diff --git a/.github/actions/copy-workflow-go/action.yml b/.github/actions/copy-workflow-go/action.yml
index 2c047eb3..50b2f282 100644
--- a/.github/actions/copy-workflow-go/action.yml
+++ b/.github/actions/copy-workflow-go/action.yml
@@ -61,7 +61,7 @@ runs:
               sed -i 's/ioutil.Discard/io.Discard/' "${file}";
             done <<< "$(find . -type f -name '*.go')"
 
-            go install golang.org/x/tools/cmd/goimports@v0.1.12
+            go install golang.org/x/tools/cmd/goimports@v0.5.0
             goimports -w .
 
             git add .
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index c24662ca..5fd9e162 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -40,14 +40,14 @@ jobs:
     if: github.event.pull_request.user.login == 'web3-bot' && needs.automerge-check.outputs.status == 'true'
     steps:
     - name: Wait on tests
-      uses: lewagon/wait-on-check-action@752bfae19aef55dab12a00bc36d48acc46b77e9d # v1.1.1
+      uses: lewagon/wait-on-check-action@3a563271c3f8d1611ed7352809303617ee7e54ac # v1.2.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         wait-interval: 10
         running-workflow-name: '${{ inputs.job }} / ${{ github.job }}' # the name of the check for this job
     - name: Merge PR
-      uses: pascalgn/automerge-action@741c311a47881be9625932b0a0de1b0937aab1ae # v0.13.1
+      uses: pascalgn/automerge-action@eb68b061739cb9d81564f8e812d0b3c45f0fb09a # v0.15.5
       env:
         GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         MERGE_LABELS: ""
diff --git a/.github/workflows/check-yaml.yml b/.github/workflows/check-yaml.yml
index 890a8e3d..4bdd2996 100644
--- a/.github/workflows/check-yaml.yml
+++ b/.github/workflows/check-yaml.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: nwisbeta/validate-yaml-schema@c3734e647d2a3beb98b9132330067e900fdbd1a2 # v2.0.0
+      - uses: pl-strflt/validate-yaml-schema@21116b89ed801672cb7354717c0d049974f265b0
         with:
           yamlSchemasJson: |
             {
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 66a99ae8..d1420659 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -39,7 +39,7 @@ jobs:
           fi
       - name: Install semver (node command line tool)
         if: steps.tag.outputs.exists == 'false'
-        run: npm install -g "https://github.com/npm/node-semver#e79ac3a450e8bb504e78b8159e3efc7089569" # v7.3.5
+        run: npm install -g "https://github.com/npm/node-semver#dc0fe202faaf19a545ce5eeab3480be84180a082" # v7.3.8
       - name: Check version
         if: steps.tag.outputs.exists == 'false'
         env:
@@ -71,7 +71,7 @@ jobs:
           fi
       - name: Post output
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version == ''
-        uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
+        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
         with:
           header: release-check
           recreate: true
@@ -102,7 +102,7 @@ jobs:
         # see https://github.com/golang/exp/commits/master/cmd/gorelease
         run: |
           go mod download
-          go install golang.org/x/exp/cmd/gorelease@b4e88ed8e8aab63a9aa9a52276782ebbc547adef
+          go install golang.org/x/exp/cmd/gorelease@f062dba9d201f5ec084d25785efec05637818c00 # https://cs.opensource.google/go/x/exp/+/f062dba9d201f5ec084d25785efec05637818c00
           output=$((gorelease -base "$PREV_VERSION") 2>&1 || true)
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - id: gocompat
@@ -145,7 +145,7 @@ jobs:
           fi
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - name: Post message on PR
-        uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
+        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
         with:
           header: release-check
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 7c27f737..64174686 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Determine if this commit is a merged PR (if we're not on a default branch)
         if: env.DEFAULT_BRANCH != github.ref
         id: getmergedpr
-        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9
+        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9 # v1.0.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Check if the "release" label was set on the PR
diff --git a/.github/workflows/tagpush.yml b/.github/workflows/tagpush.yml
index f295aacf..b2c19e90 100644
--- a/.github/workflows/tagpush.yml
+++ b/.github/workflows/tagpush.yml
@@ -36,7 +36,7 @@ jobs:
       - run: cat .github/workflows/tagpush.md
       - name: create an issue
         if: ${{ github.event.pusher.name != 'web3-bot' }}
-        uses: JasonEtco/create-an-issue@9e6213aec58987fa7d2f4deb8b256b99e63107a2 # v2.6.0
+        uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2.9.1
         env:
           GITHUB_TOKEN: ${{ github.token }}
           PUSHER: ${{ github.event.pusher.name }}
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index b834b1c4..ee5969eb 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -24,7 +24,7 @@ jobs:
             echo "RUNGOGENERATE=true" >> $GITHUB_ENV
           fi
       - name: Install staticcheck
-        run: go install honnef.co/go/tools/cmd/staticcheck@376210a89477dedbe6fdc4484b233998650d7b3c # 2022.1.3 (v0.3.3)
+        run: go install honnef.co/go/tools/cmd/staticcheck@4970552d932f48b71485287748246cf3237cebdf # 2023.1 (v0.4.0)
       - name: Check that go.mod is tidy
         uses: protocol/multiple-go-modules@v1.2
         with:
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index c229ce10..2b5073e1 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -67,7 +67,7 @@ jobs:
         shell: bash
         run: echo "COVERAGES=$(find . -type f -name 'module-coverage.txt' | tr -s '\n' ',' | sed 's/,$//')" >> $GITHUB_ENV
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           files: '${{ env.COVERAGES }}'
           env_vars: OS=${{ matrix.os }}, GO=${{ matrix.go }}
diff --git a/templates/.github/workflows/js-test-and-release.yml b/templates/.github/workflows/js-test-and-release.yml
index 27fd45a3..0bd8f243 100644
--- a/templates/.github/workflows/js-test-and-release.yml
+++ b/templates/.github/workflows/js-test-and-release.yml
@@ -33,7 +33,7 @@ jobs:
           node-version: ${{ matrix.node }}
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:node
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: node
 
@@ -47,7 +47,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:chrome
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: chrome
 
@@ -61,7 +61,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:chrome-webworker
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: chrome-webworker
 
@@ -75,7 +75,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:firefox
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: firefox
 
@@ -89,7 +89,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:firefox-webworker
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: firefox-webworker
 
@@ -103,7 +103,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npx xvfb-maybe npm run --if-present test:electron-main
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: electron-main
 
@@ -117,7 +117,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npx xvfb-maybe npm run --if-present test:electron-renderer
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: electron-renderer