[anurag629]

What and why

Six Dependabot alerts opened on toolbelt today (#79 to #84), and npm audit flags a seventh that has no alert yet:

• body-parser 2.3.0 (high), pulled in by express through @opennextjs/aws. Fixed in 2.4.0.
• undici 6.29.0 and 7.29.1 (two high, three medium). Fixed in 6.29.1 and 7.30.1.
• zod 4.6.5 (high, GHSA-mrhx-c7xc-m3w5), only used by eslint-plugin-react-hooks. Fixed in 4.6.6, this takes 4.6.7.

body-parser, the 6.x undici (from @dotenvx/dotenvx) and zod only needed a lockfile refresh. The 7.x undici is pinned to exactly 7.29.1 by miniflare, and the newest wrangler (4.152.0) still ships a miniflare with that pin, so this adds a version-scoped override, "undici@7": "^7.30.1", which leaves the 6.x copy alone. A nested "miniflare": { "undici": ... } or "wrangler": { "undici": ... } override didn't change anything here, npm kept 7.29.1.

None of these packages end up in the deployed Worker (nothing under .open-next references body-parser or undici). They come from the build, lint and local preview tooling.

This also covers #354, Dependabot's body-parser bump, which should close on its own once this is in.

How I tested this

• npm ci on Node 22 from the new lockfile. npm ls shows body-parser 2.4.0, undici 6.29.1 under dotenvx, undici 7.30.1 (overridden) under miniflare and zod 4.6.7, with nothing invalid, and npm audit reports 0 vulnerabilities.
• npm run lint (0 errors, the same 11 warnings as develop), npm run test (1275 passed), the OpenNext build, and CI's page check, which serves the Worker through wrangler dev and so runs miniflare on the new undici.