diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c6c6ea7ba4..113a6312fd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3.0.0
+        uses: actions/checkout@v3.0.2
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 0131673bbd..ab60520e23 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v3.0.0
+        uses: actions/checkout@v3.0.2
       -
         name: Spell-Checking
         uses: codespell-project/actions-codespell@master
diff --git a/.github/workflows/editorconfig-checker b/.github/workflows/editorconfig-checker
index 67bf86aa0d..b21598ba59 100644
--- a/.github/workflows/editorconfig-checker
+++ b/.github/workflows/editorconfig-checker
@@ -7,8 +7,8 @@ on:
 jobs:
     build:
       name: editorconfig-checker
-      runs-on: ubuntu-20.04
+      runs-on: ubuntu-latest
       steps:
-        - uses: actions/checkout@v3.0.0
-        - uses: editorconfig-checker/action-editorconfig-checker@v1.0.0
+        - uses: actions/checkout@v3.0.2
+        - uses: editorconfig-checker/action-editorconfig-checker@main # current tag v1.0.0 is really out-of-date
         - run: editorconfig-checker
diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index eff290e8a6..e0fb326d42 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -8,7 +8,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3.0.0
+    - uses: actions/checkout@v3.0.2
     - name: Change PHP version
       run: |
         sudo update-alternatives --set php /usr/bin/php8.0
@@ -21,7 +21,7 @@ jobs:
       run: composer validate
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v3.0.0
+      uses: actions/cache@v3.0.5
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 3d98d6ba98..12f9064246 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write
 
     steps:
-    - uses: actions/stale@v5.0.0
+    - uses: actions/stale@v5.1.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-stale: 30
diff --git a/.github/workflows/sync-back-to-dev.yml b/.github/workflows/sync-back-to-dev.yml
index ad24e60eef..bce9c59d16 100644
--- a/.github/workflows/sync-back-to-dev.yml
+++ b/.github/workflows/sync-back-to-dev.yml
@@ -11,7 +11,7 @@ jobs:
     name: Syncing branches
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.0.0
+        uses: actions/checkout@v3.0.2
       - name: Opening pull request
         id: pull
         uses: tretuna/sync-branches@1.4.0
@@ -20,7 +20,7 @@ jobs:
           FROM_BRANCH: 'master'
           TO_BRANCH: 'devel'
       - name: Label the pull request to ignore for release note generation
-        uses: actions-ecosystem/action-add-labels@v1.0.0
+        uses: actions-ecosystem/action-add-labels@v1.1.0
         with:
           labels: internal
           repo: ${{ github.repository }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8f4157c346..59838b8df1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v3.0.0
+        uses: actions/checkout@v3.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3.0.0
+        uses: actions/setup-node@v3.4.1
         with:
           node-version: "16.x"
           cache: npm