From cc3a3b7897a92fb5075c99443d04c882c3cf15a4 Mon Sep 17 00:00:00 2001 From: O M Date: Tue, 13 Oct 2026 18:58:58 -0400 Subject: [PATCH 1/2] Add honest comparisons against Prowler, Cartography, and BloodHound. People already search for a Prowler alternative and a self-hosted CNAPP. These pages answer those queries with the limit of each tool, instead of a generic scanning table. Co-authored-by: Cursor --- scripts/content-dates.mjs | 8 +- scripts/content-dates.test.mjs | 4 +- src/components/CompareSection.astro | 10 + src/components/Footer.astro | 2 + .../blog/open-source-cspm-cnapp-tools-2026.md | 26 +- src/pages/docs/getting-started.astro | 2 + src/pages/docs/open-source.astro | 2 + src/pages/prowler-alternative.astro | 268 ++++++++++++++ src/pages/self-hosted-cnapp.astro | 343 ++++++++++++++++++ 9 files changed, 647 insertions(+), 18 deletions(-) create mode 100644 src/pages/prowler-alternative.astro create mode 100644 src/pages/self-hosted-cnapp.astro diff --git a/scripts/content-dates.mjs b/scripts/content-dates.mjs index 73aaad5..6ed424e 100644 --- a/scripts/content-dates.mjs +++ b/scripts/content-dates.mjs @@ -19,10 +19,12 @@ const DATE_RE = /^(\d{4}-\d{2}-\d{2})/; /** @type {Record} */ export const STATIC_LASTMOD = { - '/': '2026-08-24', + '/': '2026-10-13', + '/self-hosted-cnapp/': '2026-10-13', + '/prowler-alternative/': '2026-10-13', '/contact/': '2026-08-26', '/docs/': '2026-09-28', - '/docs/getting-started/': '2026-09-28', + '/docs/getting-started/': '2026-10-13', '/docs/configuration/': '2026-09-28', '/docs/the-graph/': '2026-09-28', '/docs/schema/': '2026-09-28', @@ -46,7 +48,7 @@ export const STATIC_LASTMOD = { '/docs/docker/': '2026-09-28', '/docs/kubernetes/': '2026-09-28', '/docs/security/': '2026-09-28', - '/docs/open-source/': '2026-09-28', + '/docs/open-source/': '2026-10-13', }; /** diff --git a/scripts/content-dates.test.mjs b/scripts/content-dates.test.mjs index 92045ee..1de657b 100644 --- a/scripts/content-dates.test.mjs +++ b/scripts/content-dates.test.mjs @@ -37,7 +37,9 @@ test('indexed blogs have lastmod and /blog/ uses the newest', () => { const lastmodByPath = buildLastmodByPath(); const newest = entries.reduce((acc, entry) => maxIsoDate(acc, entry.lastmod), '1970-01-01'); assert.equal(lastmodByPath.get('/blog/'), newest); - assert.equal(lastmodByPath.get('/'), '2026-08-24'); + assert.equal(lastmodByPath.get('/'), '2026-10-13'); + assert.equal(lastmodByPath.get('/self-hosted-cnapp/'), '2026-10-13'); + assert.equal(lastmodByPath.get('/prowler-alternative/'), '2026-10-13'); const sample = entries.find((entry) => entry.slug === 'agentless-vs-agent-cloud-security'); assert.ok(sample); diff --git a/src/components/CompareSection.astro b/src/components/CompareSection.astro index 2bd7663..1a1a60e 100644 --- a/src/components/CompareSection.astro +++ b/src/components/CompareSection.astro @@ -48,6 +48,11 @@ const rows = [ )) } +

+ Prowler vs OpenSourceOM is the Prowler alternative + comparison. Cartography and BloodHound are compared as a + self-hosted CNAPP. +

@@ -102,6 +107,11 @@ const rows = [ background: var(--gradient); } + .compare-more { + margin: 1.5rem 0 0; + color: var(--text-muted); + } + @media (min-width: 768px) { .compare-header { display: grid; diff --git a/src/components/Footer.astro b/src/components/Footer.astro index dee6f48..7db0ba8 100644 --- a/src/components/Footer.astro +++ b/src/components/Footer.astro @@ -21,6 +21,8 @@ const licenseUrl = 'https://github.com/OpenSourceOM/website/blob/main/LICENSE';
  • Security graph
  • Architecture
  • Open source scope
    • +
  • Prowler alternative
    • +
  • Self-hosted CNAPP
  • Contact
  • Core repo
  • License
    • diff --git a/src/content/blog/open-source-cspm-cnapp-tools-2026.md b/src/content/blog/open-source-cspm-cnapp-tools-2026.md index 2465a5f..eff480d 100644 --- a/src/content/blog/open-source-cspm-cnapp-tools-2026.md +++ b/src/content/blog/open-source-cspm-cnapp-tools-2026.md @@ -2,7 +2,7 @@ title: "Open Source CSPM and CNAPP Tools in 2026: What Exists Today" description: "Survey of open source CSPM, self-hosted CNAPP alternatives, and graph-native cloud security tools in 2026 — plus how to evaluate self-hosted options for your team." pubDate: 2026-08-24 -updatedDate: 2026-08-24 +updatedDate: 2026-10-13 author: OpenSourceOM Team tags: - open source CSPM @@ -43,7 +43,7 @@ No single mature OSS project clones every proprietary CNAPP feature yet. Instead | Project / category | Strength | Gap vs. CNAPP | |--------------------|----------|----------------| | Policy engines (OPA, Cloud Custodian) | Flexible policy-as-code | No unified graph or path analysis | -| Multi-cloud scanners (Prowler, ScoutSuite) | Broad AWS/Azure/GCP checks | Flat findings lists | +| Multi-cloud scanners (Prowler, ScoutSuite) | Broad AWS/Azure/GCP checks | Findings lists. Prowler App can add an AWS attack-path graph via Cartography | | IaC scanners (Checkov, tfsec) | Shift-left | Pre-deploy only | These are excellent for **misconfiguration detection** — the CSPM layer — but they rarely answer *"Which of these 500 findings sits on a path to prod data?"* @@ -69,7 +69,7 @@ The differentiator for **self-hosted CNAPP**-like experiences is the **security | Finding enrichment | CVEs and misconfigs on graph nodes | | Path queries | Prioritize by attack path, not severity | -**[OpenSourceOM](https://opensourceom.org)** is building this layer openly: collectors, graph engine, CSPM rules with path context, Apache-2.0 licensed, self-hosted. Status: early development — see [roadmap on GitHub](https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md). +**[OpenSourceOM](/prowler-alternative/)** is that layer, self-hosted and Apache-2.0: collectors, a Postgres graph, and CSPM rules scored by path. [Prowler vs OpenSourceOM](/prowler-alternative/) is the Prowler alternative comparison. Cartography and BloodHound are on [self-hosted CNAPP](/self-hosted-cnapp/). Phase 3 has shipped — see the [roadmap on GitHub](https://github.com/OpenSourceOM/core/blob/main/docs/ROADMAP.md). ## Proprietary CNAPP vs. open source stack @@ -112,19 +112,17 @@ Promises vs. shipped features — especially for attack path and UI. ## Reference architecture: composable OSS cloud security +Prowler and OpenSourceOM stay separate tools. OpenSourceOM does not ingest a Prowler report. + ``` -┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐ -│ CSPM scanner │────▶│ Graph / normalizer│────▶│ Path queries + │ -│ (Prowler, etc.) │ │ (OpenSourceOM) │ │ prioritization │ -└─────────────────┘ └──────────────────┘ └─────────────────┘ - │ ▲ - │ ┌────────┴────────┐ - │ │ IAM + inventory │ - └───────────────│ collectors │ - └─────────────────┘ +┌─────────────────┐ ┌──────────────────┐ +│ CSPM scanner │ │ Security graph │ +│ (Prowler) │ │ (OpenSourceOM) │ +└─────────────────┘ └──────────────────┘ + compliance workbook ranked attack paths ``` -Start with one CSPM scanner + graph platform; add CIEM and CWPP feeds over time. +Run Prowler for the framework mapping and OpenSourceOM for the queue. Add CIEM and CWPP feeds over time. ## When open source is the wrong fit @@ -150,4 +148,4 @@ Even then, **open source CSPM** scanners can supplement vendor tools for second --- -**Related:** [CSPM vs CNAPP](/blog/cspm-vs-cnapp-whats-the-difference/) · [Attack path analysis](/blog/attack-path-analysis-cloud-security/) +**Related:** [Prowler vs OpenSourceOM](/prowler-alternative/) · [Self-hosted CNAPP, Cartography, and BloodHound](/self-hosted-cnapp/) · [CSPM vs CNAPP](/blog/cspm-vs-cnapp-whats-the-difference/) · [Attack path analysis](/blog/attack-path-analysis-cloud-security/) diff --git a/src/pages/docs/getting-started.astro b/src/pages/docs/getting-started.astro index 79d8c81..b45d23d 100644 --- a/src/pages/docs/getting-started.astro +++ b/src/pages/docs/getting-started.astro @@ -20,6 +20,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro'; }, ]} related={[ + { href: '/prowler-alternative/', label: 'Prowler vs OpenSourceOM' }, + { href: '/self-hosted-cnapp/', label: 'Self-hosted CNAPP, Cartography, BloodHound' }, { href: '/blog/open-source-cspm-cnapp-tools-2026/', label: 'Open-source CSPM and CNAPP tools' }, { href: '/blog/self-hosted-cspm-architecture/', label: 'Self-hosted CSPM architecture' }, { href: '/docs/the-graph/', label: 'How the security graph works' }, diff --git a/src/pages/docs/open-source.astro b/src/pages/docs/open-source.astro index 23d2191..4a47d75 100644 --- a/src/pages/docs/open-source.astro +++ b/src/pages/docs/open-source.astro @@ -20,6 +20,8 @@ import DocsLayout from '@/layouts/DocsLayout.astro'; }, ]} related={[ + { href: '/prowler-alternative/', label: 'Prowler vs OpenSourceOM' }, + { href: '/self-hosted-cnapp/', label: 'Self-hosted CNAPP, Cartography, BloodHound' }, { href: '/blog/open-source-cspm-cnapp-tools-2026/', label: 'Open-source CSPM and CNAPP tools' }, { href: '/blog/cspm-vs-cnapp-whats-the-difference/', label: 'CSPM vs CNAPP' }, ]} diff --git a/src/pages/prowler-alternative.astro b/src/pages/prowler-alternative.astro new file mode 100644 index 0000000..bf06e9d --- /dev/null +++ b/src/pages/prowler-alternative.astro @@ -0,0 +1,268 @@ +--- +// Copyright 2026 OpenSourceOM +// SPDX-License-Identifier: Apache-2.0 +import BaseLayout from '@/layouts/BaseLayout.astro'; + +const faq = [ + { + question: 'Is OpenSourceOM a Prowler alternative?', + answer: + 'For a ranked queue, yes. Prowler reports which controls failed, and that catalog is larger. OpenSourceOM scores each CSPM finding in the same run: internet reachability, a path to a datastore, and admin access, across AWS, Azure, GCP, and Kubernetes in one Postgres graph. If the deliverable is the compliance workbook, keep Prowler.', + }, + { + question: 'Does Prowler have attack paths?', + answer: + 'Prowler App does, for AWS. After an AWS scan it loads inventory with Cartography into Neo4j or Neptune, attaches finding nodes, and runs openCypher queries for exposure, misconfigurations, and privilege escalation. Other providers are planned. OpenSourceOM ships six named walks in the same Postgres database as the findings, including internet-to-datastore, on AWS, Azure, GCP, and Kubernetes.', + }, + { + question: 'Can OpenSourceOM import a Prowler report?', + answer: + 'No. Scans use the OpenSourceOM collectors. A Prowler report is not an input. The two tools can run side by side: Prowler for the control catalog, OpenSourceOM for the path score.', + }, + { + question: 'Which tool has more compliance checks?', + answer: + 'Prowler. Its catalog covers thousands of controls across AWS, Azure, GCP, Kubernetes, and other providers, mapped to CIS and other frameworks. OpenSourceOM’s CSPM catalog is smaller. The difference is that each OpenSourceOM finding is scored from the graph in the same run.', + }, +]; + +const pageTitle = 'Prowler alternative: Prowler vs OpenSourceOM'; +const description = + 'OpenSourceOM is a Prowler alternative when the queue should be ranked by attack path. Prowler vs OpenSourceOM: checks, graphs, and when to keep both.'; +const canonical = new URL('/prowler-alternative/', Astro.site).href; + +const jsonLd = [ + { + '@context': 'https://schema.org', + '@type': 'WebPage', + name: pageTitle, + description, + url: canonical, + isPartOf: { '@type': 'WebSite', name: 'OpenSourceOM', url: Astro.site?.href }, + }, + { + '@context': 'https://schema.org', + '@type': 'FAQPage', + mainEntity: faq.map((item) => ({ + '@type': 'Question', + name: item.question, + acceptedAnswer: { '@type': 'Answer', text: item.answer }, + })), + }, +]; +--- + + +
    +
    +

    Prowler alternative

    +

    Prowler vs OpenSourceOM

    +
    +

    + People searching for a Prowler alternative usually have the findings list + and want the next question answered: which failure can an outsider walk to a datastore? + Prowler is the check catalog. + OpenSourceOM is the self-hosted graph that scores a finding because it sits on a path. + This page is an independent comparison. Prowler is a separate project. +

    +
    + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    AspectProwlerOpenSourceOM
    QuestionWhich controls failed on this resource?Which finding sits on a path from the internet to data?
    OutputA findings list, mapped to CIS and other frameworks.A queue scored in the same run as the scan.
    CatalogThousands of checks across AWS, Azure, GCP, Kubernetes, and other providers.A smaller CSPM catalog. Each finding is scored from the graph.
    Attack paths + Prowler App, after an AWS scan: Cartography into Neo4j or Neptune, then openCypher. + Other providers are planned. + + Six named walks in the same Postgres graph. + internet-to-datastore sorts the queue on AWS, Azure, GCP, and Kubernetes. +
    ScorePass or fail on the check. The finding is stored beside the scan. + Base score, then +10 for internet reachability, +25 for a path to a datastore, and +5 + for admin access, capped at 100. +
    Where it runsThe CLI and Prowler App can be self-hosted. Prowler Cloud is their SaaS.Self-hosted only. Postgres, the API, the CLI, and the console. Apache-2.0.
    +
    + +
    +

    What Prowler is for

    +

    + Prowler answers the compliance + question. Each result is a control, a resource, and a pass or fail, mapped to CIS and the + other frameworks. That workbook is why teams run it, and the catalog is larger than + OpenSourceOM’s. Both projects are Apache-2.0. The license is not the difference. +

    +

    + Prowler App can go further after an AWS scan. It loads inventory with Cartography into + Neo4j or Neptune, attaches finding nodes, and lets you + query attack paths + in openCypher: exposure, misconfigurations, and privilege-escalation chains. + Attack Paths is AWS today. + Support for other providers is planned. The finding is still a check result. The graph is + a second database you query, and the check itself is not rescored by the path. +

    + +

    What OpenSourceOM changes

    +

    + OpenSourceOM is the alternative when the score should come from the path in the same run. + A rule starts from a base score. + Internet reachability adds 10, a path to a datastore adds 25, and admin access adds 5, + capped at 100. A public bucket on a path to data outranks the same rule on an isolated + bucket. AWS, Azure, GCP, and Kubernetes land in one Postgres graph. +

    +

    + The walks are named. + om paths list prints six names. + The one that sorts a weekly queue is internet-to-datastore: from the internet, + through a workload, ending on a datastore. There is no query language. A question you still + have to write in Cypher belongs in Prowler App or + Cartography. +

    +

    + Scans use the OpenSourceOM collectors. A Prowler report is not an input. You operate + Postgres, the API, the CLI, and the console. Runtime agents, SAML, and multi-tenant RBAC + sit outside the open-source core. +

    + +

    Which to run

    +
      +
    • A compliance workbook with hundreds of controls: Prowler.
      • +
    • openCypher over an AWS inventory after the scan: Prowler App attack paths.
      • +
    • + Which cloud finding sits on a path from the internet to data, on a host you operate: + OpenSourceOM. +
      • +
    +

    + They can run beside each other. Prowler keeps the framework mapping. OpenSourceOM keeps + the ranked queue. +

    +

    + Cartography and BloodHound answer different questions again. That three-tool map is the + self-hosted CNAPP page. +

    +

    + Get started +

    +
    + +
    +

    Questions

    + { + faq.map((item) => ( +
    +

    {item.question}

    +

    {item.answer}

    +
    + )) + } +
    +
    +
    +     + + diff --git a/src/pages/self-hosted-cnapp.astro b/src/pages/self-hosted-cnapp.astro new file mode 100644 index 0000000..17652ba --- /dev/null +++ b/src/pages/self-hosted-cnapp.astro @@ -0,0 +1,343 @@ +--- +// Copyright 2026 OpenSourceOM +// SPDX-License-Identifier: Apache-2.0 +import BaseLayout from '@/layouts/BaseLayout.astro'; + +const faq = [ + { + question: 'How is OpenSourceOM different from Cartography?', + answer: + 'Cartography stores a Neo4j graph and lets you write Cypher. OpenSourceOM stores a Postgres graph and ships six named walks, then ranks findings that sit on them. A question you have not named yet belongs in Cartography.', + }, + { + question: 'What is a self-hosted CNAPP?', + answer: + 'A self-hosted CNAPP runs collection and correlation in your infrastructure. OpenSourceOM covers the security graph, CSPM, and attack-path parts of that, under Apache-2.0. You operate Postgres, the API, the CLI, and the console. Runtime agents, SAML, and multi-tenant RBAC are outside the open-source core.', + }, + { + question: 'What are open-source attack paths?', + answer: + 'An attack path is a walk from an entry point to something an attacker wants. Cartography stores a Neo4j graph and lets you write Cypher. OpenSourceOM stores a Postgres graph and ships six named walks, then ranks findings that sit on them. BloodHound walks identity edges in Active Directory and Entra ID.', + }, + { + question: 'How is OpenSourceOM different from BloodHound?', + answer: + 'BloodHound answers which principal can reach a high-value admin, through membership, sessions, and ACLs. That graph has an on-prem Active Directory shape, extended to Entra ID with AzureHound. OpenSourceOM answers which cloud finding an outsider can walk from the internet to a datastore. It does not collect on-prem Active Directory.', + }, +]; + +const canonical = new URL('/self-hosted-cnapp/', Astro.site).href; +const pageName = 'Self-hosted CNAPP and open-source attack paths'; + +const jsonLd = [ + { + '@context': 'https://schema.org', + '@type': 'WebPage', + name: pageName, + description: + 'Cartography stores a graph. BloodHound walks identity paths. Prowler lists findings. OpenSourceOM is a self-hosted CNAPP that ranks open-source attack paths.', + url: canonical, + isPartOf: { '@type': 'WebSite', name: 'OpenSourceOM', url: Astro.site?.href }, + }, + { + '@context': 'https://schema.org', + '@type': 'FAQPage', + mainEntity: faq.map((item) => ({ + '@type': 'Question', + name: item.question, + acceptedAnswer: { '@type': 'Answer', text: item.answer }, + })), + }, +]; +--- + + +
    +
    +

    Compare

    +

    {pageName}

    +
    +

    + People looking for a self-hosted CNAPP or open-source attack paths + already run one of three tools. + Prowler is the check catalog. + Cartography is a graph without a prioritized queue. + BloodHound is identity paths, in an on-prem Active Directory shape. + OpenSourceOM is the cloud graph that scores a finding because it sits on a path. +

    +
    + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ToolWhat you getWhere it stops
    Prowler + Thousands of compliance checks. A findings list, and in Prowler App an AWS attack-path + graph built with Cartography. + The graph is a second database, and today it is AWS.
    Cartography + A Neo4j graph of cloud and identity relationships, plus Cypher rules that return matches. + You pick the query. Matches are not a scored queue.
    BloodHound + Identity attack paths: which principal can reach a high-value one, through membership, + sessions, and ACLs. On-prem AD, and Entra ID via AzureHound. + + The nodes are principals. A public workload and a datastore are a different graph. +
    OpenSourceOM + A self-hosted Postgres graph. Six named attack paths. CSPM findings scored by internet + reachability, a path to a datastore, and admin access. AWS, Azure, GCP, and Kubernetes. + A smaller check catalog. No Cypher. No on-prem Active Directory.
    +
    + +
    +

    Prowler

    +

    + Prowler is the check catalog. Each result + is a control, a resource, and a pass or fail, mapped to CIS and the other frameworks. Prowler + App can also build an AWS attack-path graph with Cartography. The catalog is larger than + OpenSourceOM’s. The head-to-head, including when to keep both, is + Prowler vs OpenSourceOM. +

    + +

    Open-source attack paths

    +

    + Cartography syncs cloud, identity, + and SaaS APIs into Neo4j. Cartography Rules runs Cypher and prints the rows. You can ask + exposure and identity-to-data questions the schema supports, once you write or select the + query. Nothing in that pipeline turns the rows into “fix this one first.” +

    +

    + OpenSourceOM ships the walks. + om paths list prints six names. + The one that sorts a weekly queue is internet-to-datastore: from the internet, + through a workload, ending on a datastore. The same names are on the API and in the console. + There is no query language. A question you have not named yet belongs in Cartography. +

    + +

    BloodHound

    +

    + BloodHound walks identity paths in an on-prem + Active Directory shape: users, groups, computers, sessions, and ACLs. The question is which + principal can reach a high-value one. AzureHound collects Entra ID into that same shape. + Domain Admin and Global Admin paths belong here. +

    +

    + OpenSourceOM does not collect on-prem AD. Its walks start at the internet and end on a + datastore, through network and workload nodes. + Identity blast radius + is which cloud assets an identity can reach. +

    + +

    Self-hosted CNAPP

    +

    + Self-hosted means the collectors, Postgres, API, CLI, and console run in your environment. + The license is Apache-2.0. The slice in the open-source core is the security graph, CSPM + rules scored by path, the six named attack paths, and CVE enrichment from packages and + images already in inventory. Runtime agents, SAML, multi-tenant RBAC, and insider-threat + analysis sit + outside that core. + A longer map of the open-source landscape is the + 2026 CSPM and CNAPP survey. +

    + +

    Which one to run

    +
      +
    • + A compliance workbook with hundreds of controls: + Prowler. +
      • +
    • A Cypher question you still have to write: Cartography.
      • +
    • A path inside Active Directory or Entra ID: BloodHound.
      • +
    • + Which cloud finding sits on a path from the internet to data, on a host you operate: + OpenSourceOM. +
      • +
    +

    + Prowler and Cartography can run beside this. They answer a question the ranked queue does not. +

    +

    + Get started +

    +
    + +
    +

    Questions

    + { + faq.map((item) => ( +
    +

    {item.question}

    +

    {item.answer}

    +
    + )) + } +
    +
    +
    +     + + From 814255ecee3123e80aab8ee04c37148f0d722431 Mon Sep 17 00:00:00 2001 From: O M Date: Tue, 13 Oct 2026 19:04:58 -0400 Subject: [PATCH 2/2] Pin fflate to 0.7.5 so the Snyk high-severity scan can pass. satori still depends on 0.7.3, which has a decompression denial of service. The patched 0.7.5 release is a drop-in override. Co-authored-by: Cursor --- package-lock.json | 6 +++--- package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 208430d..303eb89 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3739,9 +3739,9 @@ } }, "node_modules/fflate": { - "version": "0.7.3", - "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.7.3.tgz", - "integrity": "sha512-0Zz1jOzJWERhyhsimS54VTqOteCNwRtIlh8isdL0AXLo0g7xNTfTL7oWrkmCnPhZGocKIkWHBistBrrpoNH3aw==", + "version": "0.7.5", + "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.7.5.tgz", + "integrity": "sha512-QieYf//cis6ywHNi5qW1+PXPQ4bC+XVJAtS4AXIML8P76GroEiOxm/oQtn1f02UkJY1+KsXMJcC+R2v/Eg4G3g==", "license": "MIT" }, "node_modules/file-uri-to-path": { diff --git a/package.json b/package.json index 1563e0f..aed6ba1 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,7 @@ "path-to-regexp": "6.3.0", "undici": "8.10.2", "fast-uri": "3.1.6", + "fflate": "0.7.5", "@vercel/analytics": "$@vercel/analytics", "@vercel/routing-utils": { "path-to-regexp": "6.3.0"