diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 533e26e..50c54e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -105,7 +105,7 @@ jobs:
         run: pnpm exec vsce package --target ${{ matrix.vsce-target }} -o rstack-${{ matrix.vsce-target }}.vsix
 
       - name: Upload VSIX Artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rstack-${{ matrix.vsce-target }}
           path: packages/vscode/rstack-${{ matrix.vsce-target }}.vsix
@@ -153,7 +153,7 @@ jobs:
           node-version: 22.23.4
 
       - name: Download VSIX Artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: rstack-*
           path: vsix
diff --git a/packages/vscode/package.json b/packages/vscode/package.json
index d5255e2..d2f5189 100644
--- a/packages/vscode/package.json
+++ b/packages/vscode/package.json
@@ -450,7 +450,7 @@
     "mocha": "^11.8.0",
     "ovsx": "^1.3.0",
     "picomatch": "^4.0.7",
-    "semver": "^7.8.5",
+    "semver": "^7.8.6",
     "stacktrace-parser": "^0.1.11",
     "tinyglobby": "^0.2.17",
     "typescript": "^5.9.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 076e6c7..6a06045 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -75,8 +75,8 @@ importers:
         specifier: ^4.0.7
         version: 4.0.7
       semver:
-        specifier: ^7.8.5
-        version: 7.8.5
+        specifier: ^7.8.6
+        version: 7.8.6
       stacktrace-parser:
         specifier: ^0.1.11
         version: 0.1.11
@@ -2054,6 +2054,11 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
+  semver@7.8.6:
+    resolution: {integrity: sha512-9lpSSU4Mly3mrtruwLs1eLK6+gzbzqeBFwRNjIjE+9LuDpWdYctrQlQ3ej1Ilgi7gknpsTRnPoLP8DpCHqHIJw==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   serialize-javascript@6.0.2:
     resolution: {integrity: sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==}
 
@@ -3177,7 +3182,7 @@ snapshots:
       https-proxy-agent: 7.0.6(supports-color@8.1.1)
       jszip: 3.10.1
       ora: 8.2.0
-      semver: 7.8.5
+      semver: 7.8.6
     transitivePeerDependencies:
       - supports-color
 
@@ -3241,7 +3246,7 @@ snapshots:
       parse5: 8.0.1
       proper-lockfile: 4.1.2
       read: 1.0.7
-      semver: 7.8.5
+      semver: 7.8.6
       tinyglobby: 0.2.17
       typed-rest-client: 1.8.11
       url-join: 4.0.1
@@ -3771,7 +3776,7 @@ snapshots:
       lodash.isstring: 4.0.1
       lodash.once: 4.1.1
       ms: 2.1.3
-      semver: 7.8.5
+      semver: 7.8.6
 
   jszip@3.10.1:
     dependencies:
@@ -3940,7 +3945,7 @@ snapshots:
       commander: 14.0.3
       cross-keychain: 1.1.0(@types/node@22.20.5)
       is-ci: 2.0.0
-      semver: 7.8.5
+      semver: 7.8.6
       yauzl-promise: 4.0.0
     transitivePeerDependencies:
       - '@types/node'
@@ -4088,6 +4093,8 @@ snapshots:
 
   semver@7.8.5: {}
 
+  semver@7.8.6: {}
+
   serialize-javascript@6.0.2:
     dependencies:
       randombytes: 2.1.0
@@ -4280,7 +4287,7 @@ snapshots:
   vscode-languageclient@9.0.1:
     dependencies:
       minimatch: 5.1.9
-      semver: 7.8.5
+      semver: 7.8.6
       vscode-languageserver-protocol: 3.17.5
 
   vscode-languageserver-protocol@3.17.5: