chore(deps): update actions/setup-node action to v6.5.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v6.4.0 → v6.5.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c87c956

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 2 finding(s)

🔴 2

• 🔴 P0 .github/workflows/release.yml:85 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
  Using a version tag (@v1) instead of a specific commit SHA for the actions/setup-node action can lead to security vulnerabilities if the action is updated in a
• 🔴 P0 .github/workflows/release.yml:85 CWE-269 — Overbroad token permissions
  The action/setup-node step does not specify any permissions, which means it may be granted more access than necessary.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a narrowly scoped update of the pinned setup-node action used by governance, lint, verification, and npm publishing workflows, with no application-runtime or deployment-target changes. All changed workflow files are explicitly owned by the core team rather than the automated author, so designated human review is recommended.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.