diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 25f1d66a81..adc2239097 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -6209,19 +6209,19 @@ jobs:
       - name: Download Go modules
         run: go mod download
       - name: Generate SBOM (SPDX format)
-        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0
+        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
         with:
           artifact-name: sbom.spdx.json
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Generate SBOM (CycloneDX format)
-        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0
+        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
         with:
           artifact-name: sbom.cdx.json
           format: cyclonedx-json
           output-file: sbom.cdx.json
       - name: Upload SBOM artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: sbom-artifacts
           path: |
diff --git a/.github/workflows/spec-kit-execute.lock.yml b/.github/workflows/spec-kit-execute.lock.yml
index fc88388f54..622a19e029 100644
--- a/.github/workflows/spec-kit-execute.lock.yml
+++ b/.github/workflows/spec-kit-execute.lock.yml
@@ -648,11 +648,6 @@ jobs:
           restore-keys: |
             memory-${{ github.workflow }}-
             memory-
-      - name: Upload cache-memory data as artifact
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-        with:
-          name: cache-memory
-          path: /tmp/gh-aw/cache-memory
       # Repo memory git-based storage configuration from frontmatter processed below
       - name: Clone repo-memory branch (default)
         env:
@@ -5651,6 +5646,12 @@ jobs:
           path: /tmp/gh-aw/repo-memory-default
           retention-days: 1
           if-no-files-found: ignore
+      - name: Upload cache-memory data as artifact
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        if: always()
+        with:
+          name: cache-memory
+          path: /tmp/gh-aw/cache-memory
       - name: Validate agent logs for errors
         if: always()
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
diff --git a/pkg/cli/mcp_inspect_safe_inputs_test.go b/pkg/cli/mcp_inspect_safe_inputs_test.go
index 22351bd36f..a1041599d3 100644
--- a/pkg/cli/mcp_inspect_safe_inputs_test.go
+++ b/pkg/cli/mcp_inspect_safe_inputs_test.go
@@ -51,7 +51,6 @@ func TestWriteSafeInputsFiles(t *testing.T) {
 	// Verify JavaScript dependencies are written
 	expectedJSFiles := []string{
 		"read_buffer.cjs",
-		"mcp_server.cjs",
 		"mcp_http_transport.cjs",
 		"safe_inputs_config_loader.cjs",
 		"mcp_server_core.cjs",
diff --git a/pkg/workflow/domains_test.go b/pkg/workflow/domains_test.go
index 489d039d1b..96ee8e8ab8 100644
--- a/pkg/workflow/domains_test.go
+++ b/pkg/workflow/domains_test.go
@@ -228,6 +228,7 @@ func TestCopilotDefaultDomains(t *testing.T) {
 		"api.enterprise.githubcopilot.com",
 		"api.github.com",
 		"github.com",
+		"host.docker.internal",
 		"raw.githubusercontent.com",
 		"registry.npmjs.org",
 	}
diff --git a/pkg/workflow/js/mcp_server_core.cjs b/pkg/workflow/js/mcp_server_core.cjs
index 824e8bbd6e..8e8ddc22bf 100644
--- a/pkg/workflow/js/mcp_server_core.cjs
+++ b/pkg/workflow/js/mcp_server_core.cjs
@@ -579,7 +579,7 @@ async function handleRequest(server, request, defaultHandler) {
       result,
     };
   } catch (error) {
-    const err = /** @type {any} */ error;
+    const err = /** @type {any} */ (error);
     return {
       jsonrpc: "2.0",
       id,