From 617f73c825a08022cf6345b9ed87c8ff39ef8ef0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 14 Oct 2026 09:20:20 +0000
Subject: [PATCH 1/3] build(deps): bump actions/cache from 4 to 6

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f7a1fbe8..985bcd87 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -169,7 +169,7 @@ jobs:
       - name: "Restore generated radio search index"
         id: search_cache
         if: steps.scope.outputs.prerender == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: public/search/stations.json
           key: ${{ runner.os }}-onair-search-v1-${{ hashFiles('public/radio/**/*.json', 'utils/featured-stations.mjs', 'scripts/build-station-search-index.mjs') }}
@@ -177,7 +177,7 @@ jobs:
       - name: "Restore generated social preview"
         id: social_cache
         if: steps.scope.outputs.prerender == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: public/brand/social-preview.png
           key: ${{ runner.os }}-onair-social-v1-${{ hashFiles('public/brand/social-preview.svg', 'scripts/generate-social-preview.mjs', 'package-lock.json') }}

From 03e8edf66acbf98ad60bc1d75d694460f5a1ab69 Mon Sep 17 00:00:00 2001
From: David Nguyen <h250694@gmail.com>
Date: Thu, 15 Oct 2026 11:57:52 +0700
Subject: [PATCH 2/3] security: scrub credentials from env example

---
 .env.example | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.env.example b/.env.example
index 59d6071e..842915a7 100644
--- a/.env.example
+++ b/.env.example
@@ -16,22 +16,22 @@ CORS_SERVER_3="https://cors.eplus.dev/"
 CORS_SERVER_4="https://e-cors.netlify.app/"
 NUXT_PUBLIC_API_FRESHPING="https://api.freshping.io/v1/"
 # Algolia
-ALGOLIA_APPLICATION_ID="N87NFQVY0Z"
-ALGOLIA_API_KEY="73e93ee2ef3aa6919b7c6495767c7f9d"
-ALGOLIA_WRITE_API_KEY="73e93ee2ef3aa6919b7c6495767c7f9d"
-# ALGOLIA_APPLICATION_ID="P2IANQRBXJ"
-# ALGOLIA_API_KEY="59f763506ceef787c76d64a6d407cc49"
-# ALGOLIA_WRITE_API_KEY="0b650d5ddd09a3b296db220d2544ae18"
+ALGOLIA_APPLICATION_ID=
+ALGOLIA_API_KEY=
+ALGOLIA_WRITE_API_KEY=
+# ALGOLIA_APPLICATION_ID=
+# ALGOLIA_API_KEY=
+# ALGOLIA_WRITE_API_KEY=
 # Zing Server
 NUXT_PUBLIC_API_ZING_LIVE_STREAM_PROGRAM_DETAIL="https://zing.eplus.dev/api/live-stream-program-detail?id="
 NUXT_PUBLIC_API_ZING_GET_LYRIC="https://zing.eplus.dev/api/lyric?id="
 # Cloudinary
 CLOUDINARY_NAME="eplus-dev"
-CLOUDINARY_API_KEY="854137316289745"
-CLOUDINARY_API_SECRET="DfxLkt8brnb-AqyMiALNtW0Hnqw"
+CLOUDINARY_API_KEY=
+CLOUDINARY_API_SECRET=
 NUXT_PUBLIC_CLOUDINARY_BASE_URL="http://localhost:3000"
 # DigitalOcean
 NUXT_PUBLIC_DIGITALOCEAN_ENDPOINT="https://api.digitalocean.com/v2/apps/7cebe9c4-324f-4d47-a41f-ebfe3baedaf6/deployments?page=1&per_page=1"
-NUXT_PUBLIC_DIGITALOCEAN_API_KEY="dop_v1_d8ceeb4ae52c6632602dab89d251eacecfe8a6e75c406e2c69ca3c42ed46d8e5"
+NUXT_PUBLIC_DIGITALOCEAN_API_KEY=
 # Sitemap
 NUXT_PUBLIC_SITE_URL="http://localhost:3000"
\ No newline at end of file

From d136ffac9121e61b201652ec8a9c90ea7721e475 Mon Sep 17 00:00:00 2001
From: David Nguyen <h250694@gmail.com>
Date: Sun, 18 Oct 2026 08:23:17 +0700
Subject: [PATCH 3/3] chore(deps): defer unsolicited npm version PRs during
 backlog cleanup

---
 .github/dependabot.yml | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 16460ece..0bc378d0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,20 +10,3 @@ updates:
       interval: "weekly"
     labels:
       - "dependencies"
-
-  # Keep runtime/frontend dependencies visible to maintainers without
-  # opening dozens of near-identical public dependency PRs.
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    groups:
-      minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-    labels:
-      - "dependencies"