diff --git a/.github/workflows/bindings-sysman-python-checks.yml b/.github/workflows/bindings-sysman-python-checks.yml
index a8aa30ac..c0de93cc 100644
--- a/.github/workflows/bindings-sysman-python-checks.yml
+++ b/.github/workflows/bindings-sysman-python-checks.yml
@@ -40,10 +40,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/.github/workflows/bindings-sysman-python-security-scan.yml b/.github/workflows/bindings-sysman-python-security-scan.yml
index 5d1d0f3b..1c9880a7 100644
--- a/.github/workflows/bindings-sysman-python-security-scan.yml
+++ b/.github/workflows/bindings-sysman-python-security-scan.yml
@@ -37,10 +37,10 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       
@@ -55,7 +55,7 @@ jobs:
           bandit -r source/ test/ -ll -f screen
       
       - name: Upload Bandit results as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: bandit-security-report
diff --git a/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml b/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
index 07369987..1d399da9 100644
--- a/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
+++ b/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
@@ -40,12 +40,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for better coverage comparison
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -285,7 +285,7 @@ jobs:
           fi
 
       - name: Upload Test Results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: test-results-${{ github.run_number }}
@@ -298,7 +298,7 @@ jobs:
           retention-days: 30
 
       - name: Upload Coverage Reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-report-${{ github.run_number }}
diff --git a/.github/workflows/build-clang.yml b/.github/workflows/build-clang.yml
index b86e78e1..fbf53632 100644
--- a/.github/workflows/build-clang.yml
+++ b/.github/workflows/build-clang.yml
@@ -27,7 +27,7 @@ jobs:
         run: |
           apt-get update
           apt-get install -y clang cmake make git
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Build Loader (${{ matrix.build_type }}) with Clang on ${{ matrix.container }}
         run: |
           mkdir build
diff --git a/.github/workflows/build-msi-package.yml b/.github/workflows/build-msi-package.yml
index d9895fbb..1b7defae 100644
--- a/.github/workflows/build-msi-package.yml
+++ b/.github/workflows/build-msi-package.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Setup Windows build environment
         uses: ilammy/msvc-dev-cmd@v1
         with:
diff --git a/.github/workflows/build-multi-static.yml b/.github/workflows/build-multi-static.yml
index 2e5f6fd1..9b9f3b88 100644
--- a/.github/workflows/build-multi-static.yml
+++ b/.github/workflows/build-multi-static.yml
@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v7
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -86,7 +86,7 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v7
       with:
         clean: true
         fetch-depth: 0
@@ -94,7 +94,7 @@ jobs:
     - name: Create Ccache directory
       run: mkdir -p '${{ steps.const.outputs.ccache-dir }}'
     - name: Ccache
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: ${{ steps.const.outputs.ccache-dir }}
         key: ccache-${{ github.job }}-${{ steps.const.outputs.os-string }}${{ env.ARCH_SUFFIX }}-${{ matrix.target }}-${{ github.sha }}
diff --git a/.github/workflows/build-multi.yml b/.github/workflows/build-multi.yml
index 8395993f..4e1fef11 100644
--- a/.github/workflows/build-multi.yml
+++ b/.github/workflows/build-multi.yml
@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v7
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -104,7 +104,7 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v7
       with:
         clean: true
         fetch-depth: 0
@@ -112,7 +112,7 @@ jobs:
     - name: Create Ccache directory
       run: mkdir -p '${{ steps.const.outputs.ccache-dir }}'
     - name: Ccache
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: ${{ steps.const.outputs.ccache-dir }}
         key: ccache-${{ github.job }}-${{ steps.const.outputs.os-string }}${{ env.ARCH_SUFFIX }}-${{ matrix.target }}-${{ github.sha }}
diff --git a/.github/workflows/build-quick-static-n-1.yml b/.github/workflows/build-quick-static-n-1.yml
index 3183ea1c..1b2b3af8 100644
--- a/.github/workflows/build-quick-static-n-1.yml
+++ b/.github/workflows/build-quick-static-n-1.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Use ccache-action for ccache setup and caching
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           path: pr
@@ -22,7 +22,7 @@ jobs:
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: master
           fetch-depth: 0
@@ -73,14 +73,14 @@ jobs:
     runs-on: windows-latest
     steps:
       # Checkout PR branch (dynamic loader source)
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           path: pr
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: master
           fetch-depth: 0
diff --git a/.github/workflows/build-quick-static.yml b/.github/workflows/build-quick-static.yml
index ff0434da..0680955a 100644
--- a/.github/workflows/build-quick-static.yml
+++ b/.github/workflows/build-quick-static.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: hendrikmuhs/ccache-action@v1
       - name: Build Static Loader on Latest Ubuntu
         run: |
@@ -48,7 +48,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Setup Windows build environment
         uses: ilammy/msvc-dev-cmd@v1
         with:
diff --git a/.github/workflows/build-quick.yml b/.github/workflows/build-quick.yml
index 912e0bd4..7aab2abb 100644
--- a/.github/workflows/build-quick.yml
+++ b/.github/workflows/build-quick.yml
@@ -31,7 +31,7 @@ jobs:
             apt-get update
             apt-get install -y build-essential cmake git
           fi
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Build Loader on ${{ matrix.container }}
         run: |
           mkdir build
@@ -71,7 +71,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Setup Windows build environment
         uses: ilammy/msvc-dev-cmd@v1
         with:
diff --git a/.github/workflows/check-abi.yml b/.github/workflows/check-abi.yml
index cd96b741..6585201e 100644
--- a/.github/workflows/check-abi.yml
+++ b/.github/workflows/check-abi.yml
@@ -16,7 +16,7 @@ jobs:
       run: |
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0 # Required due to the way Git works, without it this action won't be able to find any or the correct tags
     - uses: actions-ecosystem/action-get-latest-tag@v1
@@ -24,13 +24,13 @@ jobs:
       with:
         semver_only: true
     - name: Checkout base
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         ref: ${{ steps.get-latest-tag.outputs.tag }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         clean: true
         path: head
@@ -78,7 +78,7 @@ jobs:
           -old base.dump \
           -new head.dump \
           -report-path release_report.html
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       if: always()
       with:
         name: abi-report-last-release
@@ -92,13 +92,13 @@ jobs:
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
     - name: Checkout base
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         ref: ${{ github.base_ref }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         clean: true
         path: head
@@ -146,7 +146,7 @@ jobs:
           -old base.dump \
           -new head.dump \
           -report-path master_report.html
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       if: always()
       with:
         name: abi-report-master
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c6d6126d..3be1cb0b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/codespell-comment.yml b/.github/workflows/codespell-comment.yml
index ff8d8e4b..6f7ba9a3 100644
--- a/.github/workflows/codespell-comment.yml
+++ b/.github/workflows/codespell-comment.yml
@@ -27,14 +27,14 @@ jobs:
     if: github.event.workflow_run.event == 'pull_request'
     steps:
     - name: Download report
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       continue-on-error: true
       with:
         name: codespell-report
         run-id: ${{ github.event.workflow_run.id }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Post or update PR comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: |
           const fs = require('fs');
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 16d6ab09..0b9d6b45 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -19,8 +19,8 @@ jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v7
+    - uses: actions/setup-python@v7
       with:
         python-version: '3.x'
     - name: Install codespell
@@ -40,7 +40,7 @@ jobs:
       run: echo "${{ github.event.number }}" > pr_number.txt
     - name: Upload report
       # Consumed by the "Codespell Comment" workflow to post the PR comment.
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: codespell-report
         path: |
diff --git a/.github/workflows/regen-source.yml b/.github/workflows/regen-source.yml
index 60385aa0..ec11136b 100644
--- a/.github/workflows/regen-source.yml
+++ b/.github/workflows/regen-source.yml
@@ -40,7 +40,7 @@ jobs:
           # Floor kept in step with the spec repository's third_party/requirements.txt;
           # verified to produce byte-identical output from 1.3.3 through 1.3.11.
           pip3 install --break-system-packages "Mako>=1.3.3"
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Regenerate sources from archived spec metadata
         run: python3 scripts/spec_metadata.py regen
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload drift report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: regen-diff-linux
           path: regen.diff
@@ -105,8 +105,8 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       - name: Install dependencies
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c729c4b3..fb34825b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -26,7 +26,7 @@ jobs:
       id-token: write
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         persist-credentials: false
     - name: "Run analysis"
@@ -41,7 +41,7 @@ jobs:
         repo_token: ${{ secrets.SCORECARD_TOKEN }}
         publish_results: true
     - name: "Upload artifact"
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: SARIF file
         path: results.sarif
diff --git a/.github/workflows/update-spec.yml b/.github/workflows/update-spec.yml
index 642cea52..4ee217b6 100644
--- a/.github/workflows/update-spec.yml
+++ b/.github/workflows/update-spec.yml
@@ -33,14 +33,14 @@ jobs:
   generate-code:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v7
       with:
         python-version: '3.x'
     - name: Install dependencies
       # Kept in step with the spec repository's third_party/requirements.txt, since
       # this job runs that repository's generators.
       run: pip install "Mako>=1.3.3" "PyYAML>=6.0.1"
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v7
       with:
         clean: true
         fetch-depth: 0
@@ -55,7 +55,7 @@ jobs:
       if: ${{ github.event_name == 'workflow_dispatch' }}
       run: git reset --hard origin/master
     - name: Checkout spec repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         repository: ${{ github.event_name == 'pull_request' && 'oneapi-src/level-zero-spec' || inputs.repository }}
         clean: true