diff --git a/.github/actions/cache-typst/action.yml b/.github/actions/cache-typst/action.yml
index 018cc9faae8..bbcb23a9633 100644
--- a/.github/actions/cache-typst/action.yml
+++ b/.github/actions/cache-typst/action.yml
@@ -41,7 +41,7 @@ runs:
 
     - name: Cache Typst package folder
       id: cache-typst-restore
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ${{ env.TYPST_CACHE }}
         key: ${{ runner.os }}-typst-1
diff --git a/.github/workflows/actions/launcher/action.yml b/.github/workflows/actions/launcher/action.yml
deleted file mode 100644
index 6313c9bd6be..00000000000
--- a/.github/workflows/actions/launcher/action.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-# working-directory
-# rust version / toolchain
-# out-dir
-
-name: 'Build Launcher'
-description: 'Builds the Quarto Launcher'
-runs:
-  using: "composite"
-  steps: 
-    - uses: actions/checkout@v4
-      uses: actions-rs/toolchain@v1
-      with:
-        toolchain: 1.63.0
-        override: true
-        components: rustfmt, clippy
-    - uses: actions-rs/cargo@v1
-      working-directory: package/launcher
-      with:
-        command: build
-        args: --release --all-features
diff --git a/.github/workflows/actions/quarto-dev/action.yml b/.github/workflows/actions/quarto-dev/action.yml
index 072c6f71e81..cc5292af525 100644
--- a/.github/workflows/actions/quarto-dev/action.yml
+++ b/.github/workflows/actions/quarto-dev/action.yml
@@ -5,7 +5,7 @@ runs:
   using: "composite"
   steps:
     - name: Cache deno std deps
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ./src/resources/deno_std/cache
         key: ${{ runner.os }}-deno_std-2-${{ hashFiles('./src/resources/deno_std/deno_std.lock', './package/scripts/deno_std/deno_std.ts') }}
@@ -13,7 +13,7 @@ runs:
           ${{ runner.os }}-deno_std-2-
 
     - name: Cache Cargo dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cargo/registry
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 5f9b584e5cc..f4db596d7bf 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -35,7 +35,7 @@ jobs:
       tag_pushed: ${{ steps.version_commit.outputs.tag_pushed }}
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -44,9 +44,9 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       # we _also_ need npm, specifically for webui/preview
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 18
+          node-version: 22
 
       - name: Get previous version
         id: read-version
@@ -78,7 +78,7 @@ jobs:
           # echo -e "Due to an issue with upstream dependency, the RHEL build may not included in this release." >> "release_note.md"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: News
           path: |
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -116,7 +116,7 @@ jobs:
           tar --owner=root --group=root -zcvf  quarto-${{needs.configure.outputs.version}}.tar.gz *
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Source
           path: ./quarto-${{needs.configure.outputs.version}}.tar.gz
@@ -125,7 +125,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -153,7 +153,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Deb Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-amd64.tar.gz
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -190,7 +190,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Deb Arm64 Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-arm64.tar.gz
@@ -201,7 +201,7 @@ jobs:
     if: false
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -240,7 +240,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: RHEL Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-rhel7-amd64.tar.gz
@@ -253,7 +253,7 @@ jobs:
         arch: [x86_64, aarch64]
         format: [deb, rpm]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -302,7 +302,7 @@ jobs:
           fi
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Linux-${{ matrix.format }}-${{ matrix.arch }}-Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-linux-${{ steps.pkg_arch.outputs.arch_name }}.${{ matrix.format }}
@@ -311,7 +311,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure, make-tarball]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -321,7 +321,7 @@ jobs:
         if: ${{ inputs.publish-release }}
         uses: ./.github/workflows/actions/prevent-rerun
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Deb Zip
           path: .
@@ -352,7 +352,7 @@ jobs:
     needs: [configure]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -417,13 +417,13 @@ jobs:
           CERT_FINGERPRINT: ${{ secrets.SM_CLIENT_CERT_FINGERPRINT }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Windows Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.msi
 
       - name: Upload Zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Windows Zip
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.zip
@@ -432,7 +432,7 @@ jobs:
     runs-on: windows-latest
     needs: [configure, make-installer-win]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -443,7 +443,7 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       - name: "Download Windows Zip"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: Windows Zip
           path: .
@@ -480,7 +480,7 @@ jobs:
     runs-on: macos-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -529,13 +529,13 @@ jobs:
           QUARTO_APPLE_CONNECT_PW: ${{ secrets.APPLE_CONNECT_PW }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Mac Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.pkg
 
       - name: Upload Zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Mac Zip
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.tar.gz
@@ -549,7 +549,7 @@ jobs:
     runs-on: macos-latest
     needs: [configure, make-installer-mac]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -559,7 +559,7 @@ jobs:
         if: ${{ inputs.publish-release }}
         uses: ./.github/workflows/actions/prevent-rerun
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Mac Zip
           path: .
@@ -603,7 +603,7 @@ jobs:
       ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           path: quarto-cli
@@ -615,7 +615,7 @@ jobs:
         uses: ./quarto-cli/.github/workflows/actions/prevent-rerun
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Rename news
         run: |
@@ -723,7 +723,7 @@ jobs:
       ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prevent Re-run
         if: ${{ inputs.publish-release }}
@@ -751,7 +751,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure, publish-release]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -761,7 +761,7 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - uses: ./.github/actions/docker
         with:
diff --git a/.github/workflows/performance-check.yml b/.github/workflows/performance-check.yml
index e35b81d5653..73702dd0fe0 100644
--- a/.github/workflows/performance-check.yml
+++ b/.github/workflows/performance-check.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # checkout full tree
           fetch-depth: 0
diff --git a/.github/workflows/publish-cloudsmith.yml b/.github/workflows/publish-cloudsmith.yml
index 78ab47d6c78..4edcd8a2ea1 100644
--- a/.github/workflows/publish-cloudsmith.yml
+++ b/.github/workflows/publish-cloudsmith.yml
@@ -36,7 +36,7 @@ jobs:
       version: ${{ steps.resolve.outputs.version }}
       is_prerelease: ${{ steps.resolve.outputs.is_prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -175,7 +175,7 @@ jobs:
           GH_REPO: quarto-dev/quarto-cli
 
       - name: Install and authenticate Cloudsmith CLI
-        uses: cloudsmith-io/cloudsmith-cli-action@v1.0.8
+        uses: cloudsmith-io/cloudsmith-cli-action@v2.0.2
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
 
diff --git a/.github/workflows/stale-needs-repro.yml b/.github/workflows/stale-needs-repro.yml
index 73f1771e945..e88ea42e51a 100644
--- a/.github/workflows/stale-needs-repro.yml
+++ b/.github/workflows/stale-needs-repro.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           start-date: 2023-01-01T01:00:00Z
           stale-issue-label: "stale"
diff --git a/.github/workflows/test-bundle.yml b/.github/workflows/test-bundle.yml
index 847a3018d9e..ca43b88890c 100644
--- a/.github/workflows/test-bundle.yml
+++ b/.github/workflows/test-bundle.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # checkout full tree
           fetch-depth: 0
diff --git a/.github/workflows/test-quarto-latexmk.yml b/.github/workflows/test-quarto-latexmk.yml
index db865e38dad..266d3d407e8 100644
--- a/.github/workflows/test-quarto-latexmk.yml
+++ b/.github/workflows/test-quarto-latexmk.yml
@@ -22,7 +22,7 @@ jobs:
           - { os: ubuntu-latest }
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -55,7 +55,7 @@ jobs:
           ../dist/bin/tinitex/x86_64-unknown-linux-gnu/tinitex --help
 
       - name: Upload binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tinitex-${{ matrix.config.os }}
           path: |
diff --git a/.github/workflows/test-smokes-parallel.yml b/.github/workflows/test-smokes-parallel.yml
index ef93a87d48c..d36cbe86b6e 100644
--- a/.github/workflows/test-smokes-parallel.yml
+++ b/.github/workflows/test-smokes-parallel.yml
@@ -53,7 +53,7 @@ jobs:
       BUCKETS: ${{ steps.tests-buckets.outputs.BUCKETS }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Quarto
         uses: quarto-dev/quarto-actions/setup@v2
diff --git a/.github/workflows/test-smokes.yml b/.github/workflows/test-smokes.yml
index 5adfde80c06..863e0d951ba 100644
--- a/.github/workflows/test-smokes.yml
+++ b/.github/workflows/test-smokes.yml
@@ -60,7 +60,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Fix temp dir to use runner one (windows)
         if: runner.os == 'Windows'
@@ -79,13 +79,13 @@ jobs:
           windows-path-include-rtools: false
 
       - name: Install node (for Playwright, MECA)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
 
       - name: Cache multiplex server node_modules
         if: ${{ runner.os != 'Windows' || github.event_name == 'schedule' }}
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: tests/integration/playwright/multiplex-server/node_modules
           key: ${{ runner.os }}-multiplex-server-${{ hashFiles('tests/integration/playwright/multiplex-server/package.json') }}
@@ -121,7 +121,7 @@ jobs:
 
       - name: Restore Renv package cache
         id: cache-renv-packages-restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: |
             ${{ env.RENV_PATHS_ROOT }}
@@ -182,7 +182,7 @@ jobs:
         shell: Rscript {0}
 
       - name: Install uv for Python
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           version: "0.9.5"
           enable-cache: true
@@ -340,7 +340,7 @@ jobs:
         shell: pwsh
 
       - name: Upload test timing file
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: matrix.time-test
         with:
           name: timed test file
@@ -348,7 +348,7 @@ jobs:
 
       - name: Save Typst cache
         if: always() && steps.cache-typst.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           key: ${{ steps.cache-typst.outputs.cache-primary-key }}
           path: ${{ steps.cache-typst.outputs.cache-path }}
@@ -356,14 +356,14 @@ jobs:
       - name: Save Renv package cache
         # don't save cache if we have extra R packages
         if: ${{ always() && steps.cache-renv-packages-restore.outputs.cache-hit != 'true' && inputs.extra-r-packages == '' }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: |
             ${{ env.RENV_PATHS_ROOT }}
             renv/library
           key: ${{ steps.cache-renv-packages-restore.outputs.cache-primary-key }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         # Upload pLaywright test report if they exists (playwright is only running on Linux for now)
         if: ${{ !cancelled() && runner.os != 'Windows' && hashFiles('tests/integration/playwright/playwright-report/**/*') != '' }}
         with:
diff --git a/.github/workflows/update-test-timing.yml b/.github/workflows/update-test-timing.yml
index acd5de6f110..94ffeb7a5d6 100644
--- a/.github/workflows/update-test-timing.yml
+++ b/.github/workflows/update-test-timing.yml
@@ -23,17 +23,17 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download timing file artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: timed test file
           path: tests/
 
       - name: Create Pull Request for new tests timing
         id: cpr
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: tests/timing-for-ci.txt
diff --git a/.github/workflows/verify-tinytex-patterns.yml b/.github/workflows/verify-tinytex-patterns.yml
index 29fb1359c8d..c7654dadd32 100644
--- a/.github/workflows/verify-tinytex-patterns.yml
+++ b/.github/workflows/verify-tinytex-patterns.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download and extract regex.json
         env:
@@ -32,7 +32,7 @@ jobs:
 
       - name: Restore cached regex.json
         id: cache-restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: .cache/regex.json
           key: tinytex-regex-latest
@@ -160,7 +160,7 @@ jobs:
 
       - name: Save new cache
         if: steps.compare.outputs.changed == 'true' || steps.compare.outputs.first_run == 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: .cache/regex.json
           key: tinytex-regex-latest