diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index 56f734df8644f3..1efae8be59e5c5 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -83,7 +83,7 @@ jobs:
       )}}
 
     steps:
-      - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
         id: msys2
         with:
           msystem: ${{ matrix.msystem }}
diff --git a/.github/workflows/zjit-macos.yml b/.github/workflows/zjit-macos.yml
index 0f3c60932e4ab5..1cd08178d3919d 100644
--- a/.github/workflows/zjit-macos.yml
+++ b/.github/workflows/zjit-macos.yml
@@ -93,7 +93,7 @@ jobs:
           rustup install ${{ matrix.rust_version }} --profile minimal
           rustup default ${{ matrix.rust_version }}
 
-      - uses: taiki-e/install-action@a2352fc6ce487f030a3aa709482d57823eadfb37 # v2.75.16
+      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}
diff --git a/.github/workflows/zjit-ubuntu.yml b/.github/workflows/zjit-ubuntu.yml
index ce47b82e36c0af..44187c45607c6f 100644
--- a/.github/workflows/zjit-ubuntu.yml
+++ b/.github/workflows/zjit-ubuntu.yml
@@ -119,7 +119,7 @@ jobs:
           ruby-version: '3.1'
           bundler: none
 
-      - uses: taiki-e/install-action@a2352fc6ce487f030a3aa709482d57823eadfb37 # v2.75.16
+      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}
diff --git a/spec/ruby/language/source_encoding_spec.rb b/spec/ruby/language/source_encoding_spec.rb
index 7135bc0a700c38..5a243fa2c3cf8c 100644
--- a/spec/ruby/language/source_encoding_spec.rb
+++ b/spec/ruby/language/source_encoding_spec.rb
@@ -29,7 +29,7 @@
 
       touch(path, "wb") { |f| f.write source }
       begin
-        ruby_exe(path, args: "2>&1", exit_status: 1).should =~ /invalid multibyte char/
+        ruby_exe(path, args: "2>&1", exit_status: 1).b.should =~ /invalid multibyte char/
       ensure
         rm_r path
       end
@@ -51,7 +51,7 @@
 
       touch(path, "wb") { |f| f.write source }
       begin
-        ruby_exe(path, args: "2>&1", exit_status: 1).should =~ /invalid multibyte char/
+        ruby_exe(path, args: "2>&1", exit_status: 1).b.should =~ /invalid multibyte char/
       ensure
         rm_r path
       end
diff --git a/tool/update-NEWS-github-release.rb b/tool/update-NEWS-github-release.rb
index 0ef6fcfe377145..f346209a7d294f 100755
--- a/tool/update-NEWS-github-release.rb
+++ b/tool/update-NEWS-github-release.rb
@@ -339,8 +339,16 @@ def update_news_md(results)
     i += 1
   end
 
-  # All footnote definitions we can emit from this run, indexed by ref name
+  # All footnote definitions we can emit, indexed by ref name. Seed from existing
+  # release-tag defs in the file so gems skipped this run (e.g. transient API
+  # failures) keep their URLs, then overlay freshly fetched URLs.
+  release_ref_pattern = %r{^\[([^\]]+)\]:\s+(https://github\.com/[^/]+/[^/]+/releases/tag/.*)}
   available_footnotes = {}
+  new_lines.each do |line|
+    if (m = line.match(release_ref_pattern))
+      available_footnotes[m[1]] = "[#{m[1]}]: #{m[2]}"
+    end
+  end
   results.each do |r|
     r[:footnote_links].each do |fl|
       available_footnotes[fl[:ref]] = "[#{fl[:ref]}]: #{fl[:url]}"
@@ -349,18 +357,10 @@ def update_news_md(results)
 
   # Refs the regenerated body actually uses (e.g. `][gem-vX.Y.Z]`)
   used_refs = new_lines.join.scan(/\]\[([^\]]+)\]/).flatten.uniq
-  used_set = used_refs.to_set
 
-  # Drop existing GitHub release-tag link defs that are either orphaned (no
-  # body reference) or about to be re-emitted from this run's results. Defs
-  # still referenced by gems we couldn't refresh are preserved in place.
-  release_ref_pattern = %r{^\[([^\]]+)\]:\s+https://github\.com/[^/]+/[^/]+/releases/tag/}
-  new_lines.reject! do |line|
-    if (m = line.match(release_ref_pattern))
-      ref = m[1]
-      !used_set.include?(ref) || available_footnotes.key?(ref)
-    end
-  end
+  # Drop all existing GitHub release-tag link defs; the used subset is
+  # re-emitted below in body-ref order so the footer is deterministic.
+  new_lines.reject! { |line| line.match?(release_ref_pattern) }
 
   # Trim trailing blank lines so the appended footer block is clean
   new_lines.pop while new_lines.last == "\n"