diff --git a/.github/workflows/gh_pr_auto_merger.yml b/.github/workflows/gh_pr_auto_merger.yml
index b9beb1d47fe..2134bc70f12 100644
--- a/.github/workflows/gh_pr_auto_merger.yml
+++ b/.github/workflows/gh_pr_auto_merger.yml
@@ -10,6 +10,12 @@ env:
  GREETINGS_MESSAGE: ':tada: It seems that this pull request has been approved by all required reviewers.'
  AUTO_MERGE_MESSAGE: As it only contains one normal commit, I will rebase and merge it automatically via add `action(rebase-merge)` label.
  MANUAL_MERGE_MESSAGE: But it has more than one normal commit, I will notify admin team member to merge it manually, please wait a moment.
+ MERGE_SHA_MESSAGE: |
+  <details>
+
+    * SHA: {0}
+
+  </details>
 
 jobs:
   call_get_workflow_output:
@@ -26,6 +32,7 @@ jobs:
       pull_request_number: ${{ steps.parse_workflow_output.outputs.pull_request_number }}
       pull_request_title: ${{ steps.parse_workflow_output.outputs.pull_request_title }}
       pull_request_url: ${{ steps.parse_workflow_output.outputs.pull_request_url }}
+      pull_request_sha: ${{ steps.parse_workflow_output.outputs.pull_request_sha }}
     steps:
     - name: Parse
       id: parse_workflow_output
@@ -43,6 +50,7 @@ jobs:
           file.write("pull_request_number=%s\n" % data["pull_request"]["number"])
           file.write("pull_request_title=%s\n" % data["pull_request"]["title"])
           file.write("pull_request_url=%s\n" % data["pull_request"]["html_url"])
+          file.write("pull_request_sha=%s\n" % data["pull_request"]["head"]["sha"])
     - name: Decision
       id: decision
       if: steps.parse_workflow_output.outputs.review_state == 'approved'
@@ -88,11 +96,22 @@ jobs:
         app-id: ${{ secrets.BOT_APP_ID }}
     - name: Auto
       uses: actions/github-script@v6
+      env:
+        COMMENT_MESSAGE: ${{ env.GREETINGS_MESSAGE }} ${{ env.AUTO_MERGE_MESSAGE }} ${{ format(env.MERGE_SHA_MESSAGE, needs.get_decision.outputs.pull_request_sha) }}
       with:
         github-token: ${{ steps.get-token.outputs.token }}
         script: |
           const { issues } = github.rest;
 
+          const comments = await github.paginate(issues.listComments, {
+            ...context.repo,
+            per_page: 100,
+            issue_number: ${{ needs.get_decision.outputs.pull_request_number }}
+          });
+          if (comments.some((comment) => comment.body.includes(process.env.COMMENT_MESSAGE))) {
+            return;
+          }
+
           const p = [];
 
           p.push(issues.addLabels({
@@ -104,7 +123,7 @@ jobs:
           p.push(issues.createComment({
             ...context.repo,
             issue_number: ${{ needs.get_decision.outputs.pull_request_number }},
-            body: process.env.GREETINGS_MESSAGE + " " + process.env.AUTO_MERGE_MESSAGE,
+            body: process.env.COMMENT_MESSAGE
           }));
 
           await Promise.all(p);
@@ -127,18 +146,28 @@ jobs:
           [#${{ needs.get_decision.outputs.pull_request_number }}](${{ needs.get_decision.outputs.pull_request_url }}) pull request is met merge requirements.
           > ${{ needs.get_decision.outputs.pull_request_title }}
           > <font color="warning">%s</font> normal commits ahead
+        COMMENT_MESSAGE: ${{ env.GREETINGS_MESSAGE }} ${{ env.MANUAL_MERGE_MESSAGE }} ${{ format(env.MERGE_SHA_MESSAGE, needs.get_decision.outputs.pull_request_sha) }}
       with:
         github-token: ${{ steps.get-token.outputs.token }}
         script: |
           const util = require('util');
           const { issues } = github.rest;
 
+          const comments = await github.paginate(issues.listComments, {
+            ...context.repo,
+            per_page: 100,
+            issue_number: ${{ needs.get_decision.outputs.pull_request_number }}
+          });
+          if (comments.some((comment) => comment.body.includes(process.env.COMMENT_MESSAGE))) {
+            return;
+          }
+
           const p = [];
 
           p.push(issues.createComment({
             ...context.repo,
             issue_number: ${{ needs.get_decision.outputs.pull_request_number }},
-            body: process.env.GREETINGS_MESSAGE + " " + process.env.MANUAL_MERGE_MESSAGE
+            body: process.env.COMMENT_MESSAGE
           }));
 
           p.push(github.request("POST ${{ secrets.WECHAT_WORK_BOT_WEBHOOK }}", {
diff --git a/.github/workflows/gh_pr_checks_approval.yml b/.github/workflows/gh_pr_checks_approval.yml
index 6d0b28c2e12..ba687b32e54 100644
--- a/.github/workflows/gh_pr_checks_approval.yml
+++ b/.github/workflows/gh_pr_checks_approval.yml
@@ -79,20 +79,20 @@ jobs:
 
         </details>
       tips_message: |
-        :label: **New commits in this PR would not be tested automatically** until our collaborators do something verified for them. After that, collaborators would either approve this PR or apply the action(approve-checks) label to this PR.
-        :label: **No need to worry about the status of `[gh] pull request merge guard / merge_guard (pull_request_target)` check**, once this PR is merged via `action(rebase-merge)` or `action(squash-merge)`, it will be automatically converted to successful status.
-    steps:
+        :label: **New commits in this PR would not be tested automatically** until this pull request is reviewed by our collaborators.
+        :label: **No need to worry about the status of `merge_guard ` and `[gh] pull request merge guard / merge_guard (pull_request_target)` checks**, once this pull request is met merge requirements, it will be automatically converted to successful status.
+     steps:
     - name: Message
       id: generate_message
       run: |
-        message="${{ needs.call_approval_checks_run.outputs.included_risk_files == 'true' && env.risky_changes_message || env.safety_changes_message }}"
+        message="$${{ needs.call_approval_checks_run.outputs.included_risk_files == 'true' && 'risky_changes_message' || 'safety_changes_message' }}"
 
         echo "comment_message<<EOF" >> $GITHUB_OUTPUT
         echo "$message" >> $GITHUB_OUTPUT
         echo "$details_message" >> $GITHUB_OUTPUT
         if [[ "${{ github.event.action }}" == *"opened"* ]]; then
           echo >> $GITHUB_OUTPUT
-          echo "${{ env.tips_message }}" >> $GITHUB_OUTPUT
+          echo "$tips_message" >> $GITHUB_OUTPUT
         fi
         echo "EOF" >> $GITHUB_OUTPUT
 
diff --git a/.github/workflows/project_dependency_review.yml b/.github/workflows/project_dependency_review.yml
new file mode 100644
index 00000000000..b57e4d3fe9a
--- /dev/null
+++ b/.github/workflows/project_dependency_review.yml
@@ -0,0 +1,22 @@
+name: "[project] dependency review"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v3
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v3
+        with:
+          deny-licenses: |
+            GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, AGPL-1.0, AGPL-3.0, AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, MPL-1.0, MPL-1.1, MPL-2.0, MPL-2.0-no-copyleft-exception, LGPL-2.0, LGPL-2.0+, LGPL-2.1, LGPL-2.1+, LGPL-3.0, LGPL-3.0+, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later
diff --git a/android/sdk/src/main/java/com/tencent/mtt/hippy/views/hippylist/HippyRecyclerView.java b/android/sdk/src/main/java/com/tencent/mtt/hippy/views/hippylist/HippyRecyclerView.java
index 36fbeb08138..ee99f4f33bb 100644
--- a/android/sdk/src/main/java/com/tencent/mtt/hippy/views/hippylist/HippyRecyclerView.java
+++ b/android/sdk/src/main/java/com/tencent/mtt/hippy/views/hippylist/HippyRecyclerView.java
@@ -191,15 +191,15 @@ public void setListData() {
             mFocusHelper.setListData();
         }
 
-        //notifyDataSetChanged 本身是可以触发requestLayout的，但是Hippy框架下 HippyRootView 已经把
-        //onLayout方法重载写成空方法，requestLayout不会回调孩子节点的onLayout，这里需要自己发起dispatchLayout
-        renderNodeCount = getAdapter().getRenderNodeCount();
-        dispatchLayout();
+        renderNodeCount = listAdapter.getRenderNodeCount();
         if (renderNodeCount > 0) {
             if (mInitialContentOffset > 0 && getChildCount() > 0) {
                 scrollToInitContentOffset();
             }
         }
+        //notifyDataSetChanged 本身是可以触发requestLayout的，但是Hippy框架下 HippyRootView 已经把
+        //onLayout方法重载写成空方法，requestLayout不会回调孩子节点的onLayout，这里需要自己发起dispatchLayout
+        dispatchLayout();
     }
 
     /**