diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 6f16d0a..f25f165 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -79,7 +79,7 @@ jobs:
           path: results.sarif
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           sarif_file: results.sarif
           category: zizmor
diff --git a/.ruby-version b/.ruby-version
index 9c25013..86fb650 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.3.6
+3.3.7
diff --git a/Gemfile.lock b/Gemfile.lock
index 3a81488..b551cbf 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -10,7 +10,7 @@ DEPENDENCIES
   pycall
 
 RUBY VERSION
-   ruby 3.3.6p108
+   ruby 3.3.7p123
 
 BUNDLED WITH
    2.5.20