diff --git a/.github/workflows/autoscript.yml b/.github/workflows/autoscript.yml
index 13d61b0..77fb546 100644
--- a/.github/workflows/autoscript.yml
+++ b/.github/workflows/autoscript.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.11'
       - name: Ejecutar
@@ -29,7 +29,7 @@ jobs:
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
           BACKEND_URL:      ${{ secrets.BACKEND_URL }}
         run: python python/codehub.py ${{ github.event.inputs.command || 'all' }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: backups-${{ github.run_number }}
diff --git a/.github/workflows/build-apk.yml b/.github/workflows/build-apk.yml
index f20dc7c..46e3770 100644
--- a/.github/workflows/build-apk.yml
+++ b/.github/workflows/build-apk.yml
@@ -47,13 +47,13 @@ jobs:
           echo "build.gradle -> versionName $APPVER (versionCode $APPCODE)"
 
       - name: Setup Java JDK 17
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '17'
           distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
         with:
           # 8.11.1 = mínimo para AGP 8.9 (compileSdk 36)
           gradle-version: '8.13'
@@ -63,7 +63,7 @@ jobs:
       # trae el SDK pre-instalado (compileSdk 36) en $ANDROID_HOME.
       - name: Setup Android SDK
         id: setup-android
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         continue-on-error: true
 
       - name: Accept SDK licenses
@@ -149,7 +149,7 @@ jobs:
 
       - name: Upload compile log (debug)
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: compile-debug-log
           path: ${{ runner.temp }}/compile-debug.log
@@ -350,7 +350,7 @@ jobs:
 
       - name: Upload release build log
         if: always() && steps.release-build.outcome != 'skipped'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-build-log
           path: ${{ runner.temp }}/release-build.log
@@ -453,7 +453,7 @@ jobs:
 
       - name: Upload APK artifact
         if: always() && hashFiles('apk/android/**/*.apk') != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codehub-apk-build
           path: apk/android/**/*.apk
diff --git a/.github/workflows/build-ytm-extension.yml b/.github/workflows/build-ytm-extension.yml
index 99c01d0..2f1576c 100644
--- a/.github/workflows/build-ytm-extension.yml
+++ b/.github/workflows/build-ytm-extension.yml
@@ -22,13 +22,13 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout CodeHub (para catalogo)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: codehub
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout fork
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ${{ github.event.inputs.repo }}
           ref: ${{ github.event.inputs.ref }}
@@ -36,7 +36,7 @@ jobs:
           path: ext
 
       - name: Setup JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: 'zulu'
           java-version: 17
@@ -133,14 +133,14 @@ jobs:
           test -f "$GITHUB_WORKSPACE/youtube-music-codebeat.eapk" && echo "APK listo: $(du -h "$GITHUB_WORKSPACE/youtube-music-codebeat.eapk" | cut -f1)"
 
       - name: Upload APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ytm-extension
           path: youtube-music-codebeat.eapk
 
       - name: Create Release
         id: release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ytm-${{ github.run_number }}
           name: YouTube Music Extension (CodeBeat build)
diff --git a/.github/workflows/dedupe-catalog.yml b/.github/workflows/dedupe-catalog.yml
index faca30b..353ed5c 100644
--- a/.github/workflows/dedupe-catalog.yml
+++ b/.github/workflows/dedupe-catalog.yml
@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: ⚙️ Setup Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 50c6c8d..74453e4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
       - name: Instalar dependencias
diff --git a/.github/workflows/echo-build.yml b/.github/workflows/echo-build.yml
index 5308395..190c70e 100644
--- a/.github/workflows/echo-build.yml
+++ b/.github/workflows/echo-build.yml
@@ -24,19 +24,19 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Java JDK 17
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '17'
           distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
         with:
           gradle-version: '8.13'
 
       - name: Setup Android SDK
         id: setup-android
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         continue-on-error: true
 
       - name: Accept SDK licenses
@@ -132,7 +132,7 @@ jobs:
 
       - name: Subir logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: echo-build-logs
           path: |
@@ -143,7 +143,7 @@ jobs:
 
       - name: Subir APK debug (prueba en dispositivo)
         if: success()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codehub-echo-debug-apk
           path: apk/android/app/build/outputs/apk/debug/app-debug.apk
diff --git a/.github/workflows/enrich-app-logos.yml b/.github/workflows/enrich-app-logos.yml
index 387a599..5000d8f 100644
--- a/.github/workflows/enrich-app-logos.yml
+++ b/.github/workflows/enrich-app-logos.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: ⚙️ Setup Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/generate-cert-pin.yml b/.github/workflows/generate-cert-pin.yml
index e37b072..5780420 100644
--- a/.github/workflows/generate-cert-pin.yml
+++ b/.github/workflows/generate-cert-pin.yml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
 
       - name: Descargar APK del release
         env:
diff --git a/.github/workflows/keystore-generate.yml b/.github/workflows/keystore-generate.yml
index c3c4d54..076ce00 100644
--- a/.github/workflows/keystore-generate.yml
+++ b/.github/workflows/keystore-generate.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Java JDK 17
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: '17'
           distribution: 'temurin'
@@ -78,7 +78,7 @@ jobs:
           fi
 
       - name: Subir keystore como artefacto (descargar y guardar fuera)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codehub-release-keystore
           path: |
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 4bd589f..2128759 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -76,7 +76,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -95,7 +95,7 @@ jobs:
 
       - name: Subir reporte si falla
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report
           path: playwright-report/
@@ -111,7 +111,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -130,7 +130,7 @@ jobs:
 
       - name: Subir reporte Lighthouse
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: lighthouse-report
           path: lighthouse-out/
diff --git a/.github/workflows/rebuild-assets.yml b/.github/workflows/rebuild-assets.yml
index 345fc27..d893016 100644
--- a/.github/workflows/rebuild-assets.yml
+++ b/.github/workflows/rebuild-assets.yml
@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/seed-foss-catalog.yml b/.github/workflows/seed-foss-catalog.yml
index a1834ed..e021826 100644
--- a/.github/workflows/seed-foss-catalog.yml
+++ b/.github/workflows/seed-foss-catalog.yml
@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: ⚙️ Setup Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/vapid-keys.yml b/.github/workflows/vapid-keys.yml
index 8a016a6..6720138 100644
--- a/.github/workflows/vapid-keys.yml
+++ b/.github/workflows/vapid-keys.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'