chore(deps): update actions/setup-node action to v6.5.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v6.4.0 → v6.5.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Note

Update actions/setup-node to v6.5.0 in governance-enforce workflow

Pins actions/setup-node to the commit hash corresponding to v6.5.0 in governance-enforce.yml, replacing the v6.4.0 pin.

^{Macroscope summarized 8e7cc17.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: ab3e253

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Risk: low. Approved: this is a narrow Renovate bump of actions/setup-node v6.4.0→v6.5.0 in one workflow file. Cursor Bugbot was not present on this PR, so that signal was skipped; no reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 2f025c9. This is a minor version bump of actions/setup-node (v6.4.0 → v6.5.0), which is low-risk. However, the modified workflow file is owned by wave-av/streaming-team per CODEOWNERS, and the designated owners should review changes to their files.

No code changes detected at 8e7cc17. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 Pinned SHA cannot be verified locally; confirm it matches v6.5.0

The only change is swapping the pinned commit SHA for actions/setup-node from 48b55a0 (v6.4.0) to 249970729cb0ef3589644e2896645e5dc5ba9c38 labeled v6.5.0. SHA pinning is used consistently in this workflow (checkout is also pinned), and this is the sole setup-node reference in .github/ so no other workflow drifts out of sync. The SHA-to-tag correspondence cannot be verified from the repo alone — worth a quick check against the upstream release tag before merge.

---

Was this helpful? React with 👍 or 👎 to provide feedback.