chore(deps): update actions/setup-node action to v6.5.0 by renovate[bot] · Pull Request #38 · wave-av/sdk

renovate · 2026-06-25T19:47:13Z

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	`v6.4.0` → `v6.5.0`

Release Notes

actions/setup-node (actions/setup-node)

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-25T19:47:18Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-25T19:47:18Z

⚠️ No Changeset found

Latest commit: 501d17c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-25T21:35:09Z

🌊 WAVE BugBot — 6 finding(s)

🔴 5 · 🟡 1

🔴 P0 .github/workflows/publish.yml:16 CWE-825 — Unpinned action tag (@v1 vs commit SHA)
The 'actions/setup-node' action is using a version tag (@v6) instead of a specific commit SHA. This can lead to unexpected behavior if the action's code changes
🔴 P0 .github/workflows/publish.yml:16 CWE-798 — Secret echoed to logs
The 'NODE_AUTH_TOKEN' environment variable is being used in a command that will be logged. This could potentially leak the token if the log is not properly secu
🔴 P0 .github/workflows/publish.yml:16 CWE-269 — Unpinned action tag
The action tag is pinned to a specific version (v6), but it's recommended to use a commit SHA for more control and security.
🔴 P0 .github/workflows/publish.yml:16 CWE-840 — Potential money path issue due to version update
Updating the actions/setup-node action from v4 to v6 might introduce a money path vulnerability if not properly managed. Ensure that any money-related operation
🔴 P0 .github/workflows/publish.yml:16 CWE-312 — Secret token in environment variable
The NODE_AUTH_TOKEN is being used directly from the environment, which could potentially leak if not properly secured.
🟡 P2 .github/workflows/publish.yml:16 — Unpinned action tag
The action tag is unpinned (e.g., @v6 instead of a specific commit SHA). This can lead to unexpected behavior if the action's default branch changes.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

devin-ai-integration

Devin Review found 1 potential issue.

devin-ai-integration · 2026-08-01T23:14:22Z

        with:
          persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0


🔍 Action pin bump applied consistently; SHA/tag pairing unverifiable offline

All three actions/setup-node pins in the repo (.github/workflows/lint.yml:19, .github/workflows/release.yml:81, .github/workflows/release.yml:135) were updated to the same commit SHA with the # v6.5.0 comment, so the mechanical bump is complete — no stale pins remain. The only thing I could not verify from within the repo is that the SHA 249970729cb0ef3589644e2896645e5dc5ba9c38 actually corresponds to the upstream v6.5.0 tag; a reviewer should confirm against the upstream release before merge since the comment is the only trust anchor for the pin.

Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-04T04:03:56Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a mechanically consistent setup-node pin update across validation, evidence, SBOM, smoke-test, and release workflows, with no SDK runtime or deployment-target change. All modified workflows are owned by the core team, and the upstream SHA/tag pairing remains unverified in the available repository context, so owner review is warranted.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at ee97643. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-09-03T18:09:58Z