chore(deps): update actions/setup-node action to v6

[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v4.4.0 → v6.3.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6.3.0

Compare Source

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in #​1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in #​1491
• Replace uuid with crypto.randomUUID() by @​trivikr in #​1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in #​1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in #​1495

New Contributors

• @​susnux made their first contribution in #​1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed

Documentation

• Documentation update related to absence of Lockfile by @​mahabaleshwars in #​1454
• Correct mirror option typos by @​MikeMcC399 in #​1442
• Readme update on checkout version v6 by @​deining in #​1446
• Readme typo fixes @​munyari in #​1226
• Advanced document update on checkout version v6 by @​aparnajyothi-y in #​1468

Dependency updates:

• Upgrade @​actions/cache to v5.0.1 by @​salmanmkc in #​1449

New Contributors

• @​mahabaleshwars made their first contribution in #​1454
• @​MikeMcC399 made their first contribution in #​1442
• @​deining made their first contribution in #​1446
• @​munyari made their first contribution in #​1226

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed

Enhancement:

• Remove always-auth configuration handling by @​priyagupta108 in #​1436

Dependency updates:

• Upgrade @​actions/cache from 4.0.3 to 4.1.0 by @​dependabot[bot] in #​1384
• Upgrade actions/checkout from 5 to 6 by @​dependabot[bot] in #​1439
• Upgrade js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in #​1435

Documentation update:

• Add example for restore-only cache in documentation by @​aparnajyothi-y in #​1419

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

• Limit automatic caching to npm, update workflows and documentation by @​priyagupta108 in #​1374

Dependency Upgrades

• Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @​dependabot[bot] in #​1336
• Upgrade prettier from 2.8.8 to 3.6.2 by @​dependabot[bot] in #​1334
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot[bot] in #​1362

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

Compare Source

What's Changed

Breaking Changes

• Enhance caching in setup-node with automatic package manager detection by @​priya-kinthali in #​1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

• Upgrade action to use node24 by @​salmanmkc in #​1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

• Upgrade @​octokit/request-error and @​actions/github by @​dependabot[bot] in #​1227
• Upgrade uuid from 9.0.1 to 11.1.0 by @​dependabot[bot] in #​1273
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​1295
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​1332
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​1345

New Contributors

• @​priya-kinthali made their first contribution in #​1348
• @​salmanmkc made their first contribution in #​1325

Full Changelog: actions/setup-node@v4...v5.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[claude]

PR Review: chore(deps): update actions/setup-node action to v6

This is a clean, straightforward dependency update from Renovate Bot bumping actions/setup-node from v4.4.0 → v6.2.0.

What changed (1 line in .github/workflows/test.yml):

• Pinned SHA updated from 49933ea5 → 6044e13b
• Version comment updated from v4.4.0 → v6.2.0

Breaking changes between v4 and v6 to consider:

• v5.0.0: Introduced automatic caching when a packageManager field is present in package.json, and upgraded the action to use node24 (requires runner v2.327.1+)
• v6.0.0: Limited automatic caching to npm only (removed support for other package managers via auto-detection)

Assessment: None of the breaking changes apply here because:

1. The workflow only uses node-version: 22 — no caching options are configured, so the auto-caching behavior change in v5/v6 is irrelevant
2. GitHub-hosted runners are already at a version supporting node24
3. The SHA pinning practice is correctly maintained — good security hygiene

No issues found. This update is safe to merge.

[claude]

PR Review: chore(deps): update actions/setup-node v4.4.0 → v6.3.0

This is a routine Renovate dependency update for the actions/setup-node action, jumping two major versions (v4 → v6, skipping v5).

Summary of Notable Breaking Changes

v5.0.0

• Action now runs on Node 24 (requires GitHub Actions runner ≥ v2.327.1)
• Introduced automatic caching when a packageManager field is present in package.json

v6.0.0

• Automatic caching is now limited to npm only — other package managers (yarn, pnpm) no longer get automatic cache behavior

Assessment

The changes look good for this use case:

• Scope is limited: The step only runs for non-single-user modes (if: matrix.mode != 'single-user') to build the Astrolabe frontend app using npm ci + npm run build.
• npm-only caching restriction (v6) is a non-issue: This workflow uses npm, so the breaking caching change in v6 doesn't apply.
• node-version: 24 is unchanged and compatible with v6.
• Commit SHA pinning is maintained (53b83947...), which is the correct security practice for this repo.
• No cache or package-manager-cache inputs are set, so the automatic caching change in v5 won't unexpectedly alter behavior unless package.json in third_party/astrolabe has a packageManager field.

Minor Observation

Worth a quick sanity check: if third_party/astrolabe/package.json contains a packageManager field (e.g., "packageManager": "npm@..."), v5+ will now auto-cache npm dependencies in the Build Astrolabe app step. This is generally desirable (speeds up CI) but worth being aware of as a behavioral change. If unwanted, add package-manager-cache: false under with:.

Verdict

✅ Safe to merge. Low-risk dependency bump with no functional impact on the tested workflows.