run: npm run build:wasm
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: prepared-wasm
           path: |
             rust/kcl-wasm-lib/pkg/kcl_wasm_lib*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: prepared-ts-rs-bindings
           path: |
diff --git a/.github/workflows/cargo-bench.yml b/.github/workflows/cargo-bench.yml
index a082f9b083..f13dfa70c3 100644
--- a/.github/workflows/cargo-bench.yml
+++ b/.github/workflows/cargo-bench.yml
@@ -32,7 +32,7 @@ jobs:
     # Enabling this results in the following error on GitHub Actions:
     #   setarch: failed to set personality to x86_64: Operation not permitted
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Use correct Rust toolchain
         shell: bash
         run: |
@@ -52,7 +52,7 @@ jobs:
           cd rust
           cargo codspeed build
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@v3
+        uses: CodSpeedHQ/action@v4
         with:
           working-directory: rust
           run: cargo codspeed run
diff --git a/.github/workflows/cargo-check.yml b/.github/workflows/cargo-check.yml
index 6bf179d23d..f49e1baab9 100644
--- a/.github/workflows/cargo-check.yml
+++ b/.github/workflows/cargo-check.yml
@@ -18,7 +18,7 @@ jobs:
     name: cargo check
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Use correct Rust toolchain
         shell: bash
         run: |
diff --git a/.github/workflows/cargo-clippy.yml b/.github/workflows/cargo-clippy.yml
index ec1e7f6f26..10f7b8877b 100644
--- a/.github/workflows/cargo-clippy.yml
+++ b/.github/workflows/cargo-clippy.yml
@@ -24,7 +24,7 @@ jobs:
     name: cargo clippy
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: taiki-e/install-action@just
       - name: Use correct Rust toolchain
         shell: bash
diff --git a/.github/workflows/cargo-fmt.yml b/.github/workflows/cargo-fmt.yml
index 020bbe27a8..d16045b4a0 100644
--- a/.github/workflows/cargo-fmt.yml
+++ b/.github/workflows/cargo-fmt.yml
@@ -27,7 +27,7 @@ jobs:
     name: cargo fmt
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Use correct Rust toolchain
         shell: bash
         run: |
diff --git a/.github/workflows/cargo-test.yml b/.github/workflows/cargo-test.yml
index d1d5c78479..0482e440b7 100644
--- a/.github/workflows/cargo-test.yml
+++ b/.github/workflows/cargo-test.yml
@@ -23,13 +23,13 @@ jobs:
     runs-on: namespace-profile-ubuntu-8-cores
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.MODELING_APP_GH_APP_ID }}
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ steps.app-token.outputs.token }}
       - name: Use correct Rust toolchain
@@ -132,7 +132,7 @@ jobs:
           cd rust
           cargo nextest archive --workspace --features artifact-graph --archive-file nextest-archive.tar.zst
       - name: Upload archive to workflow
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nextest-archive
           path: rust/nextest-archive.tar.zst
@@ -147,13 +147,13 @@ jobs:
         partitionTotal: [6]
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.MODELING_APP_GH_APP_ID }}
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ steps.app-token.outputs.token }}
       - name: Use correct Rust toolchain
@@ -171,7 +171,7 @@ jobs:
           OS_NAME: ${{ env.OS_NAME }}
       - uses: taiki-e/install-action@nextest
       - name: Download archive
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: nextest-archive
       - name: Run tests
@@ -199,13 +199,13 @@ jobs:
     runs-on: namespace-profile-ubuntu-8-cores
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.MODELING_APP_GH_APP_ID }}
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ steps.app-token.outputs.token }}
       - name: Use correct Rust toolchain
@@ -256,7 +256,7 @@ jobs:
       fail-fast: false
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Use correct Rust toolchain
         shell: bash
         run: |
diff --git a/.github/workflows/check-kcl-header.yml b/.github/workflows/check-kcl-header.yml
index 4ef271b71a..ad27e6ec9f 100644
--- a/.github/workflows/check-kcl-header.yml
+++ b/.github/workflows/check-kcl-header.yml
@@ -21,7 +21,7 @@ jobs:
   check-kcl-header:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Check KCL files for header comment block and blank line
         run: |
diff --git a/.github/workflows/codemirror-lang-kcl.yml b/.github/workflows/codemirror-lang-kcl.yml
index d5cb962977..b3352a5471 100644
--- a/.github/workflows/codemirror-lang-kcl.yml
+++ b/.github/workflows/codemirror-lang-kcl.yml
@@ -14,9 +14,9 @@ jobs:
   npm-unit-test:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 2a962ef945..b9fbbe36fc 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -23,20 +23,20 @@ jobs:
   prepare-wasm:
     runs-on: namespace-profile-ubuntu-8-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: kittycad/modeling-app # required for 'workflow_call'
 
       - id: filter
         name: Check for Rust changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         continue-on-error: true # this step fails when invoked as 'workflow_call'
         with:
           filters: |
             rust:
               - 'rust/**'
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -47,7 +47,7 @@ jobs:
       - name: Download Wasm cache
         id: download-wasm
         if: ${{ github.event_name != 'schedule' && (steps.filter.outputs.rust || 'false') == 'false' }}
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@v20
         continue-on-error: true
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
@@ -97,7 +97,7 @@ jobs:
         run: npm run build:wasm
 
       - name: Upload compiled wasm artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: prepared-wasm
           path: |
@@ -110,19 +110,19 @@ jobs:
     name: e2e:snapshots
 
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.MODELING_APP_GH_APP_ID }}
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: kittycad/modeling-app # required for 'workflow_call'
           token: ${{ steps.app-token.outputs.token }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: prepared-wasm
           path: prepared-wasm
@@ -134,7 +134,7 @@ jobs:
           mkdir rust/kcl-wasm-lib/pkg
           cp prepared-wasm/kcl_wasm_lib* rust/kcl-wasm-lib/pkg
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -143,7 +143,7 @@ jobs:
         run: npm install
 
       - name: Download browser cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/ms-playwright/
@@ -153,7 +153,7 @@ jobs:
         run: npm run playwright install --with-deps
 
       - name: npm run test:snapshots
-        uses: nick-fields/retry@v3.0.2
+        uses: nick-fields/retry@v4.0.0
         with:
           shell: bash
           command: npm run test:snapshots
@@ -181,7 +181,7 @@ jobs:
           TARGET: web
 
       - name: Upload playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: playwright-report-snapshot-${{ github.sha }}
@@ -232,19 +232,19 @@ jobs:
       OS_NAME: ${{ contains(matrix.os, 'ubuntu') && 'ubuntu' || (contains(matrix.os, 'windows') && 'windows' || 'macos') }}
 
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.MODELING_APP_GH_APP_ID }}
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: kittycad/modeling-app # required for 'workflow_call'
           token: ${{ steps.app-token.outputs.token }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: prepared-wasm
           path: prepared-wasm
@@ -256,7 +256,7 @@ jobs:
           mkdir rust/kcl-wasm-lib/pkg
           cp prepared-wasm/kcl_wasm_lib* rust/kcl-wasm-lib/pkg
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -265,7 +265,7 @@ jobs:
         run: npm install
 
       - name: Download browser cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/ms-playwright/
@@ -282,7 +282,7 @@ jobs:
           OS_NAME: ${{ env.OS_NAME }}
 
       - name: npm run test:e2e:web
-        uses: nick-fields/retry@v3.0.2
+        uses: nick-fields/retry@v4.0.0
         with:
           shell: bash
           command: npm run test:e2e:web
@@ -298,7 +298,7 @@ jobs:
           TARGET: web
 
       - name: Upload playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ !cancelled() && (success() || failure()) }}
         with:
           name: playwright-report-web-${{ env.OS_NAME }}-${{ matrix.shardIndex }}-${{ github.sha }}
@@ -356,11 +356,11 @@ jobs:
       OS_NAME: ${{ contains(matrix.os, 'ubuntu') && 'ubuntu' || (contains(matrix.os, 'windows') && 'windows' || 'macos') }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: kittycad/modeling-app # required for 'workflow_call'
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: prepared-wasm
           path: prepared-wasm
@@ -372,7 +372,7 @@ jobs:
           mkdir rust/kcl-wasm-lib/pkg
           cp prepared-wasm/kcl_wasm_lib* rust/kcl-wasm-lib/pkg
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -382,7 +382,7 @@ jobs:
         run: npm install
 
       - name: Download browser cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/ms-playwright/
@@ -401,7 +401,7 @@ jobs:
       - name: Build app
         run: npm run tronb:vite:dev
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         if: ${{ !cancelled() && (success() || failure()) }}
         continue-on-error: true
         with:
@@ -411,7 +411,7 @@ jobs:
       - name: npm run test:e2e:desktop
         id: retry
         if: ${{ !cancelled() && steps.deps-install.outcome == 'success' }}
-        uses: nick-fields/retry@v3.0.2
+        uses: nick-fields/retry@v4.0.0
         with:
           shell: bash
           command: .github/ci-cd-scripts/playwright-electron.sh ${{matrix.shardIndex}} ${{matrix.shardTotal}} ${{ env.OS_NAME }}
@@ -428,7 +428,7 @@ jobs:
           TARGET: desktop
 
       - name: Upload test report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: test-results-desktop-${{ env.OS_NAME }}-${{ matrix.shardIndex }}-${{ github.sha }}
@@ -438,7 +438,7 @@ jobs:
           overwrite: true
 
       - name: Upload playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: playwright-report-desktop-${{ env.OS_NAME }}-${{ matrix.shardIndex }}-${{ github.sha }}
diff --git a/.github/workflows/flakehub.yml b/.github/workflows/flakehub.yml
index 9a4b761a23..8bfe1643ed 100644
--- a/.github/workflows/flakehub.yml
+++ b/.github/workflows/flakehub.yml
@@ -10,7 +10,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: "actions/checkout@v5"
+      - uses: "actions/checkout@v6"
         with:
           persist-credentials: false
       - uses: "DeterminateSystems/determinate-nix-action@v3"
diff --git a/.github/workflows/generate-machine-api-types.yml b/.github/workflows/generate-machine-api-types.yml
index ac6d88c56b..0bba6bfe31 100644
--- a/.github/workflows/generate-machine-api-types.yml
+++ b/.github/workflows/generate-machine-api-types.yml
@@ -17,8 +17,8 @@ jobs:
   generate:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
diff --git a/.github/workflows/generate-website-docs.yml b/.github/workflows/generate-website-docs.yml
index 86541607f0..0c2d983c95 100644
--- a/.github/workflows/generate-website-docs.yml
+++ b/.github/workflows/generate-website-docs.yml
@@ -19,8 +19,8 @@ jobs:
     name: generate-website-docs
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/checkout@v6
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           # required
@@ -28,7 +28,7 @@ jobs:
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
       # Checkout the docs repo since we will want to update the files there.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: 'kittycad/documentation'
           path: 'documentation'
diff --git a/.github/workflows/kcl-language-server.yml b/.github/workflows/kcl-language-server.yml
index 1cf877a7f2..65cc84a200 100644
--- a/.github/workflows/kcl-language-server.yml
+++ b/.github/workflows/kcl-language-server.yml
@@ -48,9 +48,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
       - name: Install dependencies
@@ -105,7 +105,7 @@ jobs:
       RA_TARGET: ${{ matrix.target }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: ${{ env.FETCH_DEPTH }}
       - name: Use correct Rust toolchain
@@ -119,7 +119,7 @@ jobs:
           components: rust-src
           target: ${{ matrix.target }}
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
       - name: Update apt repositories
@@ -190,7 +190,7 @@ jobs:
           cd rust/kcl-language-server
           npx vsce package --yarn -o ../build/kcl-language-server-no-server.vsix --pre-release
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-${{ matrix.target }}
           path: ./rust/build
@@ -219,7 +219,7 @@ jobs:
             npm \
             yarn
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: ${{ env.FETCH_DEPTH }}
       - name: Use correct Rust toolchain
@@ -252,7 +252,7 @@ jobs:
           cd rust/kcl-language-server
           npx vsce package --yarn -o "../build/kcl-language-server-alpine-x64.vsix" --target alpine-x64 --pre-release
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-x86_64-unknown-linux-musl
           path: ./rust/build
@@ -267,45 +267,45 @@ jobs:
       - run: echo "TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
       - run: 'echo "TAG: $TAG"'
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: ${{ env.FETCH_DEPTH }}
       - name: Install Nodejs
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: ".nvmrc"
       - run: echo "HEAD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
       - run: 'echo "HEAD_SHA: $HEAD_SHA"'
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-aarch64-apple-darwin
           path: rust/build
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-x86_64-unknown-linux-gnu
           path: rust/build
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-x86_64-unknown-linux-musl
           path: rust/build
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-aarch64-unknown-linux-gnu
           path: rust/build
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-arm-unknown-linux-gnueabihf
           path: rust/build
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-x86_64-pc-windows-msvc
           path: rust/build
-          #- uses: actions/download-artifact@v4
+          #- uses: actions/download-artifact@v8
           #with:
           #name: release-i686-pc-windows-msvc
           #path:
           #build
-          #- uses: actions/download-artifact@v4
+          #- uses: actions/download-artifact@v8
           #with:
           #name: release-aarch64-pc-windows-msvc
           #path: rust/build
@@ -322,11 +322,11 @@ jobs:
           mkdir -p releases/language-server/${{ env.TAG }}
           cp -r build/* releases/language-server/${{ env.TAG }}
       - name: "Authenticate to Google Cloud"
-        uses: "google-github-actions/auth@v2.1.10"
+        uses: "google-github-actions/auth@v3.0.0"
         with:
           credentials_json: "${{ secrets.GOOGLE_CLOUD_DL_SA }}"
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v2.1.4
+        uses: google-github-actions/setup-gcloud@v3.0.1
         with:
           project_id: kittycadapi
       - name: "upload files to gcp"
diff --git a/.github/workflows/kcl-python-bindings.yml b/.github/workflows/kcl-python-bindings.yml
index b9f28cb23a..44333e8c78 100644
--- a/.github/workflows/kcl-python-bindings.yml
+++ b/.github/workflows/kcl-python-bindings.yml
@@ -36,8 +36,8 @@ jobs:
     name: kcl-python-bindings (linux-x86_64)
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
       - name: Build wheels
@@ -51,7 +51,7 @@ jobs:
           before-script-linux: |
             yum install openssl-devel -y
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-linux-x86_64
           path: rust/kcl-python-bindings/dist
@@ -64,8 +64,8 @@ jobs:
           - x64
       fail-fast: false
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
           architecture: ${{ matrix.target }}
@@ -77,7 +77,7 @@ jobs:
           args: --release --out dist --find-interpreter
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-windows-${{ matrix.target }}
           path: rust/kcl-python-bindings/dist
@@ -96,8 +96,8 @@ jobs:
           - aarch64
       fail-fast: false
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
       - name: Build wheels
@@ -108,7 +108,7 @@ jobs:
           args: --release --out dist --find-interpreter
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-macos-${{ matrix.target }}
           path: rust/kcl-python-bindings/dist
@@ -116,9 +116,9 @@ jobs:
     name: kcl-python-bindings (test)
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7
       - uses: actions-rust-lang/setup-rust-toolchain@v1
       - uses: taiki-e/install-action@just
       - name: Run tests
@@ -133,9 +133,9 @@ jobs:
     name: kcl-python-bindings (sdist)
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7
       - name: Install codespell
         run: |
           uv venv .venv
@@ -149,7 +149,7 @@ jobs:
           command: sdist
           args: --out dist
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: rust/kcl-python-bindings/dist
@@ -161,12 +161,12 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     needs: [linux-x86_64, windows, macos, sdist]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v8
         with:
           path: rust/kcl-python-bindings
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7
       - name: do uv things
         run: |
           cd rust/kcl-python-bindings
diff --git a/.github/workflows/label-issues.yml b/.github/workflows/label-issues.yml
index 033322b0d8..0065f022c0 100644
--- a/.github/workflows/label-issues.yml
+++ b/.github/workflows/label-issues.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Check if issue opener is ZooSpiritWolf
         id: check_opener
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const issueOpener = context.payload.issue.user.login;
@@ -20,7 +20,7 @@ jobs:
 
       - name: Add labels
         if: steps.check_opener.outputs.result == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             github.issues.addLabels({
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 5fda8016d7..6d4cc7b8c6 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -13,7 +13,7 @@ jobs:
   nix-flake-check:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -28,7 +28,7 @@ jobs:
   nix-build-linux:
     runs-on: namespace-profile-ubuntu-8-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -42,7 +42,7 @@ jobs:
   nix-build-macos:
     runs-on: namespace-profile-macos-6-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
diff --git a/.github/workflows/publish-apps.yml b/.github/workflows/publish-apps.yml
index 908f797a6f..b65088148f 100644
--- a/.github/workflows/publish-apps.yml
+++ b/.github/workflows/publish-apps.yml
@@ -14,9 +14,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -29,70 +29,70 @@ jobs:
           id=$(gh run ls --repo kittycad/modeling-app -w build-apps.yml --branch ${{ github.event.release.tag_name }} --json databaseId | jq '.[0].databaseId')
           echo "id=$id" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-arm64-windows
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-x64-windows
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-yml-windows
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-arm64-macos
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-x64-macos
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-yml-macos
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-arm64-linux
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-x64-linux
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-yml-linux
           path: out
           run-id: ${{ steps.tag_workflow_id.outputs.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: out-download-json
           path: out
@@ -108,12 +108,12 @@ jobs:
         run: npm run files:set-notes
 
       - name: Authenticate to Google Cloud
-        uses: 'google-github-actions/auth@v2.1.10'
+        uses: 'google-github-actions/auth@v3.0.0'
         with:
           credentials_json: '${{ secrets.GOOGLE_CLOUD_DL_SA }}'
 
       - name: Set up Google Cloud SDK
-        uses: google-github-actions/setup-gcloud@v2.1.4
+        uses: google-github-actions/setup-gcloud@v3.0.1
         with:
           project_id: ${{ env.GOOGLE_CLOUD_PROJECT_ID }}
 
@@ -130,7 +130,7 @@ jobs:
 
       - name: Upload release files to Github
         if: ${{ github.event_name == 'release' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: 'out/Zoo*'
 
@@ -146,10 +146,10 @@ jobs:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 
diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml
index 966b825714..eef4410bf5 100644
--- a/.github/workflows/ruff.yml
+++ b/.github/workflows/ruff.yml
@@ -19,6 +19,6 @@ jobs:
   ruff:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: astral-sh/ruff-action@v3
 
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index a78e486e28..ede2a35e58 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -19,8 +19,8 @@ jobs:
   npm-fmt-check:
     runs-on: 'ubuntu-22.04'
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -35,15 +35,15 @@ jobs:
     needs: npm-build-wasm
 
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
       - run: npm install
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Copy prepared wasm
         run: |
@@ -65,15 +65,15 @@ jobs:
     needs: npm-build-wasm
 
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
       - run: npm install
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Copy prepared wasm
         run: |
@@ -95,15 +95,15 @@ jobs:
     needs: npm-build-wasm
 
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
       - run: npm install
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Copy prepared wasm
         run: |
@@ -125,15 +125,15 @@ jobs:
     needs: npm-build-wasm
 
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
       - run: npm install
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Copy prepared wasm
         run: |
@@ -154,6 +154,6 @@ jobs:
     runs-on: namespace-profile-ubuntu-2-cores
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Run codespell
         uses: crate-ci/typos@v1.38.1
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index caafbce295..5392e49ec2 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -26,9 +26,9 @@ jobs:
     # TODO: Remove unit test dependency on Wasm binary
     needs: npm-build-wasm
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -39,7 +39,7 @@ jobs:
           tool: wasm-pack
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Copy prepared wasm
         run: |
@@ -70,9 +70,9 @@ jobs:
     runs-on: namespace-profile-ubuntu-2-cores
     needs: npm-build-wasm
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -83,7 +83,7 @@ jobs:
           tool: wasm-pack
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Copy prepared wasm
         run: |
diff --git a/.github/workflows/update-python-stubs.yml b/.github/workflows/update-python-stubs.yml
index 3ebebe32a4..afb0237857 100644
--- a/.github/workflows/update-python-stubs.yml
+++ b/.github/workflows/update-python-stubs.yml
@@ -17,7 +17,7 @@ jobs:
       run:
         shell: bash -eux {0}
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           # required
@@ -25,7 +25,7 @@ jobs:
           private-key: ${{ secrets.MODELING_APP_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
       - name: Checkout the repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: recursive
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/update-staging.yml b/.github/workflows/update-staging.yml
index 7667d60b91..da2833f789 100644
--- a/.github/workflows/update-staging.yml
+++ b/.github/workflows/update-staging.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: namespace-profile-ubuntu-2-cores
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - shell: bash
         run: |
           git checkout staging || git checkout -b staging