diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index 8510d58c..8a90e6f5 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -168,12 +168,12 @@ jobs:
           fi
       - name: Login to Docker Hub
         if: env.DOCKER_USER != '' && env.DOCKER_PASSWORD != ''
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.1
         with:
           username: ${{ env.DOCKER_USER }}
           password: ${{ env.DOCKER_PASSWORD }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/golang.yaml b/.github/workflows/golang.yaml
index 2582e254..e72668d8 100644
--- a/.github/workflows/golang.yaml
+++ b/.github/workflows/golang.yaml
@@ -181,7 +181,7 @@ jobs:
       # This requires to set in the package settings read permission for the
       # repository where the golang ci is running
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -218,7 +218,7 @@ jobs:
       # This requires to set in the package settings read permission for the
       # repository where the golang ci is running
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/js.yaml b/.github/workflows/js.yaml
index 1def63e4..5215625d 100644
--- a/.github/workflows/js.yaml
+++ b/.github/workflows/js.yaml
@@ -165,7 +165,7 @@ jobs:
         run: |
           make ci-pre-build
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/python.yaml b/.github/workflows/python.yaml
index ce3a26b9..e8c7b546 100644
--- a/.github/workflows/python.yaml
+++ b/.github/workflows/python.yaml
@@ -142,7 +142,7 @@ jobs:
           repositories: ${{ github.event.repository.name }}${{ inputs.repositories && format(',{0}', inputs.repositories) || '' }}
           permission-contents: read
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.1
         # we log in the registry to code check also images
         with:
           registry: ghcr.io
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index f986dfa5..90bea705 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,6 +1,6 @@
 # GitHub Workflows Release Notes
 
-## 0.0.3-dev - 2026-06-19
+## 0.0.3-dev - 2026-08-01
 
 ### Features
 
@@ -54,13 +54,15 @@
   contains `docker` (PR #99 by @chicco785)
 - golang workflow: skip code coverage if the actor is dependabot (PR #100 by
   @cosimomeli)
-- markdown workflow: run spellcheck only on actually changed \*.md files (PR #96
+- markdown workflow: run spellcheck only on actually changed *.md files (PR #96
   by @chicco785)
 - Support different grammar check modalities (local and online) in the script
   (PR #89 by @chicco785)
 
 ### Bug Fixes
 
+- deployment: update tag only where the app entry already exists (PR #321 by
+  @cosimomeli)
 - markdown wf: fix chrome for puppeteer (PR #299 by @chicco785)
 - Use Linkspector 1.4.1 (PR #296 by @cosimomeli)
 - approve and merge wf: pr were failing checks are not required should be merged
@@ -108,6 +110,42 @@
 
 ### Dependencies
 
+- Bump actions/setup-python from 6.3.0 to 7.0.0 (PR #322 by @dependabot[bot])
+- Bump reviewdog/action-actionlint from 1.72.0 to 1.73.0 (PR #324 by
+  @dependabot[bot])
+- Bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 (PR #325 by
+  @dependabot[bot])
+- Bump actions/checkout from 7.0.0 to 7.0.1 (PR #326 by @dependabot[bot])
+- Bump docker/login-action from 4 to 4.5.1 (PR #323 by @dependabot[bot])
+- Bump actions/setup-python from 6 to 6.3.0 (PR #316 by @dependabot[bot])
+- Bump reviewdog/action-actionlint from 1 to 1.72.0 (PR #317 by
+  @dependabot[bot])
+- Bump actions/setup-go from 6 to 7 (PR #318 by @dependabot[bot])
+- Bump actions/setup-node from 6.4.0 to 7.0.0 (PR #319 by @dependabot[bot])
+- Bump SonarSource/sonarqube-scan-action from 8.2.0 to 8.2.1 (PR #320 by
+  @dependabot[bot])
+- Bump aws-actions/configure-aws-credentials from 6.2.1 to 6.2.2 (PR #314 by
+  @dependabot[bot])
+- Bump actions/setup-node from 6 to 6.4.0 (PR #315 by @dependabot[bot])
+- Bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 (PR #310 by
+  @dependabot[bot])
+- Bump DavidAnson/markdownlint-cli2-action from 23 to 24 (PR #311 by
+  @dependabot[bot])
+- Bump aws-actions/configure-aws-credentials from 6 to 6.2.1 (PR #312 by
+  @dependabot[bot])
+- Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (PR #313 by
+  @dependabot[bot])
+- Bump golangci/golangci-lint-action from 9 to 9.2.1 (PR #307 by
+  @dependabot[bot])
+- Bump stefanzweifel/git-auto-commit-action from 7 to 7.1.0 (PR #308 by
+  @dependabot[bot])
+- Bump actions/cache from 5.0.5 to 6.1.0 (PR #309 by @dependabot[bot])
+- Bump actions/cache from 5 to 5.0.5 (PR #305 by @dependabot[bot])
+- Bump actions/checkout from 6.0.3 to 7.0.0 (PR #306 by @dependabot[bot])
+- Bump SonarSource/sonarqube-scan-action from 8.1.0 to 8.2.0 (PR #302 by
+  @dependabot[bot])
+- Bump umbrelladocs/action-linkspector from 1.5.2 to 1.5.4 (PR #303 by
+  @dependabot[bot])
 - Bump actions/checkout from 6.0.2 to 6.0.3 (PR #301 by @dependabot[bot])
 - Bump actions/checkout from 6 to 6.0.2 (PR #298 by @dependabot[bot])
 - Bump umbrelladocs/action-linkspector from 1.4.1 to 1.5.2 (PR #297 by