diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1a2b4b3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+    groups:
+      github-actions-minor:
+        update-types:
+          - minor
+          - patch
diff --git a/.github/workflows/build-for-heroku.yml b/.github/workflows/build-for-heroku.yml
index ace464a..166a352 100644
--- a/.github/workflows/build-for-heroku.yml
+++ b/.github/workflows/build-for-heroku.yml
@@ -47,13 +47,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Heroku CLI
         if: ${{ env.ACT }}
         run: curl https://cli-assets.heroku.com/install-ubuntu.sh | sh
 
-      - uses: akhileshns/heroku-deploy@v3.12.13 # This is the action
+      - uses: akhileshns/heroku-deploy@1b080913896a5d6d44a18e9e208f8eb1fee9b0f7 # v3.15.15
         with:
           heroku_api_key: ${{secrets.HEROKU_API_KEY}}
           heroku_app_name: ${{ inputs.heroku_app_name }} # Must be unique in Heroku
diff --git a/.github/workflows/caprover-configure-app.yml b/.github/workflows/caprover-configure-app.yml
index 05d1a6d..7b5f756 100644
--- a/.github/workflows/caprover-configure-app.yml
+++ b/.github/workflows/caprover-configure-app.yml
@@ -96,13 +96,13 @@ jobs:
       name: ${{ inputs.caproverAppName }}
       url: ${{ inputs.deployTargetUrl || env.defaultDeployTargetUrl }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: cardinalby/export-env-action@2.2.0
+      - uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
         with:
           envFile: ${{ inputs.envFile }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -158,7 +158,7 @@ jobs:
       - name: Enable SSL 🔒
         run: bunx caprover api --path=/user/apps/appDefinitions/enablebasedomainssl --method=POST --data='{"appName":"${{ inputs.caproverAppName }}"}'
 
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         if: ${{ inputs.discordWebhook }}
         with:
           webhook: ${{ inputs.discordWebhook }}
diff --git a/.github/workflows/caprover-deploy.yml b/.github/workflows/caprover-deploy.yml
index dfd92b0..d383b8c 100644
--- a/.github/workflows/caprover-deploy.yml
+++ b/.github/workflows/caprover-deploy.yml
@@ -41,12 +41,12 @@ jobs:
       name: ${{ inputs.caproverAppName }}
       url: ${{ inputs.deployTargetUrl || env.defaultDeployTargetUrl }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: cardinalby/export-env-action@2.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
         with:
           envFile: ${{ inputs.envFile }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -59,7 +59,7 @@ jobs:
           CAPROVER_IMAGE_NAME: ${{ inputs.caproverImageName }}
           CAPROVER_APP: ${{ inputs.caproverAppName }}
 
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         if: ${{ inputs.discordWebhook }}
         with:
           webhook: ${{ inputs.discordWebhook }}
diff --git a/.github/workflows/deploy-to-heroku.yml b/.github/workflows/deploy-to-heroku.yml
index 486e2ea..c4efec6 100644
--- a/.github/workflows/deploy-to-heroku.yml
+++ b/.github/workflows/deploy-to-heroku.yml
@@ -43,13 +43,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Heroku CLI
         if: ${{ env.ACT }}
         run: curl https://cli-assets.heroku.com/install-ubuntu.sh | sh
 
-      - uses: akhileshns/heroku-deploy@v3.12.13 # This is the action
+      - uses: akhileshns/heroku-deploy@1b080913896a5d6d44a18e9e208f8eb1fee9b0f7 # v3.15.15
         with:
           heroku_api_key: ${{secrets.HEROKU_API_KEY}}
           heroku_app_name: ${{ inputs.heroku_app_name }} # Must be unique in Heroku
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index bc8340e..b9649c7 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -28,21 +28,21 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
-      - uses: cardinalby/export-env-action@2.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
         with:
           envFile: ${{ inputs.envFile }}
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.github-token }}
 
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/build-push-action@v4
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         env:
           baseImage: BASE_IMAGE=oven/bun:${{ env.BUN_VERSION || 'latest' }}-slim
         with:
@@ -53,7 +53,7 @@ jobs:
           cache-to: type=gha,mode=max
           tags: ${{ inputs.dockerImageTags }}
 
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         if: ${{ failure() && inputs.discordWebhook }}
         with:
           webhook: ${{ inputs.discordWebhook }}
diff --git a/.github/workflows/eas-build-local.yml b/.github/workflows/eas-build-local.yml
index 648ab45..efe86ee 100644
--- a/.github/workflows/eas-build-local.yml
+++ b/.github/workflows/eas-build-local.yml
@@ -60,8 +60,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
       google_service_account_key_path:
         required: false
         type: string
@@ -98,31 +97,31 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ !inputs.checkout_ref }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ inputs.checkout_ref }}
         with:
           ref: ${{ inputs.checkout_ref }}
 
       # as required by expo 50
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: zulu
           java-version: ${{ inputs.java_version }}
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: ${{ inputs.package_manager == 'bun' }}
         with:
           bun-version: ${{ inputs.bun_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ inputs.package_manager != 'bun' }}
         with:
           node-version-file: .nvmrc
@@ -144,7 +143,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         id: expo-init
         with:
           # Your Expo username, for authentication.
diff --git a/.github/workflows/eas-build.yml b/.github/workflows/eas-build.yml
index 9f713e1..ca94cf5 100644
--- a/.github/workflows/eas-build.yml
+++ b/.github/workflows/eas-build.yml
@@ -60,8 +60,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
       nodeModulePaths:
         required: false
         type: string
@@ -106,25 +105,25 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ !inputs.checkout_ref }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ inputs.checkout_ref }}
         with:
           ref: ${{ inputs.checkout_ref }}
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: ${{ inputs.package_manager == 'bun' }}
         with:
           bun-version: ${{ inputs.bun_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ inputs.package_manager != 'bun' }}
         with:
           node-version-file: .nvmrc
@@ -146,7 +145,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         id: expo-init
         with:
           # Your Expo username, for authentication.
diff --git a/.github/workflows/expo-preview.yml b/.github/workflows/expo-preview.yml
index cf135fe..8aa0648 100644
--- a/.github/workflows/expo-preview.yml
+++ b/.github/workflows/expo-preview.yml
@@ -37,8 +37,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
     secrets:
       EXPO_TOKEN:
         required: true
@@ -59,14 +58,14 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager }}
@@ -87,7 +86,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           # Your Expo username, for authentication.
           token: ${{ secrets.EXPO_TOKEN }}
@@ -98,7 +97,7 @@ jobs:
 
       - name: Find Metro cache
         id: metro-cache-dir-path
-        uses: actions/github-script@v4
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           result-encoding: string
           script: |
@@ -107,7 +106,7 @@ jobs:
             return path.join(os.tmpdir(), 'metro-cache');
 
       - name: Restore Metro cache
-        uses: actions/cache@v2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ${{ steps.metro-cache-dir-path.outputs.result }}
           key: ${{ runner.os }}-metro-cache-${{ matrix.app }}-${{ github.ref }}
@@ -123,7 +122,7 @@ jobs:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_DEPLOY_ENV: ${{ inputs.expo_release_channel }}
 
-      - uses: marocchino/sticky-pull-request-comment@v2
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         with:
           recreate: true
           message: |
diff --git a/.github/workflows/expo-publish.yml b/.github/workflows/expo-publish.yml
index eeb0c92..09ee558 100644
--- a/.github/workflows/expo-publish.yml
+++ b/.github/workflows/expo-publish.yml
@@ -28,8 +28,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
     secrets:
       EXPO_TOKEN:
         description: The Expo token to use for publishing
@@ -51,15 +50,15 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         id: checkout
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager }}
@@ -80,7 +79,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         id: expo-init
         with:
           # Your Expo username, for authentication.
@@ -92,7 +91,7 @@ jobs:
 
       - name: Find Metro cache
         id: metro-cache-dir-path
-        uses: actions/github-script@v4
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           result-encoding: string
           script: |
@@ -101,7 +100,7 @@ jobs:
             return path.join(os.tmpdir(), 'metro-cache');
 
       - name: Restore Metro cache
-        uses: actions/cache@v2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ${{ steps.metro-cache-dir-path.outputs.result }}
           key: ${{ runner.os }}-metro-cache-${{ matrix.app }}-${{ github.ref }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 9765e6d..118a34a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,8 +18,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
   workflow_call:
     inputs:
       lint_command:
@@ -34,27 +33,27 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         id: checkout
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ env.ACT }}
         with:
           node-version-file: .nvmrc
+          package-manager-cache: false
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ !env.ACT }}
         with:
           node-version-file: .nvmrc
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 20dcd87..a0a713d 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -19,8 +19,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
       shard_count:
         required: false
         type: number
@@ -54,25 +53,24 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
 
 jobs:
   e2e:
     timeout-minutes: 20
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ inputs.repository }}
           token: ${{ secrets.GITHUB_PAT }}
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager }}
@@ -103,9 +101,9 @@ jobs:
         if: ${{ inputs.shard_count > 1 }}
         run: PLAYWRIGHT_TEST_URL=${{ inputs.PLAYWRIGHT_TEST_URL }} npx playwright test --shard=${{ inputs.shard_index }}/${{ inputs.shard_count }}
 
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
-          name: playwright-report
+          name: playwright-report-${{ inputs.shard_index || 1 }}
           path: playwright-report/
           retention-days: 30
diff --git a/.github/workflows/publish-auto.yml b/.github/workflows/publish-auto.yml
index 4248518..80c6e45 100644
--- a/.github/workflows/publish-auto.yml
+++ b/.github/workflows/publish-auto.yml
@@ -17,9 +17,9 @@ jobs:
     needs: [ test ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: pnpm/action-setup@v2
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org/
@@ -36,7 +36,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
       - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           name: ${{ env.versionTag }} - autorelease
           tag_name: ${{ env.versionTag }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ce7330a..aaf4320 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -65,10 +65,10 @@ jobs:
   publish-to-npm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: pnpm/action-setup@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager }}
@@ -89,7 +89,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{secrets.github-token}}
       - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           name: ${{ env.versionTag }} ${{ inputs.description }}
           tag_name: ${{ env.versionTag }}
diff --git a/.github/workflows/test-in-parallel.yml b/.github/workflows/test-in-parallel.yml
index be33024..14a424f 100644
--- a/.github/workflows/test-in-parallel.yml
+++ b/.github/workflows/test-in-parallel.yml
@@ -25,8 +25,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
   workflow_call:
     inputs:
       parellelism_count:
@@ -44,8 +43,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
@@ -59,22 +57,23 @@ jobs:
       test-chunk-ids: ${{ steps['set-test-chunk-ids'].outputs['test-chunk-ids'] }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: ${{ inputs.package_manager == 'bun' }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ env.ACT && inputs.package_manager != 'bun' }}
         with:
           node-version-file: .nvmrc
+          package-manager-cache: false
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ !env.ACT && inputs.package_manager != 'bun' }}
         with:
           node-version-file: .nvmrc
@@ -114,21 +113,22 @@ jobs:
         chunk: ${{ fromJson(needs.setup.outputs['test-chunk-ids']) }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ env.ACT }}
         with:
           node-version-file: .nvmrc
+          package-manager-cache: false
 
       - name: Setup Node and Cache
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ !env.ACT }}
         with:
           node-version-file: .nvmrc
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bd40c12..24e156a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,10 +22,10 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
-      - uses: pnpm/action-setup@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Setup Node.js environment
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         id: setup
         with:
           cache: pnpm
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 539a7ce..182fbae 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -18,8 +18,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
   workflow_call:
     inputs:
       typecheck_command:
@@ -33,27 +32,27 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
 
 jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         id: checkout
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ env.ACT }}
         with:
           node-version-file: .nvmrc
+          package-manager-cache: false
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ !env.ACT }}
         with:
           node-version-file: .nvmrc
diff --git a/src/node/parseEnv.ts b/src/node/parseEnv.ts
index b4ca2c8..7a07384 100644
--- a/src/node/parseEnv.ts
+++ b/src/node/parseEnv.ts
@@ -23,7 +23,7 @@ export function parseEnvNumber<
   }
 }
 
-// todo [2025-03-01]: allow to only specify first type argument
+// todo [2027-03-01]: allow to only specify first type argument
 export function parseEnvJSON<
   T,
   TDefault extends T | undefined