diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index 1db9de1b48..ac65536291 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -31,7 +31,7 @@ jobs:
         run: |
           HOMEBREW_NO_AUTO_UPDATE=1 brew install qemu binaryen
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: true
       - name: Extract TinyGo version
@@ -43,7 +43,7 @@ jobs:
           go-version: '1.25.7'
           cache: true
       - name: Restore LLVM source cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-${{ matrix.os }}-v1
@@ -57,7 +57,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Save LLVM source cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-source.outputs.cache-primary-key }}
@@ -68,7 +68,7 @@ jobs:
             llvm-project/lld/include
             llvm-project/llvm/include
       - name: Restore LLVM build cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
           key: llvm-build-20-${{ matrix.os }}-v2
@@ -85,7 +85,7 @@ jobs:
           make llvm-build
           find llvm-build -name CMakeFiles -prune -exec rm -r '{}' \;
       - name: Save LLVM build cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-build.outputs.cache-primary-key }}
@@ -107,7 +107,7 @@ jobs:
         # - have a double-zipped artifact when downloaded from the UI
         # - have a very slow artifact upload
         # We're doing the former here, to keep artifact uploads fast.
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: darwin-${{ matrix.goarch }}-double-zipped-${{ steps.version.outputs.version }}
           path: build/tinygo${{ steps.version.outputs.version }}.darwin-${{ matrix.goarch }}.tar.gz
@@ -131,7 +131,7 @@ jobs:
         run: |
           brew install llvm@${{ matrix.version }}
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Install Go
         uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 18fd5127d4..f1e8be695b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -31,14 +31,14 @@ jobs:
           sudo rm -rf /usr/local/share/boost
           df -h
       - name: Check out the repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             tinygo/tinygo-dev
@@ -47,18 +47,18 @@ jobs:
             type=sha,format=long
             type=raw,value=latest
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
       - name: Log in to Github Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index e11d8193af..4d161cc5f1 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -23,7 +23,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Install apk dependencies
-        # tar: needed for actions/cache@v4
+        # tar: needed for actions/cache@v5
         # git+openssh: needed for checkout (I think?)
         # ruby: needed to install fpm
         run: apk add tar git openssh make g++ ruby-dev mold
@@ -31,21 +31,21 @@ jobs:
         # We're not on a multi-user machine, so this is safe.
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: true
       - name: Extract TinyGo version
         id: version
         run: ./.github/workflows/tinygo-extract-version.sh | tee -a "$GITHUB_OUTPUT"
       - name: Cache Go
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           key: go-cache-linux-alpine-v1-${{ hashFiles('go.mod') }}
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
       - name: Restore LLVM source cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-linux-alpine-v1
@@ -59,7 +59,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Save LLVM source cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-source.outputs.cache-primary-key }}
@@ -70,7 +70,7 @@ jobs:
             llvm-project/lld/include
             llvm-project/llvm/include
       - name: Restore LLVM build cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
           key: llvm-build-20-linux-alpine-v1
@@ -88,13 +88,13 @@ jobs:
           # Remove unnecessary object files (to reduce cache size).
           find llvm-build -name CMakeFiles -prune -exec rm -r '{}' \;
       - name: Save LLVM build cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-build.outputs.cache-primary-key }}
           path: llvm-build
       - name: Cache Binaryen
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-binaryen
         with:
           key: binaryen-linux-alpine-v1
@@ -119,7 +119,7 @@ jobs:
           cp -p build/release.tar.gz /tmp/tinygo${{ steps.version.outputs.version }}.linux-amd64.tar.gz
           cp -p build/release.deb    /tmp/tinygo_${{ steps.version.outputs.version }}_amd64.deb
       - name: Publish release artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: linux-amd64-double-zipped-${{ steps.version.outputs.version }}
           path: |
@@ -131,7 +131,7 @@ jobs:
     needs: build-linux
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: true
       - name: Install Go
@@ -164,7 +164,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: true
       - name: Install apt dependencies
@@ -184,7 +184,7 @@ jobs:
           go-version: '1.25.7'
           cache: true
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '18'
       - name: Install wasmtime
@@ -194,7 +194,7 @@ jobs:
       - name: Setup `wasm-tools`
         uses: bytecodealliance/actions/wasm-tools/setup@v1
       - name: Restore LLVM source cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-linux-asserts-v1
@@ -208,7 +208,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Save LLVM source cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-source.outputs.cache-primary-key }}
@@ -219,7 +219,7 @@ jobs:
             llvm-project/lld/include
             llvm-project/llvm/include
       - name: Restore LLVM build cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
           key: llvm-build-20-linux-asserts-v1
@@ -235,13 +235,13 @@ jobs:
           # Remove unnecessary object files (to reduce cache size).
           find llvm-build -name CMakeFiles -prune -exec rm -r '{}' \;
       - name: Save LLVM build cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-build.outputs.cache-primary-key }}
           path: llvm-build
       - name: Cache Binaryen
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-binaryen
         with:
           key: binaryen-linux-asserts-v1
@@ -284,7 +284,7 @@ jobs:
     needs: build-linux
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Get TinyGo version
         id: version
         run: ./.github/workflows/tinygo-extract-version.sh | tee -a "$GITHUB_OUTPUT"
@@ -301,7 +301,7 @@ jobs:
           go-version: '1.25.7'
           cache: true
       - name: Restore LLVM source cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-linux-v1
@@ -315,7 +315,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Save LLVM source cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-source.outputs.cache-primary-key }}
@@ -326,7 +326,7 @@ jobs:
             llvm-project/lld/include
             llvm-project/llvm/include
       - name: Restore LLVM build cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
           key: llvm-build-20-linux-${{ matrix.goarch }}-v1
@@ -344,13 +344,13 @@ jobs:
           # Remove unnecessary object files (to reduce cache size).
           find llvm-build -name CMakeFiles -prune -exec rm -r '{}' \;
       - name: Save LLVM build cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-build.outputs.cache-primary-key }}
           path: llvm-build
       - name: Cache Binaryen
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-binaryen
         with:
           key: binaryen-linux-${{ matrix.goarch }}-v4
@@ -387,7 +387,7 @@ jobs:
           cp -p build/release.tar.gz /tmp/tinygo${{ steps.version.outputs.version }}.linux-${{ matrix.goarch }}.tar.gz
           cp -p build/release.deb    /tmp/tinygo_${{ steps.version.outputs.version }}_${{ matrix.libc }}.deb
       - name: Publish release artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: linux-${{ matrix.goarch }}-double-zipped-${{ steps.version.outputs.version }}
           path: |
diff --git a/.github/workflows/llvm.yml b/.github/workflows/llvm.yml
index ec45d587e4..fac80561ed 100644
--- a/.github/workflows/llvm.yml
+++ b/.github/workflows/llvm.yml
@@ -25,14 +25,14 @@ jobs:
       contents: read
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             tinygo/llvm-20
@@ -46,13 +46,13 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
       - name: Log in to Github Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           target: tinygo-llvm-build
           context: .
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 6c5b9f9a41..0d3abc2b62 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -21,12 +21,12 @@ jobs:
         # See: https://github.com/tinygo-org/tinygo/pull/4516#issuecomment-2416363668
         run: sudo apt-get remove llvm-18
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Pull musl, bdwgc
         run: |
             git submodule update --init lib/musl lib/bdwgc
       - name: Restore LLVM source cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-linux-nix-v1
@@ -36,7 +36,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Save LLVM source cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-source.outputs.cache-primary-key }}
diff --git a/.github/workflows/sizediff.yml b/.github/workflows/sizediff.yml
index 08130a78c9..8243306c16 100644
--- a/.github/workflows/sizediff.yml
+++ b/.github/workflows/sizediff.yml
@@ -20,14 +20,14 @@ jobs:
         run: |
           echo "$HOME/go/bin" >> $GITHUB_PATH
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # fetch all history (no sparse checkout)
           submodules: true
       - name: Install apt dependencies
         run: ./.github/workflows/sizediff-install-pkgs.sh
       - name: Restore LLVM source cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-sizediff-v1
@@ -37,7 +37,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Cache Go
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           key: go-cache-linux-sizediff-v2-${{ hashFiles('go.mod') }}
           path: |
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 98e1ea8f8b..a989435c64 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -27,9 +27,10 @@ jobs:
       - name: Install Dependencies
         shell: bash
         run: |
+          scoop config use_external_7zip true
           scoop install ninja binaryen
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: true
       - name: Extract TinyGo version
@@ -42,7 +43,7 @@ jobs:
           go-version: '1.25.7'
           cache: true
       - name: Restore cached LLVM source
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
           key: llvm-source-20-windows-v1
@@ -56,7 +57,7 @@ jobs:
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         run: make llvm-source
       - name: Save cached LLVM source
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-source.outputs.cache-primary-key }}
@@ -67,7 +68,7 @@ jobs:
             llvm-project/lld/include
             llvm-project/llvm/include
       - name: Restore cached LLVM build
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
           key: llvm-build-20-windows-v2
@@ -84,13 +85,13 @@ jobs:
           # Remove unnecessary object files (to reduce cache size).
           find llvm-build -name CMakeFiles -prune -exec rm -r '{}' \;
       - name: Save cached LLVM build
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.cache-llvm-build.outputs.cache-primary-key }}
           path: llvm-build
       - name: Cache Go cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           key: go-cache-windows-v1-${{ hashFiles('go.mod') }}
           path: |
@@ -98,6 +99,7 @@ jobs:
             C:/Users/runneradmin/go/pkg/mod
       - name: Install wasmtime
         run: |
+          scoop config use_external_7zip true
           scoop install wasmtime@29.0.1
       - name: make gen-device
         run: make -j3 gen-device
@@ -118,7 +120,7 @@ jobs:
         # - have a dobule-zipped artifact when downloaded from the UI
         # - have a very slow artifact upload
         # We're doing the former here, to keep artifact uploads fast.
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: windows-amd64-double-zipped-${{ steps.version.outputs.version }}
           path: build/release/tinygo${{ steps.version.outputs.version }}.windows-amd64.zip
@@ -137,9 +139,10 @@ jobs:
       - name: Install Dependencies
         shell: bash
         run: |
+          scoop config use_external_7zip true
           scoop install binaryen
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Install Go
         uses: actions/setup-go@v6
         with:
@@ -169,7 +172,7 @@ jobs:
           maximum-size: 24GB
           disk-root: "C:"
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Install Go
         uses: actions/setup-go@v6
         with:
@@ -201,9 +204,10 @@ jobs:
       - name: Install Dependencies
         shell: bash
         run: |
-          scoop install binaryen && scoop install wasmtime@29.0.1
+          scoop config use_external_7zip true
+          scoop install binaryen wasmtime@29.0.1
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Install Go
         uses: actions/setup-go@v6
         with: