diff --git a/.github/workflows/asan.yml b/.github/workflows/asan.yml
index df7e4d8dd..71b381d3f 100644
--- a/.github/workflows/asan.yml
+++ b/.github/workflows/asan.yml
@@ -17,12 +17,12 @@ jobs:
       run: |
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
 
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
       with:
         submodules: true
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: "3.11"
 
diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml
index 6fd149196..e20f7164a 100644
--- a/.github/workflows/build_wheels.yml
+++ b/.github/workflows/build_wheels.yml
@@ -27,18 +27,18 @@ jobs:
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
 
     - name: Check out
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
       with:
         fetch-depth: 0  # unshallow fetch for setuptools-scm
 
     - name: Install Python 3.9
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.9'
 
     - name: Build wheel (only macosx_universal2)
       if: matrix.os == 'macos-latest'
-      uses: pypa/cibuildwheel@v2.16.1
+      uses: pypa/cibuildwheel@v2.21.2
       with:
         output-dir: dist
       env:
@@ -47,7 +47,7 @@ jobs:
         CIBW_ENVIRONMENT_MACOS: "CFLAGS='-arch arm64 -arch x86_64 -I/usr/include/libxml2' CXXFLAGS='-arch arm64 -arch x86_64' LDFLAGS='-arch arm64 -arch x86_64'"
 
     - name: Build wheel (except macosx_universal2)
-      uses: pypa/cibuildwheel@v2.16.1
+      uses: pypa/cibuildwheel@v2.21.2
       with:
         output-dir: dist
       env:
@@ -70,7 +70,7 @@ jobs:
         python -m build --sdist
 
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: wheelstorage
         path: ./dist/*
@@ -96,7 +96,7 @@ jobs:
       shell: bash
 
     - name: Download release assets
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: wheelstorage
         path: dist
@@ -108,7 +108,7 @@ jobs:
         password: ${{ secrets.pypi_password }}
 
     - name: Create GitHub Release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4de3f34fd..6f11aae2f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
 
       - name: Install Dependencies (python)
         if: ${{ matrix.language == 'python' }}
@@ -48,7 +48,7 @@ jobs:
           export PATH="$HOME/.local/bin:$PATH" && echo "PATH=$PATH" >> $GITHUB_ENV
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           config: |
@@ -64,7 +64,7 @@ jobs:
         
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v3
         if: ${{ matrix.language == 'python' }}
 
       - name: Build cpp
@@ -72,6 +72,6 @@ jobs:
         run: python3 setup.py build
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/run_cvg.yml b/.github/workflows/run_cvg.yml
index e67712bc4..406282a3b 100644
--- a/.github/workflows/run_cvg.yml
+++ b/.github/workflows/run_cvg.yml
@@ -30,12 +30,12 @@ jobs:
       run: |
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
     - name: Check out
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
       with:
         fetch-depth: 0  # unshallow fetch for setuptools-scm
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: "3.11"
 
diff --git a/.github/workflows/testpythonpackage.yml b/.github/workflows/testpythonpackage.yml
index a039f7ac8..ba6bd1797 100644
--- a/.github/workflows/testpythonpackage.yml
+++ b/.github/workflows/testpythonpackage.yml
@@ -51,12 +51,12 @@ jobs:
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
 
     - name: Check out
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
       with:
         fetch-depth: 0  # unshallow fetch for setuptools-scm
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
 
diff --git a/requirements.txt b/requirements.txt
index faa60f57b..90c8f6858 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,11 +2,11 @@
 # we want to have control over the version and guarantee that the XML output
 # of our tools is stable
 # NOTE: hard-pinning (==) here gets relaxed to >= in setup.py
-lxml==4.9.3
+lxml==5.3.0
 booleanOperations==0.9.0
 defcon[lxml,pens]==0.10.3
-fontMath==0.9.3
-fontTools[unicode,woff,lxml,ufo]==4.43.0
+fontMath==0.9.4
+fontTools[unicode,woff,lxml,ufo]==4.54.1
 tqdm==4.66.1
-ufonormalizer==0.6.1
-ufoProcessor==1.9.0
+ufonormalizer==0.6.2
+ufoProcessor==1.13.1