diff --git a/.github/workflows/ai-assistant.yaml b/.github/workflows/ai-assistant.yaml
index efb4ce1..b3c098a 100644
--- a/.github/workflows/ai-assistant.yaml
+++ b/.github/workflows/ai-assistant.yaml
@@ -51,7 +51,7 @@ jobs:
     steps:
       - name: React to the mention (👀)
         # 先给评论打个 👀，让用户知道 workflow 收到了，避免以为没触发
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -62,7 +62,7 @@ jobs:
             });
 
       - name: Checkout (for repo context)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # 只拉关键文件做 prompt 上下文，不 checkout 全部（快）
           sparse-checkout: |
@@ -74,7 +74,7 @@ jobs:
 
       - name: Gather issue context
         id: context
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issueNumber = context.payload.issue?.number
@@ -122,7 +122,7 @@ jobs:
 
       - name: Call GitHub Models
         id: ai
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           model: openai/gpt-4o-mini
           system-prompt: |
@@ -164,7 +164,7 @@ jobs:
           max-tokens: 1200
 
       - name: Reply in the issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_RESPONSE: ${{ steps.ai.outputs.response }}
           ASKER: ${{ steps.context.outputs.asker }}
diff --git a/.github/workflows/ai-autofix.yaml b/.github/workflows/ai-autofix.yaml
index 02c6fb7..6046ba9 100644
--- a/.github/workflows/ai-autofix.yaml
+++ b/.github/workflows/ai-autofix.yaml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: React to the mention (🔧)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -61,7 +61,7 @@ jobs:
 
       - name: Resolve PR metadata
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const {data: pr} = await github.rest.pulls.get({
@@ -79,7 +79,7 @@ jobs:
         # then, pushing autofix commits to a fork is brittle. Document
         # the workaround (manual biome run locally) and bail early.
         if: steps.pr.outputs.is_fork == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.issues.createComment({
@@ -102,7 +102,7 @@ jobs:
             core.setFailed('Skipping: PR is from a fork.');
 
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.pr.outputs.head_ref }}
           fetch-depth: 0      # full history for later push
@@ -112,8 +112,8 @@ jobs:
           token: ${{ secrets.REPO_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup pnpm + Node
-        uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: pnpm
@@ -167,7 +167,7 @@ jobs:
           git push --no-verify origin HEAD:"${{ steps.pr.outputs.head_ref }}"
 
       - name: Comment outcome
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           COMMIT: ${{ steps.decide.outputs.commit }}
           REASON: ${{ steps.decide.outputs.reason }}
diff --git a/.github/workflows/ai-code-fix.yaml b/.github/workflows/ai-code-fix.yaml
index 155df12..7c907b8 100644
--- a/.github/workflows/ai-code-fix.yaml
+++ b/.github/workflows/ai-code-fix.yaml
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: React (🔧)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -67,14 +67,14 @@ jobs:
             });
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.REPO_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup pnpm + Node
-        uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: pnpm
@@ -82,7 +82,7 @@ jobs:
 
       - name: Gather issue context + source tree snapshot
         id: context
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issueNumber = context.payload.issue.number;
@@ -137,7 +137,7 @@ jobs:
 
       - name: Attempt 1 — ask GPT-4o for a patch plan
         id: ai1
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           model: openai/gpt-4o
           system-prompt: |
@@ -193,7 +193,7 @@ jobs:
 
       - name: Apply patch (attempt 1)
         id: apply1
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_OUTPUT: ${{ steps.ai1.outputs.response }}
         with:
@@ -275,7 +275,7 @@ jobs:
       - name: Attempt 2 — retry with error context
         id: ai2
         if: steps.apply1.outputs.success == 'true' && steps.check1.outputs.pass == 'false'
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           model: openai/gpt-4o
           system-prompt: |
@@ -303,7 +303,7 @@ jobs:
       - name: Apply patch (attempt 2)
         id: apply2
         if: steps.check1.outputs.pass == 'false'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_OUTPUT: ${{ steps.ai2.outputs.response }}
         with:
@@ -382,7 +382,7 @@ jobs:
 
       - name: Commit + push + open DRAFT PR
         if: steps.final.outputs.mode == 'pr'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           BRANCH: ${{ steps.branch.outputs.name }}
           TITLE: ${{ steps.final.outputs.title }}
@@ -477,7 +477,7 @@ jobs:
           echo "$DIFF_TEXT" > /tmp/degrade.diff
       - name: Comment degrade outcome
         if: steps.final.outputs.mode == 'degrade'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ASKER: ${{ steps.context.outputs.asker }}
diff --git a/.github/workflows/ai-docs-assistant.yaml b/.github/workflows/ai-docs-assistant.yaml
index 11cb02c..1eca606 100644
--- a/.github/workflows/ai-docs-assistant.yaml
+++ b/.github/workflows/ai-docs-assistant.yaml
@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: React (📚)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -60,7 +60,7 @@ jobs:
 
       - name: Parse command
         id: cmd
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const body = context.payload.comment.body;
@@ -80,14 +80,14 @@ jobs:
             core.setOutput('asker', context.payload.comment.user.login);
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.REPO_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup pnpm + Node
-        uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: pnpm
@@ -146,7 +146,7 @@ jobs:
       - name: Call AI (draft mode)
         id: ai_draft
         if: steps.cmd.outputs.mode == 'draft'
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           model: openai/gpt-4o
           system-prompt: |
@@ -206,7 +206,7 @@ jobs:
       - name: Call AI (polish mode)
         id: ai_polish
         if: steps.cmd.outputs.mode == 'polish'
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           model: openai/gpt-4o
           system-prompt: |
@@ -242,7 +242,7 @@ jobs:
       - name: Apply (draft)
         if: steps.cmd.outputs.mode == 'draft'
         id: apply_draft
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_OUTPUT: ${{ steps.ai_draft.outputs.response }}
         with:
@@ -333,7 +333,7 @@ jobs:
 
       - name: Commit + push + draft PR
         if: steps.smoke.outputs.pass == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           BRANCH: ${{ steps.branch.outputs.name }}
           MODE:   ${{ steps.cmd.outputs.mode }}
@@ -424,7 +424,7 @@ jobs:
 
       - name: Report failure
         if: steps.smoke.outputs.pass != 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ASKER: ${{ steps.cmd.outputs.asker }}
diff --git a/.github/workflows/ai-review-deepseek.yaml b/.github/workflows/ai-review-deepseek.yaml
index 8419f91..3c7d204 100644
--- a/.github/workflows/ai-review-deepseek.yaml
+++ b/.github/workflows/ai-review-deepseek.yaml
@@ -44,14 +44,14 @@ jobs:
 
     steps:
       - name: Checkout PR
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha || github.event.pull_request.head.sha }}
           fetch-depth: 2
 
       - name: Collect PR diff
         id: diff
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -93,7 +93,7 @@ jobs:
 
       - name: Call DeepSeek for reasoning-focused review
         id: ai
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           # DeepSeek V3 0324 is the publicly available V3 checkpoint via
           # GitHub Models. Its sweet spot is "reason through edge cases
@@ -159,7 +159,7 @@ jobs:
           max-tokens: 2000
 
       - name: Post / update DeepSeek review comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_RESPONSE: ${{ steps.ai.outputs.response }}
         with:
diff --git a/.github/workflows/ai-review-gpt.yaml b/.github/workflows/ai-review-gpt.yaml
index 815bf50..9f64204 100644
--- a/.github/workflows/ai-review-gpt.yaml
+++ b/.github/workflows/ai-review-gpt.yaml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout PR (merge commit)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Use the PR merge ref so the reviewer sees exactly what
           # would land on master. fetch-depth:2 gives us HEAD~1 for diff.
@@ -51,7 +51,7 @@ jobs:
 
       - name: Collect PR diff (<= 150 KB)
         id: diff
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -106,7 +106,7 @@ jobs:
 
       - name: Call GPT-4o for review
         id: ai
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           # gpt-4o (not mini) — this is a review task, model quality
           # matters more than latency. Costs nothing on public repos.
@@ -175,7 +175,7 @@ jobs:
           max-tokens: 2000
 
       - name: Post / update review comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_RESPONSE: ${{ steps.ai.outputs.response }}
         with:
diff --git a/.github/workflows/ai-review-llama.yaml b/.github/workflows/ai-review-llama.yaml
index a8e4ae4..8d2312b 100644
--- a/.github/workflows/ai-review-llama.yaml
+++ b/.github/workflows/ai-review-llama.yaml
@@ -46,14 +46,14 @@ jobs:
 
     steps:
       - name: Checkout PR
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha || github.event.pull_request.head.sha }}
           fetch-depth: 2
 
       - name: Collect PR diff + repo context
         id: diff
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -107,7 +107,7 @@ jobs:
 
       - name: Call Llama for cross-file review
         id: ai
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           # Llama 3.3 70B is Meta's open-weights flagship on GitHub Models.
           # It's our second voice — different training data & RLHF from GPT,
@@ -171,7 +171,7 @@ jobs:
           max-tokens: 1800
 
       - name: Post / update Llama review comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_RESPONSE: ${{ steps.ai.outputs.response }}
         with:
diff --git a/.github/workflows/ai-summarize.yaml b/.github/workflows/ai-summarize.yaml
index 4693f50..c9cf20b 100644
--- a/.github/workflows/ai-summarize.yaml
+++ b/.github/workflows/ai-summarize.yaml
@@ -34,7 +34,7 @@ jobs:
     steps:
       - name: Collect thread content
         id: gather
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issueNumber = context.payload.issue?.number
@@ -69,7 +69,7 @@ jobs:
 
       - name: Call GitHub Models for summary
         id: ai
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           model: openai/gpt-4o-mini
           system-prompt: |
@@ -103,7 +103,7 @@ jobs:
           max-tokens: 800
 
       - name: Remove old AI summaries and post new one
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_RESPONSE: ${{ steps.ai.outputs.response }}
         with:
diff --git a/.github/workflows/ai-triage.yaml b/.github/workflows/ai-triage.yaml
index d4c684b..3e332b7 100644
--- a/.github/workflows/ai-triage.yaml
+++ b/.github/workflows/ai-triage.yaml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout (for README context)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           sparse-checkout: |
             README.md
@@ -49,7 +49,7 @@ jobs:
 
       - name: Call GitHub Models for triage analysis
         id: ai
-        uses: actions/ai-inference@v1
+        uses: actions/ai-inference@v3
         with:
           # GPT-4o-mini 足够做这种分类任务，速度最快且额度最宽裕。
           # 想用更强的模型可改成:
@@ -93,7 +93,7 @@ jobs:
           max-tokens: 500
 
       - name: Parse AI response and apply labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           AI_RESPONSE: ${{ steps.ai.outputs.response }}
         with:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8791575..622abe1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -62,13 +62,13 @@ jobs:
     name: 🎨 Lint (Biome)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -93,15 +93,15 @@ jobs:
     # 仅 PR 场景检查整段 commits
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -129,13 +129,13 @@ jobs:
         # packages/* 本身兼容更老的 Node，如需验证可以单独加一个 job。
         node: [20, 22]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node ${{ matrix.node }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
@@ -182,9 +182,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d66ea3a..2082472 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -62,7 +62,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Full history so changesets can generate accurate changelogs.
           fetch-depth: 0
@@ -73,11 +73,11 @@ jobs:
           token: ${{ secrets.REPO_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         # version is read from root package.json "packageManager"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: pnpm
@@ -111,7 +111,7 @@ jobs:
 
       - name: Create Release PR or publish
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@v2
         with:
           # `publish: pnpm release` runs when the "Version Packages" PR is
           # merged. It calls `pnpm release` from root → `changeset publish`.
diff --git a/.github/workflows/rspress-docs-ci-cd.yaml b/.github/workflows/rspress-docs-ci-cd.yaml
index 6251944..47da16e 100644
--- a/.github/workflows/rspress-docs-ci-cd.yaml
+++ b/.github/workflows/rspress-docs-ci-cd.yaml
@@ -37,17 +37,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # 若 lastUpdated 启用需要完整 git log
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         # version is read from root package.json "packageManager"
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: pnpm
@@ -59,7 +59,7 @@ jobs:
         # and the default GITHUB_TOKEN doesn't have that permission.
         # If this step fails with 'Get Pages site failed', the fix is
         # to switch the source to "GitHub Actions" in the UI once.
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Install
         run: pnpm install --frozen-lockfile
@@ -73,7 +73,7 @@ jobs:
         run: pnpm run docs:build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: apps/docs/doc_build
 
@@ -87,4 +87,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5