diff --git a/.github/workflows/cache-invalidation.yml b/.github/workflows/cache-invalidation.yml
index 4dbf43a8fc..7821fcbeaf 100644
--- a/.github/workflows/cache-invalidation.yml
+++ b/.github/workflows/cache-invalidation.yml
@@ -12,6 +12,6 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_EC2_METADATA_DISABLED: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: aws configure set preview.cloudfront true
       - run: ./scripts/postrelease/invalidate_cdn_cache
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3dfa827537..3e673b3909 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ jobs:
         node-version: [20.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v6
         with:
@@ -34,7 +34,7 @@ jobs:
       HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
       ENABLE_NET_CONNECT: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v6
         with:
@@ -57,7 +57,7 @@ jobs:
       HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
       ENABLE_NET_CONNECT: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v6
         with:
@@ -80,7 +80,7 @@ jobs:
         node-version: [20.x]
         os: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with: 
           fetch-depth: 0
       - name: Use Node.js
diff --git a/.github/workflows/create-cli-release.yml b/.github/workflows/create-cli-release.yml
index b145364b86..71451c3572 100644
--- a/.github/workflows/create-cli-release.yml
+++ b/.github/workflows/create-cli-release.yml
@@ -25,7 +25,7 @@ jobs:
       # final check to ensure package.json doesn't have a dist tag, ex: '-beta'
       isStableRelease: ${{ fromJSON(inputs.isStableCandidate) && !steps.getVersion.outputs.channel }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - id: getVersion
         uses: ./.github/actions/get-version-and-channel/
         with:
diff --git a/.github/workflows/devcenter-doc-update.yml b/.github/workflows/devcenter-doc-update.yml
index 6a321770b3..67a6e948cd 100644
--- a/.github/workflows/devcenter-doc-update.yml
+++ b/.github/workflows/devcenter-doc-update.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ fromJSON(inputs.isStableRelease) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js 16.x
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/direwolf.yml b/.github/workflows/direwolf.yml
index 254117aaa4..b339e589b4 100644
--- a/.github/workflows/direwolf.yml
+++ b/.github/workflows/direwolf.yml
@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 20
     environment: direwolf
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Install jq
       run: |
         sudo apt-get update
diff --git a/.github/workflows/empty-stampy-buckets.yml b/.github/workflows/empty-stampy-buckets.yml
index ee48dd9858..7d14450618 100644
--- a/.github/workflows/empty-stampy-buckets.yml
+++ b/.github/workflows/empty-stampy-buckets.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: Stampy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Empty Stampy signed and unsigned buckets
         env:
           STAMPY_ARN: ${{ secrets.STAMPY_ARN }}
diff --git a/.github/workflows/get-signed-from-stampy.yml b/.github/workflows/get-signed-from-stampy.yml
index b0af61b444..458e35c0de 100644
--- a/.github/workflows/get-signed-from-stampy.yml
+++ b/.github/workflows/get-signed-from-stampy.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: Stampy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: download signed Windows installer from Stampy
         env:
           STAMPY_ARN: ${{ secrets.STAMPY_ARN }}
diff --git a/.github/workflows/pack-upload-windows.yml b/.github/workflows/pack-upload-windows.yml
index b6fce7f08b..c45bbd9a2c 100644
--- a/.github/workflows/pack-upload-windows.yml
+++ b/.github/workflows/pack-upload-windows.yml
@@ -12,7 +12,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_EC2_METADATA_DISABLED: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Homebrew
         id: set-up-homebrew
         uses: Homebrew/actions/setup-homebrew@41775cf0c82ef066f1eb39cea1bd74697ca5b735
diff --git a/.github/workflows/pack-upload.yml b/.github/workflows/pack-upload.yml
index 935a0d88b7..02202b4471 100644
--- a/.github/workflows/pack-upload.yml
+++ b/.github/workflows/pack-upload.yml
@@ -10,7 +10,7 @@ jobs:
     env:
       HEROKU_AUTHOR: 'Heroku'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install system deps
         run: |
           sudo apt-get update
@@ -28,7 +28,7 @@ jobs:
   pack_tarballs:
     runs-on: pub-hk-ubuntu-22.04-2xlarge
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install system deps
         run: |
           sudo apt-get update
@@ -53,7 +53,7 @@ jobs:
       HEROKU_DEB_KEY_ID: ${{ secrets.HEROKU_DEB_KEY_ID }}
       HEROKU_DEB_PUBLIC_KEY: ${{ secrets.HEROKU_DEB_PUBLIC_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: sudo mkdir -p /build
       - uses: actions/download-artifact@v6
         with:
@@ -77,7 +77,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_EC2_METADATA_DISABLED: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: sudo mkdir -p /build
       - uses: actions/download-artifact@v6
         with:
diff --git a/.github/workflows/promote-windows.yml b/.github/workflows/promote-windows.yml
index 3884376834..51cef522e1 100644
--- a/.github/workflows/promote-windows.yml
+++ b/.github/workflows/promote-windows.yml
@@ -30,7 +30,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_EC2_METADATA_DISABLED: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js 20.x
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 233029c6b4..646104bf79 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -43,7 +43,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       AWS_EC2_METADATA_DISABLED: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js 20.x
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 3487518f4e..b4a2270400 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -32,7 +32,7 @@ jobs:
     # pub-hk-ubuntu-22.04- due to IP allow list issues with public repos: https://salesforce.quip.com/bu6UA0KImOxJ
     runs-on: pub-hk-ubuntu-22.04-small
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js 20.x
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/publish-to-fig-autocomplete.yml b/.github/workflows/publish-to-fig-autocomplete.yml
index b1c9c110f2..5b1eb5b06d 100644
--- a/.github/workflows/publish-to-fig-autocomplete.yml
+++ b/.github/workflows/publish-to-fig-autocomplete.yml
@@ -8,7 +8,7 @@ jobs:
   push-to-fig-autocomplete:
     runs-on: pub-hk-ubuntu-22.04-small
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js 20.x
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/release-homebrew.yml b/.github/workflows/release-homebrew.yml
index d5c7cab0e7..eb36fb10ee 100644
--- a/.github/workflows/release-homebrew.yml
+++ b/.github/workflows/release-homebrew.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: pub-hk-ubuntu-24.04-ip
     environment: ReleaseHomebrew
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: webfactory/ssh-agent@v0.5.4
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/start-gh-release.yml b/.github/workflows/start-gh-release.yml
index d49ec346d8..d0c74988bf 100644
--- a/.github/workflows/start-gh-release.yml
+++ b/.github/workflows/start-gh-release.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       sourceName: ${{ steps.sourceName.outputs.sourceName }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Remove 'refs/heads/' from GITHUB_HEAD_REF
         shell: bash
         id: sourceName
diff --git a/.github/workflows/start-prerelease.yml b/.github/workflows/start-prerelease.yml
index f4717cbbb6..aba6f1ee27 100644
--- a/.github/workflows/start-prerelease.yml
+++ b/.github/workflows/start-prerelease.yml
@@ -13,7 +13,7 @@ jobs:
       channel: ${{ steps.getVersion.outputs.channel }}
       version: ${{ steps.getVersion.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - id: getVersion
         uses: ./.github/actions/get-version-and-channel/
         with:
@@ -28,7 +28,7 @@ jobs:
         VERSION: ${{ needs.get-version-channel.outputs.version }}
         CURRENT_BRANCH_NAME: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: yarn --immutable --network-timeout 1000000
       - run: ./scripts/release/validate-prerelease
 
@@ -40,7 +40,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       TAG_NAME: ${{ format('v{0}', needs.get-version-channel.outputs.version) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 20.x
diff --git a/.github/workflows/tag-create-github-release.yml b/.github/workflows/tag-create-github-release.yml
index 3689637aae..0280f855ac 100644
--- a/.github/workflows/tag-create-github-release.yml
+++ b/.github/workflows/tag-create-github-release.yml
@@ -11,7 +11,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # fetch entire repo, not just this branch. Tags & commits are needed for release notes
           fetch-depth: 0
diff --git a/.github/workflows/test-installed-cli.yml b/.github/workflows/test-installed-cli.yml
index 72124acf92..5b270cf69b 100644
--- a/.github/workflows/test-installed-cli.yml
+++ b/.github/workflows/test-installed-cli.yml
@@ -21,7 +21,7 @@ jobs:
     env:
       HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: '20.x'
diff --git a/.github/workflows/tps-check-lock.yml b/.github/workflows/tps-check-lock.yml
index 29657cde36..eee3a0ed2e 100644
--- a/.github/workflows/tps-check-lock.yml
+++ b/.github/workflows/tps-check-lock.yml
@@ -8,7 +8,7 @@ jobs:
     environment: ChangeManagement
     steps:
       # checkout required to get github.sha
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - env:
           TPS_API_TOKEN: ${{ secrets.TPS_API_TOKEN_PARAM }}
         run: ./scripts/release/tps_check_lock cli ${{ github.sha }}
diff --git a/.github/workflows/tps-record-release.yml b/.github/workflows/tps-record-release.yml
index 2c571cdc52..93077b0dc7 100644
--- a/.github/workflows/tps-record-release.yml
+++ b/.github/workflows/tps-record-release.yml
@@ -23,7 +23,7 @@ jobs:
     environment: ChangeManagement
     steps:
       # checkout required to get github.sha
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - env:
           ACTOR_EMAIL: ${{ secrets.TPS_API_RELEASE_ACTOR_EMAIL }}
           TPS_API_TOKEN: ${{ secrets.TPS_API_TOKEN_PARAM }}
diff --git a/.github/workflows/upload-to-stampy.yml b/.github/workflows/upload-to-stampy.yml
index 2e954a5438..a14220706d 100644
--- a/.github/workflows/upload-to-stampy.yml
+++ b/.github/workflows/upload-to-stampy.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: Stampy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: download Windows installers from s3
         env:
           AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}}