chore(deps): update actions/setup-node action to v6.5.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v6.4.0 → v6.5.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Note

Update actions/setup-node to v6.5.0 in CI workflows

Updates the pinned commit hash for actions/setup-node from v6.4.0 to v6.5.0 in the lint.yml and release.yml workflows, affecting the eslint, verify, and publish jobs.

^{Macroscope summarized 5fc35b9.}

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c87c956

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 3 finding(s)

🔴 2 · 🟡 1

• 🔴 P0 .github/workflows/publish.yml:16 CWE-825 — Unpinned action tag
  The action tag is pinned to a specific version (v6), but it's recommended to use the commit SHA for more control and security.
• 🔴 P0 .github/workflows/publish.yml:16 CWE-840 — Potential money-path issue due to update of actions/setup-node action
  The update from v4 to v6 of the actions/setup-node action might introduce a money-path vulnerability if it changes how environment variables or permissions are
• 🟡 P2 .github/workflows/publish.yml:16 — Unpinned action tag
  Using a versioned tag (@v6) instead of a specific commit SHA can lead to unexpected behavior if the action is updated in a way that breaks compatibility.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 Pin bump applied consistently across all setup-node usages

All three actions/setup-node pins in the repo (.github/workflows/lint.yml:23, .github/workflows/release.yml:85, .github/workflows/release.yml:170) were updated to the same commit SHA with a matching # v6.5.0 comment; no other workflow references setup-node, so the dependency bump is complete. Worth a reviewer confirming the SHA truly corresponds to the v6.5.0 tag upstream, since a mismatched comment/SHA pair cannot be verified from within the repo.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 5fc35b9. Minor CI/CD dependency update (actions/setup-node v6.4.0 → v6.5.0) with no runtime impact. However, all changed workflow files are owned by wave-av/core-team per CODEOWNERS, so designated owners should review and approve.

^{You can customize Macroscope's approvability policy. Learn more.}