From c7fff50f0bb5cde1a5fd763124c3319c37674806 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Mon, 21 Sep 2026 13:35:29 +0200
Subject: [PATCH 1/6] Pin actions/checkout@v7

https://github.com/actions/checkout/releases/tag/v7
https://github.com/actions/checkout/releases/tag/v7.0.1
---
 .github/workflows/build.yml                     | 2 +-
 .github/workflows/code-formatting.yml           | 2 +-
 .github/workflows/codeql-analysis.yml           | 2 +-
 .github/workflows/coverage.yml                  | 4 ++--
 .github/workflows/integration-test.yml          | 2 +-
 .github/workflows/release-verify-signatures.yml | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a1477f9a6..89a2b22e7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK ${{ matrix.java }}
       uses: actions/setup-java@v6
diff --git a/.github/workflows/code-formatting.yml b/.github/workflows/code-formatting.yml
index 9d6a4c3b0..4103fa2ad 100644
--- a/.github/workflows/code-formatting.yml
+++ b/.github/workflows/code-formatting.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK
       uses: actions/setup-java@v6
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index db1551a84..429df9dd8 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - uses: actions/setup-java@v6
       with:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index df2978232..07989e694 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK
       uses: actions/setup-java@v6
@@ -48,7 +48,7 @@ jobs:
         sed "s/{shortcommit}/${GITHUB_SHA:0:8}/g;s/{commit}/${GITHUB_SHA}/g;s#{repo}#${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}#g" .github/workflows/coverage/index.html.template > build/gh-pages/index.html
 
     - name: Check out GitHub Pages branch
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
       with:
         ref: gh-pages
         clean: false
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 5a5875881..d4decbac6 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK ${{ matrix.java }}
       uses: actions/setup-java@v6
diff --git a/.github/workflows/release-verify-signatures.yml b/.github/workflows/release-verify-signatures.yml
index 2be090ecc..f4d333a9d 100644
--- a/.github/workflows/release-verify-signatures.yml
+++ b/.github/workflows/release-verify-signatures.yml
@@ -44,7 +44,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
       with:
         ref: ${{ github.ref_name }}
 

From c4bcbefc7a7a74c482dc063e80074b891c08ffa9 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Mon, 21 Sep 2026 13:37:11 +0200
Subject: [PATCH 2/6] Pin actions/upload-artifact@v7

https://github.com/actions/upload-artifact/releases/tag/v7
https://github.com/actions/upload-artifact/releases/tag/v7.0.1
---
 .github/workflows/build.yml                     | 6 +++---
 .github/workflows/coverage.yml                  | 2 +-
 .github/workflows/integration-test.yml          | 4 ++--
 .github/workflows/release-verify-signatures.yml | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 89a2b22e7..e2f73661f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -64,14 +64,14 @@ jobs:
 
     - name: Archive HTML test reports
       if: ${{ always() }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-html
         path: "*/build/reports/**"
 
     - name: Archive JUnit test reports
       if: ${{ always() }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-xml
         path: "*/build/test-results/**/*.xml"
@@ -84,7 +84,7 @@ jobs:
         ./gradlew clean primaryPublishJar && sha256sum -c java-webauthn-server-artifacts-${{ matrix.java }}-${{ matrix.distribution }}.sha256sum
 
     - name: Archive artifact checksums
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         path: java-webauthn-server-artifacts-${{ matrix.java }}-${{ matrix.distribution }}.sha256sum
         archive: false
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 07989e694..865404c8d 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -31,7 +31,7 @@ jobs:
       run: ./gradlew pitestMerge
 
     - name: Archive test reports
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         name: pitest-reports-${{ github.sha }}
         path: "*/build/reports/pitest/**"
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index d4decbac6..45f29f82d 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -39,14 +39,14 @@ jobs:
 
     - name: Archive HTML test report
       if: ${{ always() }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-html
         path: "*/build/reports/**"
 
     - name: Archive JUnit test report
       if: ${{ always() }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-xml
         path: "*/build/test-results/**/*.xml"
diff --git a/.github/workflows/release-verify-signatures.yml b/.github/workflows/release-verify-signatures.yml
index f4d333a9d..fdff2f0ef 100644
--- a/.github/workflows/release-verify-signatures.yml
+++ b/.github/workflows/release-verify-signatures.yml
@@ -24,7 +24,7 @@ jobs:
         until wget https://repo1.maven.org/maven2/com/yubico/webauthn-server-core/${{ github.ref_name }}/webauthn-server-core-${{ github.ref_name }}.jar.asc; do sleep 180; done
 
     - name: Store keyring and signatures as artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7 => v7.0.1
       with:
         name: keyring-and-signatures
         retention-days: 1

From f32e313e0e7f5d35dd83cd128939b85b297af900 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Mon, 21 Sep 2026 13:56:02 +0200
Subject: [PATCH 3/6] Pin actions/setup-java@v6

https://github.com/actions/setup-java/releases/tag/v6
https://github.com/actions/setup-java/releases/tag/v6.0.1
---
 .github/workflows/build.yml                     | 2 +-
 .github/workflows/code-formatting.yml           | 2 +-
 .github/workflows/codeql-analysis.yml           | 2 +-
 .github/workflows/coverage.yml                  | 2 +-
 .github/workflows/integration-test.yml          | 2 +-
 .github/workflows/release-verify-signatures.yml | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e2f73661f..83dd234ae 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,7 +36,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK ${{ matrix.java }}
-      uses: actions/setup-java@v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6 => v6.0.1
       with:
         java-version: ${{ matrix.java }}
         distribution: ${{ matrix.distribution }}
diff --git a/.github/workflows/code-formatting.yml b/.github/workflows/code-formatting.yml
index 4103fa2ad..bbc200f09 100644
--- a/.github/workflows/code-formatting.yml
+++ b/.github/workflows/code-formatting.yml
@@ -24,7 +24,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK
-      uses: actions/setup-java@v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6 => v6.0.1
       with:
         java-version: ${{ matrix.java }}
         distribution: ${{ matrix.distribution }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 429df9dd8..81883abf5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -23,7 +23,7 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
-    - uses: actions/setup-java@v6
+    - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6 => v6.0.1
       with:
         java-version: 25
         distribution: temurin
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 865404c8d..4341f779b 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -22,7 +22,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK
-      uses: actions/setup-java@v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6 => v6.0.1
       with:
         java-version: 25
         distribution: temurin
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 45f29f82d..b25c725f7 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -29,7 +29,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7 => v7.0.1
 
     - name: Set up JDK ${{ matrix.java }}
-      uses: actions/setup-java@v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6 => v6.0.1
       with:
         java-version: ${{ matrix.java }}
         distribution: ${{ matrix.distribution }}
diff --git a/.github/workflows/release-verify-signatures.yml b/.github/workflows/release-verify-signatures.yml
index fdff2f0ef..aaaee0202 100644
--- a/.github/workflows/release-verify-signatures.yml
+++ b/.github/workflows/release-verify-signatures.yml
@@ -49,7 +49,7 @@ jobs:
         ref: ${{ github.ref_name }}
 
     - name: Set up JDK
-      uses: actions/setup-java@v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6 => v6.0.1
       with:
         java-version: ${{ matrix.java }}
         distribution: ${{ matrix.distribution }}

From 3edbc5e492401f53340b6205bfc5bab5674d143e Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Mon, 21 Sep 2026 13:40:53 +0200
Subject: [PATCH 4/6] Pin actions/download-artifact@v8

https://github.com/actions/download-artifact/releases/tag/v8
https://github.com/actions/download-artifact/releases/tag/v8.0.1
---
 .github/workflows/build.yml                     | 2 +-
 .github/workflows/release-verify-signatures.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 83dd234ae..8c6705193 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -101,7 +101,7 @@ jobs:
 
     steps:
     - name: Download artifacts
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8 => v8.0.1
       with:
         name: test-reports-java${{ needs.test.outputs.report-java }}-${{ needs.test.outputs.report-dist }}-xml
 
diff --git a/.github/workflows/release-verify-signatures.yml b/.github/workflows/release-verify-signatures.yml
index aaaee0202..94af3e31d 100644
--- a/.github/workflows/release-verify-signatures.yml
+++ b/.github/workflows/release-verify-signatures.yml
@@ -68,7 +68,7 @@ jobs:
         done
 
     - name: Retrieve keyring and signatures
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8 => v8.0.1
       with:
         name: keyring-and-signatures
 
@@ -87,7 +87,7 @@ jobs:
 
     steps:
     - name: Retrieve signatures
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8 => v8.0.1
       with:
         name: keyring-and-signatures
 

From 1d1ad6213eb0cc5d1d759b2dc85e683f81f95e2a Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Mon, 21 Sep 2026 13:43:32 +0200
Subject: [PATCH 5/6] Pin github/codeql-action@v4

https://github.com/github/codeql-action/releases/tag/v4
https://github.com/github/codeql-action/releases/tag/v4.38.1
---
 .github/workflows/codeql-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 81883abf5..c880621be 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -30,7 +30,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4 => v4.38.1
       with:
         languages: java
 
@@ -39,4 +39,4 @@ jobs:
         ./gradlew jar
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4 => v4.38.1

From ca32c57fd38b97322fe92bdc9e71ae2aed58e525 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Mon, 21 Sep 2026 13:45:04 +0200
Subject: [PATCH 6/6] Pin EnricoMi/publish-unit-test-result-action@v2

https://github.com/EnricoMi/publish-unit-test-result-action/releases/tag/v2
https://github.com/EnricoMi/publish-unit-test-result-action/releases/tag/v2.24.0
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8c6705193..9b6627667 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -106,6 +106,6 @@ jobs:
         name: test-reports-java${{ needs.test.outputs.report-java }}-${{ needs.test.outputs.report-dist }}-xml
 
     - name: Publish test results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3  # v2 => v2.24.0
       with:
         files: "**/*.xml"