diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index d0a8da3..11ef934 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Setup JS
-        uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0
+        uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294
         with:
           no-frozen-lockfile: true
 
diff --git a/.github/workflows/bundle-diff.yml b/.github/workflows/bundle-diff.yml
new file mode 100644
index 0000000..4c43e4b
--- /dev/null
+++ b/.github/workflows/bundle-diff.yml
@@ -0,0 +1,80 @@
+name: Dependency Diff
+
+on:
+  pull_request:
+
+jobs:
+  build-main:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: main
+          persist-credentials: false
+      - name: Setup JS
+        uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294
+
+      - name: Build
+        run: pnpm build
+      - name: Pack
+        run: pnpm pack -r --pack-destination ./tarballs -F "./packages/**"
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: base-packages
+          path: ./tarballs/*.tgz
+
+  build-pr:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Setup JS
+        uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294
+
+      - name: Build
+        run: pnpm build
+      - name: Pack
+        run: pnpm pack -r --pack-destination ./tarballs -F "./packages/**"
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: source-packages
+          path: ./tarballs/*.tgz
+
+  diff_dependencies:
+    runs-on: ubuntu-latest
+    needs: [build-main, build-pr]
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0 # allows the diff action to access git history
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: base-packages
+          path: ./base-packages
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: source-packages
+          path: ./source-packages
+      - name: Create Diff
+        uses: e18e/action-dependency-diff@3648e18f3cb944fbc79b52b7febc153a8b5381cb # fix: disable duplicate checks when threshold <= 0
+        with:
+          base-packages: ./base-packages/*.tgz
+          source-packages: ./source-packages/*.tgz
+          pack-size-threshold: -1
+          size-threshold: -1
+          duplicate-threshold: -1
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 611d070..2610814 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Setup JS
-        uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0
+        uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294
         with:
           fetch-all: true
 
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index fe59261..a6189db 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -17,7 +17,7 @@ jobs:
     permissions: {}
     steps:
       - name: Setup JS
-        uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0
+        uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294
 
       - name: Build
         run: pnpm build
@@ -36,7 +36,7 @@ jobs:
     permissions: {}
     steps:
       - name: Setup JS
-        uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0
+        uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294
         with:
           node-version: ${{ matrix.node-version }}