diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9c939cf..f0915b9 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -24,7 +24,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       # Runs a single command using the runners shell
       - name: setup
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1eadc5b..ba62d3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+# 4.0.0
+* BREAKING: use sha256 for signature verification, as per https://developer.amazon.com/en-US/docs/alexa/custom-skills/host-a-custom-skill-as-a-web-service.html#check-request-signature. fixes #68
+* update `sinon` and `unroll` dev deps
+
+
 # 3.0.1
 * fix `engines` field in `package.json`
 
diff --git a/package.json b/package.json
index ad40dc5..c936560 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "alexa-verifier",
-  "version": "3.0.2",
+  "version": "4.0.0",
   "description": "Verify HTTP requests sent to an Alexa skill are sent from Amazon",
   "main": "index.js",
   "type": "module",
@@ -27,9 +27,9 @@
   "devDependencies": {
     "esmock": "^2.6.0",
     "nock": "^13.0.0",
-    "sinon": "^14.0.0",
+    "sinon": "^17.0.1",
     "tap": "^16.0.0",
-    "unroll": "1.4.0"
+    "unroll": "1.6.0"
   },
   "engines": {
     "node": ">=12.17"