diff --git a/.github/actions/cache/restore/action.yml b/.github/actions/cache/restore/action.yml
index 943013d1e6a6..a0596b7aa547 100644
--- a/.github/actions/cache/restore/action.yml
+++ b/.github/actions/cache/restore/action.yml
@@ -25,7 +25,7 @@ runs:
     - name: Restore cache to github
       id: github-cache
       if: ${{ runner.environment == 'github-hosted' }}
-      uses: actions/cache/restore@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
+      uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
       with:
         key: ${{ inputs.key }}
         path: ${{ inputs.path }}
diff --git a/.github/actions/cache/save/action.yml b/.github/actions/cache/save/action.yml
index c45ea55440a2..b87ed5a51842 100644
--- a/.github/actions/cache/save/action.yml
+++ b/.github/actions/cache/save/action.yml
@@ -15,7 +15,7 @@ runs:
   steps:
     - name: Save cache to github
       if: ${{ runner.environment == 'github-hosted' }}
-      uses: actions/cache/save@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
+      uses: actions/cache/save@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
       with:
         key: ${{ inputs.key }}
         path: ${{ inputs.path }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1948fc725ef1..7fdecc33f0fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,7 +106,7 @@ jobs:
               - 'Cargo.lock'
       - name: Install cargo-deny
         if: steps.filter.outputs.src == 'true'
-        uses: taiki-e/install-action@3fc1605ecf43c14c7dd5ac06a4a629031ed3bdbd # v2
+        uses: taiki-e/install-action@f87f9990b09867202953bff9aa0c80e23ee16bb7 # v2
         with:
           tool: cargo-deny@0.16
       - name: Check licenses
@@ -118,7 +118,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: crate-ci/typos@db35ee91e80fbb447f33b0e5fbddb24d2a1a884f # v1.29.10
+      - uses: crate-ci/typos@72f3776b6edc3a10a567b8e43fd0524b2a3f1419 # v1.30.1
         with:
           files: .
 
@@ -271,7 +271,7 @@ jobs:
       - uses: ./.github/actions/rustup
         with:
           shared-key: check
-      - uses: cargo-bins/cargo-binstall@6010abb1da3dbaae07e8823fa57c0cd7cf183245 # v1.11.1
+      - uses: cargo-bins/cargo-binstall@acd08f184561622f67f0e4406a62a10f656777a9 # v1.12.0
       - run: cargo binstall --no-confirm cargo-shear --force
       - run: cargo shear
 
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 49b20e831cf2..030180ed34dc 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -385,7 +385,7 @@ jobs:
           shared-key: build-bench-${{ inputs.target }}-${{ inputs.profile }}
 
       - name: Install cargo-codspeed binary
-        uses: taiki-e/install-action@3fc1605ecf43c14c7dd5ac06a4a629031ed3bdbd # v2
+        uses: taiki-e/install-action@f87f9990b09867202953bff9aa0c80e23ee16bb7 # v2
         with:
           tool: cargo-codspeed@2.7.2
 
diff --git a/crates/rspack_plugin_library/src/umd_library_plugin.rs b/crates/rspack_plugin_library/src/umd_library_plugin.rs
index 51cc74d32fc3..dcaf680b6c63 100644
--- a/crates/rspack_plugin_library/src/umd_library_plugin.rs
+++ b/crates/rspack_plugin_library/src/umd_library_plugin.rs
@@ -325,7 +325,7 @@ fn replace_keys(v: String, chunk: &Chunk, compilation: &Compilation) -> String {
     .always_ok()
 }
 
-fn externals_require_array(typ: &str, externals: &[&ExternalModule]) -> Result<String> {
+fn externals_require_array(external_type: &str, externals: &[&ExternalModule]) -> Result<String> {
   Ok(
     externals
       .iter()
@@ -333,8 +333,8 @@ fn externals_require_array(typ: &str, externals: &[&ExternalModule]) -> Result<S
         let request = match &m.request {
           ExternalRequest::Single(r) => r,
           ExternalRequest::Map(map) => map
-            .get(typ)
-            .ok_or_else(|| error!("Missing external configuration for type: {typ}"))?,
+            .get(external_type)
+            .ok_or_else(|| error!("Missing external configuration for type: {external_type}"))?,
         };
         // TODO: check if external module is optional
         let primary =
@@ -356,13 +356,13 @@ fn externals_root_array(modules: &[&ExternalModule]) -> Result<String> {
     modules
       .iter()
       .map(|m| {
-        let typ = "root";
+        let external_type = "root";
         let request = match &m.request {
           ExternalRequest::Single(r) => r.iter(),
           ExternalRequest::Map(map) => map
-            .get(typ)
+            .get(external_type)
             .map(|r| r.iter())
-            .ok_or_else(|| error!("Missing external configuration for type: {typ}"))?,
+            .ok_or_else(|| error!("Missing external configuration for type: {external_type}"))?,
         };
         Ok(format!("root{}", accessor_to_object_access(request)))
       })