diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 455a9d418c2b..6a78a36c62a2 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -17,17 +17,16 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         # bypass cache: https://github.com/github/codeql-action/issues/1445
-        tools: latest
+        tools: linked
         config-file: .github/codeql/codeql-config.yml
         languages: python
         # we have none
-        setup-python-dependencies: false
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/cygwin.yml b/.github/workflows/cygwin.yml
index c6f3dc416687..d4c0ba53b20f 100644
--- a/.github/workflows/cygwin.yml
+++ b/.github/workflows/cygwin.yml
@@ -39,7 +39,7 @@ jobs:
       MESON_CI_JOBNAME: cygwin-${{ matrix.NAME }}
 
     steps:
-      - uses: actions/cache/restore@v3
+      - uses: actions/cache/restore@v4
         id: restore-cache
         with:
           # should use 'pip3 cache dir' to discover this path
@@ -49,7 +49,7 @@ jobs:
 
       - run: git config --global core.autocrlf input
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: cygwin/cygwin-install-action@master
         with:
@@ -83,7 +83,7 @@ jobs:
           python3 -m pip --disable-pip-version-check install gcovr fastjsonschema pefile pytest pytest-subtests pytest-xdist coverage
         shell: C:\cygwin\bin\bash.exe --noprofile --norc -o igncr -eo pipefail '{0}'
 
-      - uses: actions/cache/save@v3
+      - uses: actions/cache/save@v4
         with:
           # should use 'pip3 cache dir' to discover this path
           path: C:\cygwin\home\runneradmin\.cache\pip
@@ -99,7 +99,7 @@ jobs:
           SKIP_STATIC_BOOST: 1
         shell: C:\cygwin\bin\bash.exe --noprofile --norc -o igncr -eo pipefail '{0}'
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.NAME }}
           path: meson-test-run.*
diff --git a/.github/workflows/file_format.yml b/.github/workflows/file_format.yml
index 429fc91107ad..d61d634c0315 100644
--- a/.github/workflows/file_format.yml
+++ b/.github/workflows/file_format.yml
@@ -13,8 +13,8 @@ jobs:
   format:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - run: python3 ./run_format_tests.py
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index dd91898efc24..d20f7e5ced02 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -45,6 +45,7 @@ jobs:
           - { name: Ubuntu Bionic,    id: bionic   }
           - { name: Ubuntu Rolling,   id: ubuntu-rolling  }
     steps:
+        # Need v3 because of bionic
       - uses: actions/checkout@v3
 
       # Login to dockerhub
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e8cd37341762..5c6d56de30e9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,8 +22,8 @@ jobs:
   pylint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - run: python -m pip install pylint
@@ -32,8 +32,8 @@ jobs:
   flake8:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
       - run: python -m pip install flake8
@@ -42,8 +42,8 @@ jobs:
   mypy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     # Pin mypy to version 1.8, so we retain the ability to lint for Python 3.7
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 3b726315537a..88acbef90206 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -31,8 +31,8 @@ jobs:
   unittests-appleclang:
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - run: |
@@ -81,7 +81,7 @@ jobs:
       HOMEBREW_NO_AUTO_UPDATE: 1
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     # Avoid picking up an older version of LLVM that does not work.
     - run: brew update
     # github actions overwrites brew's python. Force it to reassert itself, by running in a separate step.
@@ -132,8 +132,8 @@ jobs:
     env:
       HOMEBREW_NO_AUTO_UPDATE: 1
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - run: python -m pip install -e .
@@ -145,13 +145,13 @@ jobs:
     - run: ln -sfn /usr/local/Cellar/qt@4/4.8.7_6.reinstall /usr/local/Cellar/qt@4/4.8.7_6
     - run: meson setup "test cases/frameworks/4 qt" build -Drequired=qt4
     - run: meson compile -C build
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: Qt4_Mac_build
         path: build/meson-logs/meson-log.txt
     - run: meson test -C build -v
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: Qt4_Mac_test
diff --git a/.github/workflows/msys2.yml b/.github/workflows/msys2.yml
index 278954c393d6..3b518fee7607 100644
--- a/.github/workflows/msys2.yml
+++ b/.github/workflows/msys2.yml
@@ -61,7 +61,7 @@ jobs:
         shell: msys2 {0}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: msys2/setup-msys2@v2
         with:
@@ -127,7 +127,7 @@ jobs:
 
           MSYSTEM= python3 ./tools/run_with_cov.py run_tests.py --backend=ninja
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.NAME }}
           path: meson-test-run.*
diff --git a/.github/workflows/nonnative.yml b/.github/workflows/nonnative.yml
index 1ad9e35bb0e0..2712d1032935 100644
--- a/.github/workflows/nonnative.yml
+++ b/.github/workflows/nonnative.yml
@@ -37,7 +37,7 @@ jobs:
         apt-get -y purge clang gcc gdc
         apt-get -y autoremove
         python3 -m pip install coverage
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Run tests
       run: bash -c 'source /ci/env_vars.sh; cd $GITHUB_WORKSPACE; ./tools/run_with_cov.py ./run_tests.py $CI_ARGS --cross ubuntu-armhf.json --cross-only'
 
diff --git a/.github/workflows/os_comp.yml b/.github/workflows/os_comp.yml
index 4fa4a87ed15d..05e4f072deb6 100644
--- a/.github/workflows/os_comp.yml
+++ b/.github/workflows/os_comp.yml
@@ -54,6 +54,7 @@ jobs:
       MESON_CI_JOBNAME: linux-${{ matrix.cfg.id }}-gcc
 
     steps:
+      # Need v3 because of bionic
     - uses: actions/checkout@v3
     - name: Run tests
       # All environment variables are stored inside the docker image in /ci/env_vars.sh
@@ -80,7 +81,7 @@ jobs:
       MESON_CI_JOBNAME_UPDATE: linux-arch-gcc-pypy
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Run tests
       run: |
         source /ci/env_vars.sh
@@ -134,7 +135,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run tests
         shell: bash
diff --git a/.github/workflows/stable_builddir.yml b/.github/workflows/stable_builddir.yml
index 5da321d18bce..ae2951801cef 100644
--- a/.github/workflows/stable_builddir.yml
+++ b/.github/workflows/stable_builddir.yml
@@ -14,7 +14,7 @@ jobs:
     env:
       TESTDIR: "manual tests/13 builddir upgrade"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: install ninja
         run: sudo apt-get -y install build-essential ninja-build
       - name: Fetch tags and unshallow
diff --git a/.github/workflows/unusedargs_missingreturn.yml b/.github/workflows/unusedargs_missingreturn.yml
index d823c310e7c2..72f39b511f45 100644
--- a/.github/workflows/unusedargs_missingreturn.yml
+++ b/.github/workflows/unusedargs_missingreturn.yml
@@ -44,8 +44,8 @@ jobs:
   linux:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - name: Install Compilers
@@ -71,8 +71,8 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.x'
 
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 2c76d87846b8..fdb7d1400919 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -32,9 +32,9 @@ jobs:
       HAS_SSH_KEY: ${{ secrets.WEBSITE_PRIV_KEY != '' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: actions/cache/restore@v3
+      - uses: actions/cache/restore@v4
         id: restore-cache
         with:
           # should use 'pip3 cache dir' to discover this path
@@ -47,7 +47,7 @@ jobs:
           sudo apt-get -y install python3-pip ninja-build libjson-glib-dev
           pip install hotdoc chevron strictyaml
 
-      - uses: actions/cache/save@v3
+      - uses: actions/cache/save@v4
         with:
           # should use 'pip3 cache dir' to discover this path
           path: ~/.cache/pip