diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac277046..108ce1a9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,16 +1,22 @@
 name: AST Javascript wrapper CI
 
 on: [pull_request]
+
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  integration-tests:
+  integration-tests: # zizmor: ignore[anonymous-definition]
     runs-on: cx-public-ubuntu-x64
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Install Git LFS
         run: |
diff --git a/.github/workflows/cx-one-scan.yaml b/.github/workflows/cx-one-scan.yaml
index cc66313b..1a702792 100644
--- a/.github/workflows/cx-one-scan.yaml
+++ b/.github/workflows/cx-one-scan.yaml
@@ -1,4 +1,8 @@
 name: cx-one-scan
+
+permissions:
+  contents: read # For reading repository code
+
 on:
   workflow_dispatch:
   pull_request:
@@ -8,13 +12,21 @@ on:
   schedule:
     - cron: '00 5 * * *' # Every day at 05:00
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
     cx-one-scan:
-        name: cx-one-scan
+        name: Checkmarx One Security Scan
         runs-on: cx-public-ubuntu-x64
+        permissions:
+          contents: read # For reading repository code
         steps:
         - name: Checkout
           uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+          with:
+            persist-credentials: false
         - name: Checkmarx One CLI Action
           uses: checkmarx/ast-github-action@9fda4ab4c1b67c35de380552a972a82997d97731 # https://github.com/Checkmarx/ast-github-action/releases/tag/2.0.42
           with:
diff --git a/.github/workflows/delete-packages-and-releases.yml b/.github/workflows/delete-packages-and-releases.yml
index 22f9d3c0..80ca0d8c 100644
--- a/.github/workflows/delete-packages-and-releases.yml
+++ b/.github/workflows/delete-packages-and-releases.yml
@@ -7,6 +7,9 @@ on:
         description: 'Tag to delete'
         required: true
         type: string
+    secrets:
+      GITHUB_TOKEN:
+        required: true
   workflow_dispatch:
     inputs:
       tag:
@@ -16,11 +19,16 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   delete:
+    name: Delete Old Packages and Releases
     permissions:
-      contents: write
-      packages: write
+      contents: write # For deleting releases and tags
+      packages: write # For deleting npm packages
     runs-on: cx-public-ubuntu-x64
     steps:
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index cf08169d..f0654a0e 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -8,11 +8,18 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   nightly:
+    name: Nightly Release Job
     permissions:
-      id-token: write
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@main
-    secrets: inherit
\ No newline at end of file
+      id-token: write # For signing artifacts
+      contents: write # For pushing tags and releases
+      packages: write # For publishing packages
+    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@abe950ede3b052dfc236f730cf11cc290af53d1c
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 09146634..eefbd17a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,6 +23,11 @@ on:
         required: false
         default: true
         type: boolean
+    secrets:
+      GITHUB_TOKEN:
+        required: true
+      ECHO_LIBRARIES_ACCESS_KEY:
+        required: true
   workflow_dispatch:
     inputs:
       cliTag:
@@ -47,21 +52,28 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   delete:
+    name: Delete Old Packages and Releases
     permissions:
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@main
+      contents: write # For deleting releases
+      packages: write # For deleting packages
+    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@abe950ede3b052dfc236f730cf11cc290af53d1c
     with:
       tag: ${{ inputs.jsTag }}
-    secrets: inherit
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     if: inputs.dev == true
   release:
+    name: Release JavaScript Wrapper
     permissions:
-      id-token: write
-      contents: write
-      packages: write
+      id-token: write # For signing artifacts
+      contents: write # For pushing tags and releases
+      packages: write # For publishing packages
     runs-on: cx-public-ubuntu-x64
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -76,6 +88,7 @@ jobs:
         with:
           fetch-depth: 0
           lfs: true  # Ensure LFS files are checked out
+          persist-credentials: false
 
       # VERIFY SINGLE LOCKFILE
       - name: Verify single lockfile
@@ -185,7 +198,7 @@ jobs:
         if: inputs.dev == false
         run: |
           git pull
-          git tag ${{env.TAG_NAME}}
+          git tag ${TAG_NAME}
           git push --tags
 
 
diff --git a/.github/workflows/scan-github-action.yml b/.github/workflows/scan-github-action.yml
deleted file mode 100644
index e41d5bbf..00000000
--- a/.github/workflows/scan-github-action.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Scan for GitHub Actions issues
-
-on:
-  pull_request:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
-
-permissions: {}
-
-jobs:
-  zizmor:
-    name: Scan repository contents
-    runs-on: cx-private-ubuntu-x64
-    permissions:
-      contents: read
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - name: Run Zizmor linter
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
-        with:
-          advanced-security: false
-          annotations: false
-          persona: pedantic
-          fail-on-no-inputs: false
-          online-audits: false
\ No newline at end of file
diff --git a/.github/workflows/update-cli.yml b/.github/workflows/update-cli.yml
index b71f3f7e..bbfb3e23 100644
--- a/.github/workflows/update-cli.yml
+++ b/.github/workflows/update-cli.yml
@@ -1,4 +1,5 @@
 name: Update checkmarx ast cli
+
 on:
   workflow_dispatch:
   repository_dispatch:
@@ -7,15 +8,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   update-checkmarx-cli:
+    name: Update Checkmarx CLI Binaries
     permissions:
-      contents: write
+      contents: write # For pushing updated CLI binaries
     runs-on: cx-public-ubuntu-x64
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Install Git LFS
         run: |
diff --git a/checkmarx-ast-cli.version b/checkmarx-ast-cli.version
index e62a93d5..45ed17c7 100644
--- a/checkmarx-ast-cli.version
+++ b/checkmarx-ast-cli.version
@@ -1 +1 @@
-2.3.55
+2.3.59
diff --git a/package-lock.json b/package-lock.json
index fc8022b6..0b4fd438 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@Checkmarx/ast-cli-javascript-wrapper",
-  "version": "0.0.160",
+  "version": "0.0.161",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@Checkmarx/ast-cli-javascript-wrapper",
-      "version": "0.0.160",
+      "version": "0.0.161",
       "license": "ISC",
       "dependencies": {
         "log4js": "^6.9.1"
@@ -1720,16 +1720,16 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://packages.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.8",
+      "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/braces": {
@@ -4151,9 +4151,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://packages.echohq.com/artifactory/api/npm/npm/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 3c915303..f07ad4f5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@Checkmarx/ast-cli-javascript-wrapper",
-  "version": "0.0.160",
+  "version": "0.0.161",
   "description": "AST CLI Javascript wrapper",
   "main": "dist/main/wrapper/CxWrapper.js",
   "typings": "dist/main/wrapper/CxWrapper.d.ts",
@@ -43,10 +43,10 @@
     "flatted": "^3.4.2",
     "picomatch": "2.3.2",
     "serialize-javascript": "6.0.2",
-    "brace-expansion": "5.0.7",
+    "brace-expansion": "5.0.8",
     "lodash": "4.18.0",
     "uuid": "14.0.0",
-    "js-yaml": "4.3.0"
+    "js-yaml": "4.3.1"
   },
   "publishConfig": {
     "registry": "https://npm.pkg.github.com"
diff --git a/src/main/wrapper/resources/cx-linux b/src/main/wrapper/resources/cx-linux
index 452bd052..3dd625bc 100755
--- a/src/main/wrapper/resources/cx-linux
+++ b/src/main/wrapper/resources/cx-linux
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:d76d1d464af46b0dc5976f8c79560344d86e1641b6eb1959e7a8120f5eab7293
-size 83103906
+oid sha256:de2052999f221055cc7fe52f544febf6463f4e8e20e7f4b53651ff0e9bd26720
+size 83366050
diff --git a/src/main/wrapper/resources/cx-mac b/src/main/wrapper/resources/cx-mac
index 951f21fa..e7cbf1bb 100755
--- a/src/main/wrapper/resources/cx-mac
+++ b/src/main/wrapper/resources/cx-mac
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:2a777f54cae91dc22e27dead84734ef5e84107011c9ffde441be988b9c25ac86
-size 165550656
+oid sha256:2b85c5f56d643d94c8614e43db362f63e8b0866aa9190ab59ee51f6f737073a1
+size 166032560
diff --git a/src/main/wrapper/resources/cx.exe b/src/main/wrapper/resources/cx.exe
index 7d3cbb8d..fd5b8a25 100644
--- a/src/main/wrapper/resources/cx.exe
+++ b/src/main/wrapper/resources/cx.exe
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:8c9bf6f587910590eebde2364f19c4884f814561afbcdfcc9be3f038fdfc1199
-size 85082432
+oid sha256:b558f2617195d7ea893b100eb4fa58a6daab39a204a9b17a864bdbb16fdf44d9
+size 85349696