diff --git a/.github/workflows/asan.yml b/.github/workflows/asan.yml
index b02f6d70e..40a7e2282 100644
--- a/.github/workflows/asan.yml
+++ b/.github/workflows/asan.yml
@@ -17,7 +17,7 @@ jobs:
       run: |
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
 
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       with:
         submodules: true
 
diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml
index 6fd149196..398037ebc 100644
--- a/.github/workflows/build_wheels.yml
+++ b/.github/workflows/build_wheels.yml
@@ -27,7 +27,7 @@ jobs:
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
 
     - name: Check out
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       with:
         fetch-depth: 0  # unshallow fetch for setuptools-scm
 
@@ -38,7 +38,7 @@ jobs:
 
     - name: Build wheel (only macosx_universal2)
       if: matrix.os == 'macos-latest'
-      uses: pypa/cibuildwheel@v2.16.1
+      uses: pypa/cibuildwheel@v2.16.2
       with:
         output-dir: dist
       env:
@@ -47,7 +47,7 @@ jobs:
         CIBW_ENVIRONMENT_MACOS: "CFLAGS='-arch arm64 -arch x86_64 -I/usr/include/libxml2' CXXFLAGS='-arch arm64 -arch x86_64' LDFLAGS='-arch arm64 -arch x86_64'"
 
     - name: Build wheel (except macosx_universal2)
-      uses: pypa/cibuildwheel@v2.16.1
+      uses: pypa/cibuildwheel@v2.16.2
       with:
         output-dir: dist
       env:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4de3f34fd..e75065f48 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Install Dependencies (python)
         if: ${{ matrix.language == 'python' }}
diff --git a/.github/workflows/run_cvg.yml b/.github/workflows/run_cvg.yml
index 0b99cbec6..d7a7039e7 100644
--- a/.github/workflows/run_cvg.yml
+++ b/.github/workflows/run_cvg.yml
@@ -30,7 +30,7 @@ jobs:
       run: |
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
     - name: Check out
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       with:
         fetch-depth: 0  # unshallow fetch for setuptools-scm
 
diff --git a/.github/workflows/testpythonpackage.yml b/.github/workflows/testpythonpackage.yml
index f4a33b330..6f488a623 100644
--- a/.github/workflows/testpythonpackage.yml
+++ b/.github/workflows/testpythonpackage.yml
@@ -51,7 +51,7 @@ jobs:
         echo "Reason for triggering: ${{ github.event.inputs.reason }}"
 
     - name: Check out
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       with:
         fetch-depth: 0  # unshallow fetch for setuptools-scm
 
diff --git a/requirements.txt b/requirements.txt
index 144ead91a..b7ff1ca61 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,7 +6,7 @@ lxml==4.9.3
 booleanOperations==0.9.0
 defcon[lxml,pens]==0.10.3
 fontMath==0.9.3
-fontTools[unicode,woff,lxml,ufo]==4.43.0
+fontTools[unicode,woff,lxml,ufo]==4.43.1
 psautohint==2.4.0
 tqdm==4.66.1
 ufonormalizer==0.6.1