chore(deps): update actions/setup-node action to v6.5.0 by renovate[bot] · Pull Request #38 · wave-av/sdk

renovate · 2026-06-25T19:47:13Z

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	`v6.4.0` → `v6.5.0`

Release Notes

actions/setup-node (actions/setup-node)

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-25T19:47:18Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-25T19:47:18Z

⚠️ No Changeset found

Latest commit: 501d17c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-25T21:35:09Z

🌊 WAVE BugBot — 6 finding(s)

🔴 5 · 🟡 1

🔴 P0 .github/workflows/publish.yml:16 CWE-825 — Unpinned action tag (@v1 vs commit SHA)
The 'actions/setup-node' action is using a version tag (@v6) instead of a specific commit SHA. This can lead to unexpected behavior if the action's code changes
🔴 P0 .github/workflows/publish.yml:16 CWE-798 — Secret echoed to logs
The 'NODE_AUTH_TOKEN' environment variable is being used in a command that will be logged. This could potentially leak the token if the log is not properly secu
🔴 P0 .github/workflows/publish.yml:16 CWE-269 — Unpinned action tag
The action tag is pinned to a specific version (v6), but it's recommended to use a commit SHA for more control and security.
🔴 P0 .github/workflows/publish.yml:16 CWE-840 — Potential money path issue due to version update
Updating the actions/setup-node action from v4 to v6 might introduce a money path vulnerability if not properly managed. Ensure that any money-related operation
🔴 P0 .github/workflows/publish.yml:16 CWE-312 — Secret token in environment variable
The NODE_AUTH_TOKEN is being used directly from the environment, which could potentially leak if not properly secured.
🟡 P2 .github/workflows/publish.yml:16 — Unpinned action tag
The action tag is unpinned (e.g., @v6 instead of a specific commit SHA). This can lead to unexpected behavior if the action's default branch changes.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

devin-ai-integration

Devin Review found 1 potential issue.

devin-ai-integration · 2026-08-01T23:14:22Z

        with:
          persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0


🔍 Action pin bump applied consistently; SHA/tag pairing unverifiable offline

All three actions/setup-node pins in the repo (.github/workflows/lint.yml:19, .github/workflows/release.yml:81, .github/workflows/release.yml:135) were updated to the same commit SHA with the # v6.5.0 comment, so the mechanical bump is complete — no stale pins remain. The only thing I could not verify from within the repo is that the SHA 249970729cb0ef3589644e2896645e5dc5ba9c38 actually corresponds to the upstream v6.5.0 tag; a reviewer should confirm against the upstream release before merge since the comment is the only trust anchor for the pin.

Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-04T04:03:56Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a narrowly scoped Renovate update to the setup-node action used by lint, smoke-test, verification, and npm publishing workflows, with no application runtime changes. Human review remains appropriate because all touched workflow files are owned by the core team and the pinned SHA’s correspondence to v6.5.0 is not established by the available repository evidence.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at e10a38e. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-08-27T21:24:30Z