diff --git a/.github/workflows/cache-upload.yml b/.github/workflows/cache-upload.yml
index e19d23e9315..98e6af29f4a 100644
--- a/.github/workflows/cache-upload.yml
+++ b/.github/workflows/cache-upload.yml
@@ -34,12 +34,12 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Build devbox from scratch because released devbox has a bug that prevents 
       # DEVBOX_API_TOKEN use
       # we can remove this after 0.10.6 is out.
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: ./go.mod
       - name: Build devbox
diff --git a/.github/workflows/cli-post-release.yml b/.github/workflows/cli-post-release.yml
index 0cf041d3521..b75382d734b 100644
--- a/.github/workflows/cli-post-release.yml
+++ b/.github/workflows/cli-post-release.yml
@@ -8,7 +8,7 @@ on:
 permissions:
   contents: write
   pull-requests: read
-  id-token: write # Needed for aws-actions/configure-aws-credentials@v1
+  id-token: write # Needed for aws-actions/configure-aws-credentials@v6
 
 jobs:
   # Make sure the cli-release workflow that built this tag actually succeeded
@@ -38,7 +38,7 @@ jobs:
     needs: check-release
     steps:
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE }}
           aws-region: us-west-2
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index b4fb51419e8..5315d9bd32c 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -21,7 +21,7 @@ on:
 permissions:
   contents: write
   pull-requests: read
-  id-token: write # Needed for aws-actions/configure-aws-credentials@v1
+  id-token: write # Needed for aws-actions/configure-aws-credentials@v6
 
 jobs:
   tests:
@@ -34,14 +34,16 @@ jobs:
     steps:
       - name: Notify jetpack.io slack of release status (only if tests fail)
         id: slack
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@v3.0.3
         with:
+          # v2+ moved the webhook URL from the SLACK_WEBHOOK_URL env var to the
+          # `webhook` input and made `webhook-type` required.
+          webhook: ${{ secrets.SLACK_CLI_RELEASE_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
           payload: |
             {
               "status": "test ${{ needs.tests.result }}"
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLI_RELEASE_WEBHOOK_URL }}
 
   edge:
     runs-on: ubuntu-latest
@@ -50,7 +52,7 @@ jobs:
     if: ${{ inputs.create_edge_release || github.event.schedule }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Needed by goreleaser to browse history.
       - name: Determine edge tag
@@ -58,17 +60,17 @@ jobs:
         run: echo "EDGE_TAG=0.0.0-edge.$(date +%Y-%m-%d)" >> $GITHUB_ENV
       - name: Set edge tag
         id: tag_version
-        uses: mathieudutour/github-tag-action@v6.1
+        uses: mathieudutour/github-tag-action@v6.2
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           custom_tag: ${{ env.EDGE_TAG }}
           tag_prefix: ""
       - name: Set up go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./go.mod
       - name: Build snapshot with goreleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
         with:
           distribution: goreleaser
           version: latest
@@ -88,7 +90,7 @@ jobs:
           version:  ${{ env.EDGE_TAG }}
           version_prefix: "devbox@"
       - name: Publish snapshot release to GitHub
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           prerelease: true
           body: "${{ env.EDGE_TAG }} edge release"
@@ -98,7 +100,7 @@ jobs:
             dist/checksums.txt
             dist/*.tar.gz
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE }}
           aws-region: us-west-2
@@ -116,11 +118,11 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Needed by goreleaser to browse history.
       - name: Set up go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./go.mod
       - name: Create Sentry release
@@ -134,7 +136,7 @@ jobs:
           version: ${{ github.ref }}
           version_prefix: "devbox@"
       - name: Release with goreleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v7
         with:
           distribution: goreleaser
           version: latest
@@ -148,11 +150,13 @@ jobs:
       - name: Notify jetpack.io slack of release status
         id: slack
         if: always()
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@v3.0.3
         with:
+          # v2+ moved the webhook URL from the SLACK_WEBHOOK_URL env var to the
+          # `webhook` input and made `webhook-type` required.
+          webhook: ${{ secrets.SLACK_CLI_RELEASE_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
           payload: |
             {
               "status": "release ${{ job.status }}"
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLI_RELEASE_WEBHOOK_URL }}
diff --git a/.github/workflows/cli-tests.yaml b/.github/workflows/cli-tests.yaml
index 47b8b5f1ee7..740272428b9 100644
--- a/.github/workflows/cli-tests.yaml
+++ b/.github/workflows/cli-tests.yaml
@@ -58,14 +58,14 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: ./go.mod
       - name: Build devbox
         run: go build -o dist/devbox ./cmd/devbox
       - name: Upload devbox artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: devbox-${{ runner.os }}-${{ runner.arch }}
           path: ./dist/devbox
@@ -76,7 +76,7 @@ jobs:
     if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: crate-ci/typos@v1.16.26
 
   flake-test:
@@ -84,7 +84,7 @@ jobs:
     if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install devbox
         uses: jetify-com/devbox-install-action@jl/migrate-installer
         with:
@@ -104,7 +104,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install devbox
         uses: jetify-com/devbox-install-action@jl/migrate-installer
@@ -112,7 +112,7 @@ jobs:
           enable-cache: true
 
       - name: Mount golang cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/golangci-lint
@@ -160,9 +160,9 @@ jobs:
           sudo rm -rf /usr/share/dotnet
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Mount golang cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/go-build
@@ -240,9 +240,9 @@ jobs:
         use-detsys: [true, false]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Download devbox
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: devbox-${{ runner.os }}-${{ runner.arch }}
       - name: Add devbox to path
@@ -289,9 +289,9 @@ jobs:
         nix-version: [2.18.0, 2.19.2, 2.24.7, 2.30.2]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Download devbox
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: devbox-${{ runner.os }}-${{ runner.arch }}
       - name: Add devbox to path
diff --git a/.github/workflows/debug.yaml b/.github/workflows/debug.yaml
index 4b777067d1e..4f5106d4846 100644
--- a/.github/workflows/debug.yaml
+++ b/.github/workflows/debug.yaml
@@ -36,8 +36,8 @@ jobs:
               --show-error \
               --silent \
             | jq .
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: ./go.mod
       - run: |
diff --git a/.github/workflows/docker-image-release.yml b/.github/workflows/docker-image-release.yml
index f96d0ee127c..9fe521575d4 100644
--- a/.github/workflows/docker-image-release.yml
+++ b/.github/workflows/docker-image-release.yml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             jetpackio/devbox
@@ -32,7 +32,7 @@ jobs:
             latest=false
       - name: Docker meta root
         id: metaroot
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             jetpackio/devbox-root-user
@@ -41,14 +41,14 @@ jobs:
           flavor: |
             latest=false
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: Build and push default
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./internal/devbox/generate/tmpl/
           file: ./internal/devbox/generate/tmpl/DevboxImageDockerfile
@@ -58,7 +58,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
       - name: Build and push root user
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./internal/devbox/generate/tmpl/
           file: ./internal/devbox/generate/tmpl/DevboxImageDockerfileRootUser
@@ -69,7 +69,7 @@ jobs:
           tags: ${{ steps.metaroot.outputs.tags }}
       - name: Docker meta latest
         id: metalatest
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             jetpackio/devbox
@@ -78,7 +78,7 @@ jobs:
           flavor: |
             latest=true
       - name: Build and push latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./internal/devbox/generate/tmpl/
           file: ./internal/devbox/generate/tmpl/DevboxImageDockerfile
@@ -87,7 +87,7 @@ jobs:
           tags: ${{ steps.metalatest.outputs.tags }}
       - name: Docker meta root latest
         id: metarootlatest
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             jetpackio/devbox-root-user
@@ -96,7 +96,7 @@ jobs:
           flavor: |
             latest=true
       - name: Build and push root user latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./internal/devbox/generate/tmpl/
           file: ./internal/devbox/generate/tmpl/DevboxImageDockerfileRootUser
diff --git a/.github/workflows/random-reviewer-assignment.yml b/.github/workflows/random-reviewer-assignment.yml
index d4e505194bf..3d2f11e75a2 100644
--- a/.github/workflows/random-reviewer-assignment.yml
+++ b/.github/workflows/random-reviewer-assignment.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Randomly assign reviewer from team
-        uses: actions/github-script@v6
+        uses: actions/github-script@v9
         with:
           script: |
             const TRIAGE_USERNAME = 'Lagoja';
diff --git a/.github/workflows/stale-issue-cleanup.yml b/.github/workflows/stale-issue-cleanup.yml
index 178a6eb731b..40405aea288 100644
--- a/.github/workflows/stale-issue-cleanup.yml
+++ b/.github/workflows/stale-issue-cleanup.yml
@@ -8,7 +8,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v7
+      - uses: actions/stale@v10
         with:
           stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove the `stale` label or add a comment, otherwise this issue will be closed in 5 days.'
           stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove the `stale` label or add a comment, otherwise this PR will be closed in 5 days.'
diff --git a/.github/workflows/vscode-ext-release.yaml b/.github/workflows/vscode-ext-release.yaml
index 78bca639524..d7d374d2cf9 100644
--- a/.github/workflows/vscode-ext-release.yaml
+++ b/.github/workflows/vscode-ext-release.yaml
@@ -11,9 +11,9 @@ jobs:
     environment: release
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       - name: Setup NodeJS 24
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: Install dependencies