diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d1266056bca..9656d0d6163 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -3,17 +3,19 @@ on:
   push:
     branches:
       - 'develop'
+  pull_request:
 permissions:
   contents: write
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           lfs: 'true'
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 18
       - name: Install
@@ -23,15 +25,15 @@ jobs:
       - name: Build
         run: npm run build
       - name: Install Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@708024e6c902387ab41de36e1669e43b5ee7085e # v1.283.0
         with:
-          ruby-version: 2.7.8
+          ruby-version: 3.2.2
       - name: Bundle install
         run: bundle install
       - name: Build Jekyll
         run: bundle exec jekyll build
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         if: github.ref == 'refs/heads/develop'
         with:
           github_token: ${{ secrets.SHARED_BOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/rss-to-mastodon.yml b/.github/workflows/rss-to-mastodon.yml
index 1ec228470da..44b34b5e404 100644
--- a/.github/workflows/rss-to-mastodon.yml
+++ b/.github/workflows/rss-to-mastodon.yml
@@ -4,26 +4,27 @@ on:
   schedule:
     - cron: '*/15 * * * *'
   workflow_dispatch:
+permissions: {}
 jobs:
   realtime:
     runs-on: ubuntu-latest
     steps:
       - name: Generate cache key
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         id: generate-key
         with:
           script: |
             core.setOutput('cache-key', new Date().valueOf())
 
       - name: Retrieve cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ${{ github.workspace }}/mastofeedbot
           key: feed-cache-realtime-jser-info-${{ steps.generate-key.outputs.cache-key }}
           restore-keys: feed-cache-realtime-jser-info-
 
       - name: JSer.info
-        uses: 'jser/mastofeedbot@main'
+        uses: 'jser/mastofeedbot@0e1dbc3e480b4a35d5a01dd539f2341f5b785afd' # main
         with:
           rss-feed: https://realtime.jser.info/feed.xml
           api-endpoint: https://mstdn.jp
@@ -35,21 +36,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate cache key
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         id: generate-key
         with:
           script: |
             core.setOutput('cache-key', new Date().valueOf())
 
       - name: Retrieve cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ${{ github.workspace }}/mastofeedbot
           key: feed-cache-jser-info-${{ steps.generate-key.outputs.cache-key }}
           restore-keys: feed-cache-jser-info-
 
       - name: JSer.info
-        uses: 'jser/mastofeedbot@main'
+        uses: 'jser/mastofeedbot@0e1dbc3e480b4a35d5a01dd539f2341f5b785afd' # main
         with:
           rss-feed: https://jser.info/rss/
           api-endpoint: https://mstdn.jp
diff --git a/.github/workflows/rss-to-twitter.yml b/.github/workflows/rss-to-twitter.yml
index 10327a26531..900b378caca 100644
--- a/.github/workflows/rss-to-twitter.yml
+++ b/.github/workflows/rss-to-twitter.yml
@@ -1,6 +1,7 @@
 name: rss-to-twitter
 on:
   page_build
+permissions: {}
 jobs:
   twitter:
     runs-on: ubuntu-latest
@@ -8,7 +9,7 @@ jobs:
     if: ${{ github.event.build.error.message == null }}
     steps:
       # https://github.com/azu/rss-to-twitter
-      - uses: azu/rss-to-twitter@v1
+      - uses: azu/rss-to-twitter@f20e6ba3ed2dc03d86578775a5d2a3afb5bff966 # v1.1.0
         with:
           RSS_URL: "https://jser.info/rss/"
           TWEET_TEMPLATE: '更新しました！ "%title%" %url%'
diff --git a/.github/workflows/textlint.yml b/.github/workflows/textlint.yml
index b6bae25684d..76ac3df8a4a 100644
--- a/.github/workflows/textlint.yml
+++ b/.github/workflows/textlint.yml
@@ -11,15 +11,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      with:
+        persist-credentials: false
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
       with:
         node-version: 18
     - name: Install
       run: yarn install
     - name: textlint reviewdog
-      uses: tsuyoshicho/action-textlint@v3
+      uses: tsuyoshicho/action-textlint@689c87690ef3b954b5039bcb15589863c9e021a1 # v3.11.1
       with:
         github_token: ${{ secrets.github_token }}
         reporter: github-pr-review
diff --git a/.github/workflows/update-draft-pr.yml b/.github/workflows/update-draft-pr.yml
index b32647cbf29..5b5d4f940f7 100644
--- a/.github/workflows/update-draft-pr.yml
+++ b/.github/workflows/update-draft-pr.yml
@@ -14,9 +14,11 @@ jobs:
     if: github.event_name == 'pull_request' && (github.event.pull_request.author_association == 'MEMBER' || github.event.pull_request.author_association == 'OWNER' || github.event.pull_request.author_association == 'COLLABORATOR')
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 18
       - name: Install
diff --git a/.ruby-version b/.ruby-version
index 6a81b4c8379..be94e6f53db 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.7.8
+3.2.2
diff --git a/Gemfile b/Gemfile
index cd94e038d8c..f2d33d9568d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,6 +1,7 @@
 source 'https://rubygems.org'
 gem 'jekyll', '~>3.0'
 gem 'redcarpet'
+gem 'kramdown-parser-gfm'
 gem 'jemoji'
 gem 'jekyll-sitemap'
 gem 'rake'
diff --git a/Gemfile.lock b/Gemfile.lock
index c8b171b4db5..a54e80a45f7 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,34 +1,47 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.0.3.4)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2, >= 2.2.2)
-    addressable (2.7.0)
-      public_suffix (>= 2.0.2, < 5.0)
+    activesupport (8.1.2)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
+    base64 (0.3.0)
+    bigdecimal (4.0.1)
     colorator (1.1.0)
-    concurrent-ruby (1.1.7)
-    em-websocket (0.5.2)
+    concurrent-ruby (1.3.6)
+    connection_pool (3.0.2)
+    csv (3.3.5)
+    drb (2.2.3)
+    em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
-      http_parser.rb (~> 0.6.0)
+      http_parser.rb (~> 0)
     eventmachine (1.2.7)
-    ffi (1.13.1)
+    ffi (1.17.3)
     forwardable-extended (2.6.0)
-    gemoji (3.0.1)
-    html-pipeline (2.14.0)
+    gemoji (4.1.0)
+    html-pipeline (2.14.3)
       activesupport (>= 2)
       nokogiri (>= 1.4)
-    http_parser.rb (0.6.0)
-    i18n (0.9.5)
+    http_parser.rb (0.8.1)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
-    jekyll (3.9.0)
+    jekyll (3.10.0)
       addressable (~> 2.4)
       colorator (~> 1.0)
+      csv (~> 3.0)
       em-websocket (~> 0.5)
-      i18n (~> 0.7)
+      i18n (>= 0.7, < 2)
       jekyll-sass-converter (~> 1.0)
       jekyll-watch (~> 2.0)
       kramdown (>= 1.17, < 3)
@@ -37,60 +50,66 @@ GEM
       pathutil (~> 0.9)
       rouge (>= 1.7, < 4)
       safe_yaml (~> 1.0)
-    jekyll-multiple-languages-plugin (1.7.0)
+      webrick (>= 1.0)
+    jekyll-multiple-languages-plugin (1.8.0)
       jekyll (>= 2.0, < 5.0)
     jekyll-paginate (1.1.0)
     jekyll-sass-converter (1.5.2)
       sass (~> 3.4)
     jekyll-sitemap (1.4.0)
       jekyll (>= 3.7, < 5.0)
-    jekyll-toc (0.15.0)
-      jekyll (>= 3.8)
-      nokogiri (~> 1.10)
+    jekyll-toc (0.19.0)
+      jekyll (>= 3.9)
+      nokogiri (~> 1.12)
     jekyll-watch (2.2.1)
       listen (~> 3.0)
-    jemoji (0.12.0)
-      gemoji (~> 3.0)
+    jemoji (0.13.0)
+      gemoji (>= 3, < 5)
       html-pipeline (~> 2.2)
       jekyll (>= 3.0, < 5.0)
-    kramdown (2.3.0)
-      rexml
-    liquid (4.0.3)
-    listen (3.2.1)
+    json (2.18.0)
+    kramdown (2.5.1)
+      rexml (>= 3.3.9)
+    kramdown-parser-gfm (1.1.0)
+      kramdown (~> 2.0)
+    liquid (4.0.4)
+    listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     mercenary (0.3.6)
-    mini_portile2 (2.8.2)
-    minitest (5.14.2)
-    multi_json (1.15.0)
-    nokogiri (1.13.10)
-      mini_portile2 (~> 2.8.0)
+    mini_portile2 (2.8.9)
+    minitest (6.0.1)
+      prism (~> 1.5)
+    nokogiri (1.19.0)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
-    public_suffix (4.0.6)
-    pygments.rb (1.2.1)
-      multi_json (>= 1.0.0)
-    racc (1.6.2)
+    prism (1.8.0)
+    public_suffix (7.0.2)
+    pygments.rb (4.0.0)
+    racc (1.8.1)
     rake (10.5.0)
     rake-jekyll (1.1.0)
       rake (~> 10.0)
-    rb-fsevent (0.10.4)
-    rb-inotify (0.10.1)
+    rb-fsevent (0.11.2)
+    rb-inotify (0.11.1)
       ffi (~> 1.0)
-    redcarpet (3.5.0)
-    rexml (3.2.4)
-    rouge (3.24.0)
+    redcarpet (3.6.1)
+    rexml (3.4.4)
+    rouge (3.30.0)
     safe_yaml (1.0.5)
     sass (3.7.4)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
-    thread_safe (0.3.6)
-    tzinfo (1.2.7)
-      thread_safe (~> 0.1)
-    zeitwerk (2.4.1)
+    securerandom (0.4.1)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uri (1.1.1)
+    webrick (1.9.2)
 
 PLATFORMS
   ruby
@@ -102,6 +121,7 @@ DEPENDENCIES
   jekyll-sitemap
   jekyll-toc
   jemoji
+  kramdown-parser-gfm
   pygments.rb
   rake
   rake-jekyll
diff --git a/_config.yml b/_config.yml
index a00412693b1..b54e49b32cb 100644
--- a/_config.yml
+++ b/_config.yml
@@ -35,10 +35,12 @@ paginate: 10
 paginate_path: "page/:num"
 permalink: /:year/:month/:day/:title/
 # Build settings
-markdown: redcarpet
+markdown: kramdown
 # https://github.com/jser/jser.github.io/issues/35
-redcarpet:
-  extensions: [autolink, hard_wrap, with_toc_data]
+kramdown:
+  input: GFM
+  hard_wrap: true
+  auto_ids: true
 
 # collection AMP
 collections:
@@ -60,5 +62,5 @@ exclude_from_localizations: ["bower_components", "node_modules", "public"]
 plugins:
   - jekyll-multiple-languages-plugin
   - jekyll-sitemap
-  - jemoji
+  # - jemoji # disabled due to UTF-8 issues with Ruby 3.x
   - jekyll-toc