diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
index 8fd23055..759b2c89 100644
--- a/.github/actions/setup-go/action.yaml
+++ b/.github/actions/setup-go/action.yaml
@@ -4,7 +4,7 @@ runs:
   using: "composite"
   steps:
     - name: Install go
-      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
       with:
         go-version-file: "go.mod"
         cache: true
@@ -15,14 +15,14 @@ runs:
         echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
         echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
     - name: Go Mod Cache
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
+      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       with:
         path: ${{ steps.go-cache-paths.outputs.go-mod }}
         key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-mod-
     - name: Go Build Cache
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
+      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       with:
         path: ${{ steps.go-cache-paths.outputs.go-build }}
         key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
diff --git a/.github/workflows/builder-image.yml b/.github/workflows/builder-image.yml
index dad864ca..3b49be01 100644
--- a/.github/workflows/builder-image.yml
+++ b/.github/workflows/builder-image.yml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
@@ -27,7 +27,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
         with:
           file: ./images/builder/Dockerfile
           context: ./images/builder
diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml
index 01c9954d..b2cc1f65 100644
--- a/.github/workflows/pr-verify.yml
+++ b/.github/workflows/pr-verify.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Verify Shellcheck
         run: make verify-shellcheck
 
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
         with:
           node-version: "18"
       - name: Install renovate
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c75c3272..1329093f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,11 +17,11 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
         with:
           go-version: stable
 
-      - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6
+      - uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6
         with:
           distribution: goreleaser
           version: latest
diff --git a/.github/workflows/schedule-link-checker.yml b/.github/workflows/schedule-link-checker.yml
index 0293e418..f6b8ddce 100644
--- a/.github/workflows/schedule-link-checker.yml
+++ b/.github/workflows/schedule-link-checker.yml
@@ -21,7 +21,7 @@ jobs:
           private_key: ${{ secrets.SCS_APP_PRIVATE_KEY }}
 
       - name: Link Checker
-        uses: lycheeverse/lychee-action@f81112d0d2814ded911bd23e3beaa9dda9093915 # v2.1.0
+        uses: lycheeverse/lychee-action@f613c4a64e50d792e0b31ec34bbcbba12263c6a6 # v2.3.0
         id: lychee
         env:
           GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
diff --git a/.golangci.yml b/.golangci.yml
index 2094c52f..d58ee7c7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -7,12 +7,12 @@ linters:
     - bodyclose
     - containedctx
     - contextcheck
+    - copyloopvar
     - durationcheck
     - errchkjson
     - errname
     - errorlint
     - exhaustive
-    - exportloopref
     - forcetypeassert
     - gci
     - gocritic
diff --git a/pkg/clusterstack/config.go b/pkg/clusterstack/config.go
index 4d991bb1..950c21dc 100644
--- a/pkg/clusterstack/config.go
+++ b/pkg/clusterstack/config.go
@@ -18,6 +18,7 @@ limitations under the License.
 package clusterstack
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -58,11 +59,11 @@ func GetCsctlConfig(path string) (*CsctlConfig, error) {
 	}
 
 	if cs.Config.Provider.Type == "" {
-		return nil, fmt.Errorf("provider type must not be empty")
+		return nil, errors.New("provider type must not be empty")
 	}
 
 	if len(cs.Config.Provider.Type) > 253 {
-		return nil, fmt.Errorf("provider name must not be greater than 253")
+		return nil, errors.New("provider name must not be greater than 253")
 	}
 
 	match, err := regexp.MatchString(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`, cs.Config.Provider.Type)
@@ -74,7 +75,7 @@ func GetCsctlConfig(path string) (*CsctlConfig, error) {
 	}
 
 	if cs.Config.ClusterStackName == "" {
-		return nil, fmt.Errorf("cluster stack name must not be empty")
+		return nil, errors.New("cluster stack name must not be empty")
 	}
 
 	// Validate kubernetes version
diff --git a/pkg/clusterstack/version.go b/pkg/clusterstack/version.go
index b0aeee0b..c22237dc 100644
--- a/pkg/clusterstack/version.go
+++ b/pkg/clusterstack/version.go
@@ -17,6 +17,7 @@ limitations under the License.
 package clusterstack
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 	"strconv"
@@ -30,7 +31,7 @@ func BumpVersion(version string) (string, error) {
 
 	// Check if a numeric part was found
 	if len(matches) < 2 {
-		return "", fmt.Errorf("invalid version format")
+		return "", errors.New("invalid version format")
 	}
 
 	// Extract and convert the numeric part to an integer
diff --git a/pkg/cmd/create.go b/pkg/cmd/create.go
index 58cf6555..5d80c888 100644
--- a/pkg/cmd/create.go
+++ b/pkg/cmd/create.go
@@ -19,6 +19,7 @@ package cmd
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -185,13 +186,13 @@ func GetCreateOptions(ctx context.Context, clusterStackPath string) (*CreateOpti
 		}
 	case customMode:
 		if clusterStackVersion == "" {
-			return nil, fmt.Errorf("please specify a semver for custom version with --cluster-stack-version flag")
+			return nil, errors.New("please specify a semver for custom version with --cluster-stack-version flag")
 		}
 		if clusterAddonVersion == "" {
-			return nil, fmt.Errorf("please specify a semver for custom version with --cluster-addon-version flag")
+			return nil, errors.New("please specify a semver for custom version with --cluster-addon-version flag")
 		}
 		if nodeImageVersion == "" {
-			return nil, fmt.Errorf("please specify a semver for custom version with --node-image-version flag")
+			return nil, errors.New("please specify a semver for custom version with --node-image-version flag")
 		}
 
 		createOption.Metadata, err = clusterstack.HandleCustomMode(createOption.Config.Config.KubernetesVersion, clusterStackVersion, clusterAddonVersion, nodeImageVersion)
@@ -222,7 +223,7 @@ func createAction(cmd *cobra.Command, args []string) error {
 	defer cleanTmpDirectory()
 
 	if len(args) != 1 {
-		return fmt.Errorf("please provide a valid command, create only accept one argument to path to the cluster stacks")
+		return errors.New("please provide a valid command, create only accept one argument to path to the cluster stacks")
 	}
 	clusterStackPath := args[0]
 
@@ -253,7 +254,7 @@ func (c *CreateOptions) validateHash() error {
 	if c.CurrentReleaseHash.ClusterAddonDir == c.LatestReleaseHash.ClusterAddonDir &&
 		c.CurrentReleaseHash.ClusterAddonValues == c.LatestReleaseHash.ClusterAddonValues &&
 		c.CurrentReleaseHash.NodeImageDir == c.LatestReleaseHash.NodeImageDir {
-		return fmt.Errorf("no change in the cluster stack")
+		return errors.New("no change in the cluster stack")
 	}
 
 	return nil
@@ -351,7 +352,7 @@ func (c *CreateOptions) generateRelease(ctx context.Context) error {
 
 	if publish {
 		if remote != "oci" {
-			return fmt.Errorf("not pushing assets. --publish is only implemented for remote OCI")
+			return errors.New("not pushing assets. --publish is only implemented for remote OCI")
 		}
 
 		ociClient, err := oci.NewClient()
@@ -410,7 +411,7 @@ func overwriteVersionInFile(chartYaml, newVersion string) error {
 	v := m["version"]
 	oldVersion, ok := v.(string)
 	if !ok {
-		return fmt.Errorf("failed to read version in yaml")
+		return errors.New("failed to read version in yaml")
 	}
 
 	m["version"] = newVersion
diff --git a/pkg/hash/hash.go b/pkg/hash/hash.go
index 1b432695..5e080d77 100644
--- a/pkg/hash/hash.go
+++ b/pkg/hash/hash.go
@@ -21,6 +21,7 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -111,7 +112,7 @@ func (r ReleaseHash) ValidateWithLatestReleaseHash(latestReleaseHash ReleaseHash
 	if r.ClusterAddonDir == latestReleaseHash.ClusterAddonDir &&
 		r.ClusterAddonValues == latestReleaseHash.ClusterAddonValues &&
 		r.NodeImageDir == latestReleaseHash.NodeImageDir {
-		return fmt.Errorf("no change in the cluster stack")
+		return errors.New("no change in the cluster stack")
 	}
 
 	return nil