[YeungKC]

This PR fixes the open Dependabot alerts for dev dependencies. Runtime dependencies and the published API do not change. The built dist output is byte-for-byte the same as on main.

Packages

Package	From	To	Pulled in by
node-forge	1.4.0	1.4.2	devDependency (tests)
vitest, @vitest/coverage-v8	4.1.11	4.1.12	devDependency
@vitest/mocker	4.1.11	4.1.12	vitest
vite	8.2.2	8.3.5	vitest
undici	7.29.1	7.30.1	jsdom

Other lockfile changes come with these: the rest of the @vitest/* 4.1.12 packages, rolldown 1.2.16 and its platform bindings, @oxc-project/types, postcss 8.5.32, nanoid 3.3.20, chai 6.3.0, std-env 4.3.0, tinyrainbow 3.2.0, obug 2.2.1. They are all dev-only. No new package names enter the lockfile. Every new version was published at least 4 days ago.

node-forge 1.4.1 fixes GHSA-86w9-cpqp-85rv (see the forge changelog), so the alert closes although the advisory lists no patched version.

Not fixed

• follow-redirects: covered by the open Dependabot PR Bump follow-redirects from 1.16.0 to 1.16.1 in the npm_and_yarn group across 1 directory #514.
• deepmerge 4.2.0 - 4.3.1: no fixed version is published.

Test

Same results on this branch and on main:

• npm ci, npm run lint, tsc --noEmit: pass.
• npm test and npm run test:coverage: 202 passed, 16 skipped. Coverage numbers are the same.
• npm run build: passes. The dist file hashes are the same as on main.
• Smoke run of the built package: import the ESM, CJS and blaze entry points, create a MixinApi client, call uniqueConversationID. The export counts and output are the same.
• npm run size: dist/index.js is 83.94 kB against an 80 kB limit on both branches. This failure already exists on main.