Update actions/setup-node action to v6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v4 → v6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/setup-node (actions/setup-node)

v6

Compare Source

v5

Compare Source

---

Configuration

📅 Schedule: Branch creation - "after 2am and before 8am on monday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

actions/setup-node v4 -> v6

Risk: 🟢 Safe | CI: Passing | Confidence: High

The Deep Dive

Update Scope

• actions/setup-node: v4 -> v6 (via floating v6 tag, currently pointing to v6.3.0)
• This is a major version jump spanning two major releases (v4 -> v5 -> v6)
• Only one file is affected: .claude/skills/renovate-eval/action.yaml, which uses this action solely to install Node.js 20 for running the Claude CLI

Features & UX

v5 breaking changes (not applicable):

• Automatic caching with packageManager detection (#1348): v5 auto-enables caching when package.json has a packageManager field. This repo has no packageManager field in any package.json, and the action does not use caching inputs. Not affected.
• Upgrade to Node 24 runtime (#1325): The action itself runs on Node 24 internally. Requires runner v2.327.1+. GitHub-hosted runners are already on a compatible version. No impact.

v6 breaking changes (not applicable):

• Limit automatic caching to npm only (#1374): Auto-caching (from v5) now only applies to npm. Since this repo has no packageManager field and doesn't use caching, not affected.

v6.1.0 - v6.3.0 enhancements:

• Removed always-auth configuration handling (#1436) - not used by this action
• Support for devEngines field parsing (#1283) - only relevant when using node-version-file: package.json, not used here
• Mirror URL bearer token fix (#1467) - not using mirror-url

Security

No security advisories filed against actions/setup-node in this version range. The v5 release included an upgrade to form-data fixing a critical vulnerability in the action's own dependencies (#1332).

Key Fixes

No bug fixes relevant to this deployment's usage pattern (simple node-version: '20' without caching or mirror URLs).

Newer Versions

The v6 floating tag currently points to v6.3.0, which is the latest release. No newer versions exist. No regressions identified in the v6.x line.

Hazards & Risks

None identified. The action is used in its simplest form -- just setting up Node.js 20 with no caching, no node-version-file, no always-auth, no mirror-url. Both major version breaking changes (v5 auto-caching, v6 caching scope limits) are entirely about caching behavior that this deployment does not use.

Sources

• v5.0.0 release notes
• v6.0.0 release notes
• v6.1.0 release notes
• v6.2.0 release notes
• v6.3.0 release notes
• v5 auto-caching PR
• v6 caching limit PR

---

🟢 Verdict: Safe

This is a straightforward infrastructure action update. The breaking changes in v5 and v6 relate to caching behavior that this deployment does not use -- the action only sets up Node.js 20 with no other options. All CI checks pass.