diff --git a/.github/actions/commitlint/README.md b/.github/actions/commitlint/README.md
index 5e257169..03f370da 100644
--- a/.github/actions/commitlint/README.md
+++ b/.github/actions/commitlint/README.md
@@ -77,7 +77,7 @@ being installed comes from the fork and commitlint needs no lifecycle scripts.
| INPUT | TYPE | REQUIRED | DEFAULT | DESCRIPTION |
|--------------------|--------|----------|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| branch | string | false | | Branch name matched against skip-branches. Pass
the github.event.pull_request.head.ref context. |
-| commitlint-version | string | false | `"19.8.1"` | Version of @commitlint/cli used when the
calling repository does not pin one
itself. |
+| commitlint-version | string | false | `"21.2.3"` | Version of @commitlint/cli used when the
calling repository does not pin one
itself. |
| config-path | string | false | | Path to the commitlint config. Empty
lets commitlint discover it, which finds
commitlint.config.js at the repository root. |
| fail-on-warnings | string | false | `"false"` | Treat commitlint warnings as failures. |
| from | string | false | | Range start for per-commit linting. Pass
the github.event.pull_request.base.sha context. Requires to as
well; leave both empty to skip
the check. |
diff --git a/.github/actions/go-licenses/README.md b/.github/actions/go-licenses/README.md
index 759cbd3f..fa8ef3de 100644
--- a/.github/actions/go-licenses/README.md
+++ b/.github/actions/go-licenses/README.md
@@ -15,7 +15,7 @@ Both modes share the same setup (setup-go, install go-licenses, optional private
|---------------------|--------|----------|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| fail-on-error | string | false | `"true"` | [check mode] When `false`, non-zero exit
codes from go-licenses are surfaced as
a workflow warning instead of a
failure. Use only as a temporary
escape hatch when upstream go-licenses is
broken. |
| gh-access-token | string | false | | GitHub PAT used to fetch private
loft-sh modules (both modes) and to open
the generated pull request (report mode, required). |
-| go-licenses-version | string | false | `"v1.6.0"` | Version of go-licenses to install (e.g. v1.6.0, v1.0.0).
v1.0.0 does not support `--ignore` —
set `package-mode: go-work` when using it. |
+| go-licenses-version | string | false | `"v2.0.1"` | Version of go-licenses to install (e.g. v1.6.0, v1.0.0).
v1.0.0 does not support `--ignore` —
set `package-mode: go-work` when using it. |
| go-version-file | string | false | `"go.mod"` | Path to go.mod or go.work for
setup-go. |
| ignored-packages | string | false | `"github.com/loft-sh"` | Comma-separated package path prefixes to skip.
In `all` mode these become `--ignore`
flags; in `go-work` mode they are
substring-matched against go.work DiskPaths. |
| mode | string | true | | `check` — run `go-licenses check` against the module.
`report` — render a license report with
a template and open a PR
with the output. |
diff --git a/.github/actions/publish-helm-chart/README.md b/.github/actions/publish-helm-chart/README.md
index 49f390ed..47f85692 100644
--- a/.github/actions/publish-helm-chart/README.md
+++ b/.github/actions/publish-helm-chart/README.md
@@ -16,7 +16,7 @@ Packages a Helm chart and pushes it to ChartMuseum. Handles multi-version publis
| chart-museum-user | string | true | | ChartMuseum username. |
| chart-name | string | true | | Helm chart name. Written to .name
in Chart.yaml; also determines the packaged
tarball filename. |
| chart-versions | string | true | | JSON array of chart versions to
publish. Each entry is packaged and
pushed as -.tgz. Examples: '["1.2.3"]' or
'["0.0.0-latest","0.0.0-abc1234"]'. |
-| helm-version | string | false | `"v4.1.4"` | Helm CLI version to install. |
+| helm-version | string | false | `"v4.3.0"` | Helm CLI version to install. |
| republish-latest | string | false | `"false"` | When true, after pushing, query ChartMuseum
for the highest semver of
and re-push it so it becomes
the most recently uploaded entry. Use
for stable release publishing into a
multi-line release stream. |
| values-edits | string | false | | Optional newline-separated `jsonpath=value` pairs applied via
yq to /values.yaml. Values are written
as strings. |