diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml
index 1e43775fff..bae8fc1f46 100644
--- a/.github/workflows/__analysis-kinds.yml
+++ b/.github/workflows/__analysis-kinds.yml
@@ -110,7 +110,7 @@ jobs:
 
       - name: Check quality query does not appear in security SARIF
         if: contains(matrix.analysis-kinds, 'code-scanning')
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
           EXPECT_PRESENT: 'false'
@@ -118,7 +118,7 @@ jobs:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
           EXPECT_PRESENT: 'true'
diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml
index 4c7f21a32b..d4b1116870 100644
--- a/.github/workflows/__bundle-from-toolcache.yml
+++ b/.github/workflows/__bundle-from-toolcache.yml
@@ -62,7 +62,7 @@ jobs:
         run: npm install @actions/tool-cache@3
       - name: Check toolcache contains CodeQL
         continue-on-error: true
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
@@ -75,7 +75,7 @@ jobs:
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml
index 7606475875..83444b4e4f 100644
--- a/.github/workflows/__bundle-toolcache.yml
+++ b/.github/workflows/__bundle-toolcache.yml
@@ -63,7 +63,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -73,7 +73,7 @@ jobs:
       - name: Install @actions/tool-cache
         run: npm install @actions/tool-cache@3
       - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
@@ -92,7 +92,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml
index 85e0695268..f3ffe98ffb 100644
--- a/.github/workflows/__bundle-zstd.yml
+++ b/.github/workflows/__bundle-zstd.yml
@@ -63,7 +63,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -88,7 +88,7 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
         with:
diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml
index 24549dd186..f2363792b1 100644
--- a/.github/workflows/__config-export.yml
+++ b/.github/workflows/__config-export.yml
@@ -76,7 +76,7 @@ jobs:
           path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check config properties appear in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         with:
diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml
index bdf6b0aee1..1ebda74698 100644
--- a/.github/workflows/__diagnostics-export.yml
+++ b/.github/workflows/__diagnostics-export.yml
@@ -87,7 +87,7 @@ jobs:
           path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         with:
diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
index e474e1b6f5..6e01d4f441 100644
--- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
@@ -88,7 +88,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:
diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
index cc94d3bb8a..3107059674 100644
--- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
@@ -89,7 +89,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:
diff --git a/pr-checks/checks/analysis-kinds.yml b/pr-checks/checks/analysis-kinds.yml
index 7b10f8d792..0b263e7e0c 100644
--- a/pr-checks/checks/analysis-kinds.yml
+++ b/pr-checks/checks/analysis-kinds.yml
@@ -64,7 +64,7 @@ steps:
 
   - name: Check quality query does not appear in security SARIF
     if: contains(matrix.analysis-kinds, 'code-scanning')
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
       EXPECT_PRESENT: "false"
@@ -72,7 +72,7 @@ steps:
       script: ${{ env.CHECK_SCRIPT }}
   - name: Check quality query appears in quality SARIF
     if: contains(matrix.analysis-kinds, 'code-quality')
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
       EXPECT_PRESENT: "true"
diff --git a/pr-checks/checks/bundle-from-toolcache.yml b/pr-checks/checks/bundle-from-toolcache.yml
index 2719ccfb00..85912a14c7 100644
--- a/pr-checks/checks/bundle-from-toolcache.yml
+++ b/pr-checks/checks/bundle-from-toolcache.yml
@@ -7,7 +7,7 @@ steps:
     run: npm install @actions/tool-cache@3
   - name: Check toolcache contains CodeQL
     continue-on-error: true
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     with:
       script: |
         const toolcache = require('@actions/tool-cache');
@@ -20,7 +20,7 @@ steps:
     with:
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     with:
       script: |
         const toolcache = require('@actions/tool-cache');
diff --git a/pr-checks/checks/bundle-toolcache.yml b/pr-checks/checks/bundle-toolcache.yml
index f5315d285a..12d841d454 100644
--- a/pr-checks/checks/bundle-toolcache.yml
+++ b/pr-checks/checks/bundle-toolcache.yml
@@ -8,7 +8,7 @@ operatingSystems:
   - windows
 steps:
   - name: Remove CodeQL from toolcache
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     with:
       script: |
         const fs = require('fs');
@@ -18,7 +18,7 @@ steps:
   - name: Install @actions/tool-cache
     run: npm install @actions/tool-cache@3
   - name: Check toolcache does not contain CodeQL
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     with:
       script: |
         const toolcache = require('@actions/tool-cache');
@@ -37,7 +37,7 @@ steps:
       output: ${{ runner.temp }}/results
       upload-database: false
   - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     with:
       script: |
         const toolcache = require('@actions/tool-cache');
diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml
index 810f0b0c12..3545a20415 100644
--- a/pr-checks/checks/bundle-zstd.yml
+++ b/pr-checks/checks/bundle-zstd.yml
@@ -8,7 +8,7 @@ operatingSystems:
   - windows
 steps:
   - name: Remove CodeQL from toolcache
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     with:
       script: |
         const fs = require('fs');
@@ -33,7 +33,7 @@ steps:
       path: ${{ runner.temp }}/results/javascript.sarif
       retention-days: 7
   - name: Check diagnostic with expected tools URL appears in SARIF
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
     with:
diff --git a/pr-checks/checks/config-export.yml b/pr-checks/checks/config-export.yml
index 17dd758453..f1fa022592 100644
--- a/pr-checks/checks/config-export.yml
+++ b/pr-checks/checks/config-export.yml
@@ -20,7 +20,7 @@ steps:
       path: "${{ runner.temp }}/results/javascript.sarif"
       retention-days: 7
   - name: Check config properties appear in SARIF
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
     with:
diff --git a/pr-checks/checks/diagnostics-export.yml b/pr-checks/checks/diagnostics-export.yml
index 811335a7c7..7f784a27f2 100644
--- a/pr-checks/checks/diagnostics-export.yml
+++ b/pr-checks/checks/diagnostics-export.yml
@@ -33,7 +33,7 @@ steps:
       path: "${{ runner.temp }}/results/javascript.sarif"
       retention-days: 7
   - name: Check diagnostics appear in SARIF
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
     with:
diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
index bd48f1a12c..dde4ac49a6 100644
--- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
+++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
@@ -22,7 +22,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Check diagnostic appears in SARIF
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
     with:
diff --git a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
index 8e3f4234b5..08852de2ea 100644
--- a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
+++ b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
@@ -23,7 +23,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Check diagnostic appears in SARIF
-    uses: actions/github-script@v8
+    uses: actions/github-script@v9
     env:
       SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
     with: