diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c6adb2..34b504c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
@@ -23,7 +23,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
@@ -41,7 +41,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
diff --git a/.github/workflows/reusable-cnb-sync.yml b/.github/workflows/reusable-cnb-sync.yml
index 634a874..e37a5d4 100644
--- a/.github/workflows/reusable-cnb-sync.yml
+++ b/.github/workflows/reusable-cnb-sync.yml
@@ -21,11 +21,11 @@ jobs:
     if: ${{ inputs.github-repo == github.repository && github.event_name == 'push' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
-      - uses: docker://tencentcom/git-sync
+      - uses: docker://tencentcom/git-sync@sha256:233c89bd41472ea530322509cc624604ac6c3cc566feebdfbab66d827aac73b7
         env:
           PLUGIN_TARGET_URL: https://cnb.cool/${{ inputs.cnb-repo }}.git
           PLUGIN_AUTH_TYPE: https
diff --git a/.github/workflows/reusable-issue-shoot.yml b/.github/workflows/reusable-issue-shoot.yml
index b78bf18..b8c0b34 100644
--- a/.github/workflows/reusable-issue-shoot.yml
+++ b/.github/workflows/reusable-issue-shoot.yml
@@ -18,7 +18,7 @@ jobs:
     if: contains(fromJSON('["easy", "middle", "hard"]'), github.event.label.name)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           sparse-checkout: |
             .github
diff --git a/.github/workflows/reusable-publish-npm.yml b/.github/workflows/reusable-publish-npm.yml
index b76b134..04dd532 100644
--- a/.github/workflows/reusable-publish-npm.yml
+++ b/.github/workflows/reusable-publish-npm.yml
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.ref_type == 'tag' && !inputs.publish-npm
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
 
@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.ref_type == 'tag' && !inputs.publish-tag-website
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
 
@@ -126,7 +126,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.ref_type == 'tag' && !inputs.publish-official-website
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: main
           fetch-depth: 0
diff --git a/.github/workflows/reusable-spell-check.yml b/.github/workflows/reusable-spell-check.yml
index 4b2b97f..c3d121e 100644
--- a/.github/workflows/reusable-spell-check.yml
+++ b/.github/workflows/reusable-spell-check.yml
@@ -12,9 +12,9 @@ jobs:
     name: Typos
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check spelling
-        uses: crate-ci/typos@7b04f660f4ee4f048d18fd341887cf28dfbedfe2 # v1.46.3
+        uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # v1.47.2
         with:
           config: ${{ inputs.config }}
diff --git a/.github/workflows/reusable-unit-test.yml b/.github/workflows/reusable-unit-test.yml
index 96ffd62..2f0e4b1 100644
--- a/.github/workflows/reusable-unit-test.yml
+++ b/.github/workflows/reusable-unit-test.yml
@@ -28,7 +28,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
 
@@ -45,7 +45,7 @@ jobs:
       - run: ${{ inputs.package-manager }} run lint
       - run: ${{ inputs.package-manager }} run test
       # upload report to codecov
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -53,7 +53,7 @@ jobs:
     if: ${{ !inputs.skip-site }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
 
@@ -94,7 +94,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
 
diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml
index 81a8db6..a5b7054 100644
--- a/.github/workflows/spell-check.yml
+++ b/.github/workflows/spell-check.yml
@@ -11,9 +11,9 @@ jobs:
     name: Typos
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check spelling
-        uses: crate-ci/typos@7b04f660f4ee4f048d18fd341887cf28dfbedfe2 # v1.46.3
+        uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # v1.47.2
         with:
           config: ${{ inputs.config }}
diff --git a/.github/workflows/test-close-release-issue.yml b/.github/workflows/test-close-release-issue.yml
index 0c659ff..1d4a2b1 100644
--- a/.github/workflows/test-close-release-issue.yml
+++ b/.github/workflows/test-close-release-issue.yml
@@ -11,7 +11,7 @@ jobs:
     name: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: test
         uses: ./actions/close-release-issue
diff --git a/.github/workflows/test-upgrade-deps.yml b/.github/workflows/test-upgrade-deps.yml
index a2f8528..f81d86d 100644
--- a/.github/workflows/test-upgrade-deps.yml
+++ b/.github/workflows/test-upgrade-deps.yml
@@ -11,7 +11,7 @@ jobs:
     name: tdesign-vue
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
 
@@ -30,7 +30,7 @@ jobs:
     name: tdesign-vue-next
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
 
diff --git a/actions/check-email/action.yml b/actions/check-email/action.yml
index 29735be..abab56f 100644
--- a/actions/check-email/action.yml
+++ b/actions/check-email/action.yml
@@ -14,7 +14,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     # 检查仓库当前检出的最新提交（作者/提交者邮箱）
     - name: check_github_primary_email
@@ -48,7 +48,7 @@ runs:
 
     # 检出 PR 源分支（如果存在），以便检查 PR 里的最新提交
     - name: Checkout PR head
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         ref: ${{ github.event.pull_request.head.sha }}