diff --git a/.github/workflows/LATEST_DEPENDENCY_VERSIONS.yml b/.github/workflows/LATEST_DEPENDENCY_VERSIONS.yml
index f5e4b8a397..6e79ca61eb 100644
--- a/.github/workflows/LATEST_DEPENDENCY_VERSIONS.yml
+++ b/.github/workflows/LATEST_DEPENDENCY_VERSIONS.yml
@@ -34,7 +34,7 @@ jobs:
         run: pnpm test || (echo "===== Retry =====" && pnpm test)
       - name: Notify failures
         if: failure()
-        uses: slackapi/slack-github-action@v1.18.0
+        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
         with:
           payload: |
             {
diff --git a/.github/workflows/add-issue-to-project.yml b/.github/workflows/add-issue-to-project.yml
index 5ab3e0b2db..566c37f177 100644
--- a/.github/workflows/add-issue-to-project.yml
+++ b/.github/workflows/add-issue-to-project.yml
@@ -10,7 +10,7 @@ jobs:
   add-to-project:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v0.4.0
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/NomicFoundation/projects/4
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
diff --git a/.github/workflows/add-label-to-new-issue.yml b/.github/workflows/add-label-to-new-issue.yml
index a6c6c5345d..2bd47099b5 100644
--- a/.github/workflows/add-label-to-new-issue.yml
+++ b/.github/workflows/add-label-to-new-issue.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
             const issue = await github.rest.issues.get({
diff --git a/.github/workflows/autoassign-issues.yml b/.github/workflows/autoassign-issues.yml
index efd4be5620..318b21074a 100644
--- a/.github/workflows/autoassign-issues.yml
+++ b/.github/workflows/autoassign-issues.yml
@@ -10,7 +10,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
             // each user has a chance of (p - (previousP ?? 0)) to be assigned
diff --git a/.github/workflows/autoassign-prs.yml b/.github/workflows/autoassign-prs.yml
index df5441a02f..f98c9f4f09 100644
--- a/.github/workflows/autoassign-prs.yml
+++ b/.github/workflows/autoassign-prs.yml
@@ -10,7 +10,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
             const externalPrTriager = "kanej";
diff --git a/.github/workflows/check-changeset-added.yml b/.github/workflows/check-changeset-added.yml
index 475fd48ec5..143e1adb39 100644
--- a/.github/workflows/check-changeset-added.yml
+++ b/.github/workflows/check-changeset-added.yml
@@ -21,7 +21,7 @@ jobs:
     # don't run this check in the changesets PR
     if: github.head_ref != 'changeset-release/main'
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
             const pullNumber = context.issue.number;
diff --git a/.github/workflows/close-stale-issues.yml b/.github/workflows/close-stale-issues.yml
index 9d84321d06..1040604e94 100644
--- a/.github/workflows/close-stale-issues.yml
+++ b/.github/workflows/close-stale-issues.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Close stale issues
-        uses: actions/stale@v8
+        uses: actions/stale@v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: "This issue has been automatically closed due to inactivity. If you still need help, please reopen the issue and provide the requested information."
diff --git a/.github/workflows/comment-on-linter-error.yml b/.github/workflows/comment-on-linter-error.yml
index 79a8036e0d..f6cf998469 100644
--- a/.github/workflows/comment-on-linter-error.yml
+++ b/.github/workflows/comment-on-linter-error.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Lint website
         working-directory: docs/
         run: pnpm lint
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         name: Comment on failure
         if: ${{ failure() }}
         with:
diff --git a/.github/workflows/hardhat-core-ci.yml b/.github/workflows/hardhat-core-ci.yml
index a3394316b2..35b6fc7044 100644
--- a/.github/workflows/hardhat-core-ci.yml
+++ b/.github/workflows/hardhat-core-ci.yml
@@ -39,7 +39,7 @@ jobs:
         node: [18.15]
         os: ["macos-13", "ubuntu-latest", "windows-latest"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
         with:
@@ -81,7 +81,7 @@ jobs:
         node: [18.15]
         os: ["macos-13", "ubuntu-latest", "windows-latest"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
         with:
@@ -96,7 +96,7 @@ jobs:
         run: pnpm install --frozen-lockfile --prefer-offline
 
       - name: Cache EDR RPC cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: |
             packages/hardhat-core/test/internal/hardhat-network/edr-cache
diff --git a/.github/workflows/hardhat-network-tracing-all-solc-versions.yml b/.github/workflows/hardhat-network-tracing-all-solc-versions.yml
index 1dde30263f..d657577392 100644
--- a/.github/workflows/hardhat-network-tracing-all-solc-versions.yml
+++ b/.github/workflows/hardhat-network-tracing-all-solc-versions.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Build
         run: pnpm build
       - name: Cache artifacts
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: |
             packages/hardhat-core/test/internal/hardhat-network/stack-traces/test-files/artifacts
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 113315dfc2..1b90eae439 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -16,7 +16,8 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@e460dfeb36e731f3aeb214be6b0c9a9d9a67eda6
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           issue-inactive-days: "90"
           pr-inactive-days: "90"
+          process-only: "issues, prs"
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index 1db35d8a33..d08e3bcfc6 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -31,7 +31,7 @@ jobs:
       - name: lint
         run: pnpm lint
       - name: Cache artifacts
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: |
             packages/hardhat-core/test/internal/hardhat-network/stack-traces/test-files/artifacts
@@ -62,7 +62,7 @@ jobs:
       - name: Install
         run: pnpm install --frozen-lockfile --prefer-offline
       - name: Cache network requests
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: |
             packages/hardhat-core/test/internal/hardhat-network/provider/.hardhat_node_test_cache