diff --git a/.github/actions/generate-release-notes/action.yaml b/.github/actions/generate-release-notes/action.yaml
index 661c8e58a661..821ba70d2271 100644
--- a/.github/actions/generate-release-notes/action.yaml
+++ b/.github/actions/generate-release-notes/action.yaml
@@ -21,7 +21,7 @@ runs:
       shell: bash
       run: |
         current_version="$INPUT_VERSION"
-        current_version_base="$(echo "$current_version" | sed 's/-.*//')"
+        current_version_base="$(sed 's/-.*//' <<< "$current_version")"
 
         tag_list="$(gh release list --exclude-drafts --exclude-pre-releases --json tagName --jq '.[].tagName')"
         previous_version="$(echo "$tag_list" | grep -x -A1 "$current_version" | tail -n1 || true)"
diff --git a/.github/workflows/check-misskey-js-autogen.yaml b/.github/workflows/check-misskey-js-autogen.yaml
index d6dc3baf815c..46d83f83fb78 100644
--- a/.github/workflows/check-misskey-js-autogen.yaml
+++ b/.github/workflows/check-misskey-js-autogen.yaml
@@ -14,10 +14,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
-          submodules: true
+          persist-credentials: false
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          fetch-depth: 1
+          submodules: true
 
       - name: Enable corepack
         run: |
@@ -64,10 +66,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
-          submodules: true
+          persist-credentials: false
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          fetch-depth: 1
+          submodules: true
 
       - name: Upload actual_misskey_js
         uses: actions/upload-artifact@v4.4.0
@@ -120,10 +124,9 @@ jobs:
           mode: upsert
           create_if_not_exists: true
           message: |
-            Thank you for sending us a great Pull Request! 👍
-            Please regenerate misskey-js type definitions! 🙏
+            Please regenerate misskey-js type definitions! :pray:
+            misskey-js型定義の再生成をお願いします！ :pray:
 
-            example:
             ```sh
             pnpm run build-misskey-js-with-types
             ```
@@ -138,3 +141,7 @@ jobs:
           create_if_not_exists: false
           message: |
             Thank you!
+
+      - name: Make failure if changes are detected
+        if: steps.check-changes.outputs.changes == 'true'
+        run: exit 1
diff --git a/.github/workflows/check-misskey-js-version.yaml b/.github/workflows/check-misskey-js-version.yaml
index f9145d2901d8..1a872120a197 100644
--- a/.github/workflows/check-misskey-js-version.yaml
+++ b/.github/workflows/check-misskey-js-version.yaml
@@ -20,7 +20,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
+        with:
+          persist-credentials: false
+          fetch-depth: 1
 
       - name: Check version
         run: |
@@ -31,11 +34,11 @@ jobs:
           source_version="$(cat "$source_file" | jq -r '.version')"
 
           if [[ "$source_version" != "$target_version" ]]; then
-            source_line="$(grep -n '"version": ' "$source_file" | cut -d: -f1)"
-            echo "::error file=${source_file},line=${source_line}::Version mismatch!"
+            source_line="$(grep -n '"version": ' "$source_file" | cut -d: -f1 || true)"
+            echo "::error file=${source_file},line=${source_line:-'0'}::Version mismatch!"
 
-            target_line="$(grep -n '"version": ' "$target_file" | cut -d: -f1)"
-            echo "::error file=${target_file},line=${target_line}::Version mismatch!"
+            target_line="$(grep -n '"version": ' "$target_file" | cut -d: -f1 || true)"
+            echo "::error file=${target_file},line=${target_line:-'0'}::Version mismatch!"
 
             exit 1
           fi
diff --git a/.github/workflows/check-spdx-license-id.yaml b/.github/workflows/check-spdx-license-id.yaml
index bdb76fe53f51..ec2b9900c1f3 100644
--- a/.github/workflows/check-spdx-license-id.yaml
+++ b/.github/workflows/check-spdx-license-id.yaml
@@ -22,7 +22,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
+        with:
+          persist-credentials: false
+          fetch-depth: 1
 
       - name: Check SPDX-License-Identifier
         run: |
diff --git a/.github/workflows/docker-publish.yaml b/.github/workflows/docker-publish.yaml
index 27137d9923e2..b670bac762b3 100644
--- a/.github/workflows/docker-publish.yaml
+++ b/.github/workflows/docker-publish.yaml
@@ -32,8 +32,9 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.release.tag_name }}
           fetch-depth: 1
 
@@ -58,7 +59,7 @@ jobs:
 
       - name: Build and Push to Registry
         id: build
-        uses: docker/build-push-action@v6.7.0
+        uses: docker/build-push-action@v6.9.0
         with:
           context: .
           push: true
diff --git a/.github/workflows/lint-locales.yaml b/.github/workflows/lint-locales.yaml
index 72c06ee83aa3..7e45bbb86952 100644
--- a/.github/workflows/lint-locales.yaml
+++ b/.github/workflows/lint-locales.yaml
@@ -1,4 +1,4 @@
-name: Lint (locales)
+name: Lint locales
 
 on:
   push:
@@ -13,12 +13,17 @@ on:
       - locales/**/*
 
 jobs:
-  lint_locales:
-    name: Lint locales
+  check_verify:
+    name: Check verify
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
+        with:
+          persist-credentials: false
+          fetch-depth: 1
 
       - name: Enable corepack
         run: |
@@ -38,3 +43,75 @@ jobs:
         working-directory: locales
         run: |
           node verify.js
+
+  check_dts:
+    name: Check locale type
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.0
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Enable corepack
+        run: |
+          corepack enable
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4.0.4
+        with:
+          node-version-file: .node-version
+          cache: pnpm
+
+      - name: Install dependencies
+        run: |
+          pnpm i --frozen-lockfile
+
+      - name: Generate locale type
+        run: |
+          node --input-type=module \
+            --eval 'import generateDTS from "./locales/generateDTS.js"; generateDTS();'
+
+      - name: Check locale type changes
+        id: check-changes
+        run: |
+          if git diff --name-only HEAD | grep -x locales/index.d.ts; then
+            echo "changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Comment PR (upsert)
+        if: steps.check-changes.outputs.changes == 'true'
+        uses: thollander/actions-comment-pull-request@v2.5.0
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          comment_tag: check-locale-type
+          mode: upsert
+          create_if_not_exists: true
+          message: |
+            Please regenerate locale type definitions! :pray:
+            locale型定義の再生成をお願いします！ :pray:
+
+            ```sh
+            pnpm run build-assets
+            ```
+
+      - name: Comment PR (delete)
+        if: steps.check-changes.outputs.changes == 'false'
+        uses: thollander/actions-comment-pull-request@v2.5.0
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          comment_tag: check-locale-type
+          mode: delete
+          create_if_not_exists: false
+          message: |
+            Thank you!
+
+      - name: Make failure if changes are detected
+        if: steps.check-changes.outputs.changes == 'true'
+        run: exit 1
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 4d0af9e9c433..a67867c96c6d 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -26,8 +26,9 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
+          persist-credentials: false
           fetch-depth: 1
           submodules: true
 
@@ -63,8 +64,9 @@ jobs:
       eslint-cache-path: ${{ github.workspace }}/node_modules/.cache/eslint-${{ matrix.workspace }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
+          persist-credentials: false
           fetch-depth: 1
           submodules: true
 
@@ -106,8 +108,9 @@ jobs:
         - misskey-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
+          persist-credentials: false
           fetch-depth: 1
           submodules: true
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 072c1d00e6d0..ea9e7f52c542 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -30,23 +30,25 @@ jobs:
         run: exit 1
 
       - name: Check base version
+        env:
+          base_version: ${{ inputs.base_version }}
         run: |
-          base="${{ inputs.base_version }}"
-          if [ -z "$base" ]; then
+          if [[ -z "$base_version" ]]; then
             exit 1
           fi
 
-          year="$(echo "$base" | cut -d. -f1)"
+          year="$(cut -d. -f1 <<< "$base_version")"
           if [[ ! "$year" =~ ^[0-9]+$ ]]; then
             exit 1
           fi
 
-          month="$(echo "$base" | cut -d. -f2)"
-          if [[ "$month" -lt 1 && "$month" -gt 12 ]]; then
+          month="$(cut -d. -f2 <<< "$base_version")"
+          if [[ ! "$month" =~ ^[0-9]+$ ]] || \
+            [[ "$month" -lt 1 || "$month" -gt 12 ]]; then
             exit 1
           fi
 
-          patch="$(echo "$base" | cut -d. -f3)"
+          patch="$(cut -d. -f3 <<< "$base_version")"
           if [[ ! "$patch" =~ ^[0-9]+$ ]]; then
             exit 1
           fi
@@ -60,23 +62,26 @@ jobs:
       NEW_VERSION: ${{ steps.generate.outputs.NEW_VERSION }}
     steps:
       - name: Checkout ${{ github.sha }}
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
+          persist-credentials: false
           ref: ${{ github.sha }}
           fetch-depth: 1
 
       - name: Generate new version
         id: generate
+        env:
+          base_version: ${{ inputs.base_version }}
         run: |
           current_version="$(cat package.json | jq -r '.version')"
-          current_base="$(echo $current_version | sed 's/-.*//')"
-          new_base="${{ inputs.base_version }}"
-          new_base="${new_base:-$current_base}"
-          new_suffix=""
-          if [[ "$current_version" != "$current_base" && "$current_base" == "$new_base" ]]; then
-            new_suffix="$(($(echo $current_version | cut -d- -f2 | cut -d. -f2) + 1))"
+          current_base="$(sed 's/-.*//' <<< "$current_version")"
+          new_base="${base_version:-"$current_base"}"
+          if [[ "$current_version" != "$current_base" && \
+            "$current_base" == "$new_base" ]]; then
+            current_suffix="$((cut -d- -f2 | cut -d. -f2) <<< "$current_version")"
+            new_suffix="$(("$current_suffix" + 1))"
           fi
-          new_suffix="${new_suffix:-"0"}"
+          new_suffix="${new_suffix:-'0'}"
           new_version="${new_base}-taiyme.${new_suffix}"
           echo "NEW_VERSION=${new_version}" >> $GITHUB_OUTPUT
 
@@ -87,8 +92,9 @@ jobs:
       - parse_version
     steps:
       - name: Checkout ${{ github.sha }}
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
+          persist-credentials: false
           ref: ${{ github.sha }}
           fetch-depth: 1
 
@@ -141,7 +147,7 @@ jobs:
           echo "user-id=${user_id}" >> $GITHUB_OUTPUT
 
       - name: Checkout ${{ vars.DEVELOP_BRANCH }}
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false
@@ -181,7 +187,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_PRIVATE_KEY }}
 
       - name: Checkout ${{ vars.DEVELOP_BRANCH }}
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false
@@ -193,8 +199,14 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          created_pr="$(gh pr create --draft --base ${{ vars.RELEASE_BRANCH }} --head ${{ vars.DEVELOP_BRANCH }} --title "Release: ${{ needs.parse_version.outputs.NEW_VERSION }}" --body "")"
-          created_pr="$(echo $created_pr | awk -F '/' '/\/pull\/[0-9]+$/ {print $NF}')"
+          created_pr="$(
+            gh pr create --draft \
+              --base ${{ vars.RELEASE_BRANCH }} \
+              --head ${{ vars.DEVELOP_BRANCH }} \
+              --title "Release: ${{ needs.parse_version.outputs.NEW_VERSION }}" \
+              --body ""
+          )"
+          created_pr="$(awk -F '/' '/\/pull\/[0-9]+$/ {print $NF}' <<< "$created_pr")"
           echo "CREATED_PR=${created_pr}" >> $GITHUB_OUTPUT
 
   merge_pr:
@@ -211,7 +223,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_PRIVATE_KEY }}
 
       - name: Checkout ${{ vars.DEVELOP_BRANCH }}
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false
@@ -241,7 +253,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_PRIVATE_KEY }}
 
       - name: Checkout ${{ vars.RELEASE_BRANCH }}
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false