Release v1.1.0: Severity thresholds, warn mode, monorepos and inline annotations · NPMscan/npmscan-action

Catch risky npm dependency changes before they merge, now with control over what blocks.

@v1 points to this release, so existing workflows get it automatically. No changes needed.

New

mode: warn: report findings without failing the check. Try npmscan for a week, then switch to mode: block.
fail-on-severity: choose the lowest vulnerability severity that blocks (low, moderate, high, critical, or none).
fail-on-install-script and fail-on-source-change: turn each check on or off.
fail-on-error (default false): if npmscan.com is unreachable, the step warns instead of failing, so an outage never blocks your merges.
files: scan several lockfiles in one step. All results go into one PR comment, which is useful for monorepos.
Inline annotations: each finding is marked on its line in package.json, package-lock.json, yarn.lock or pnpm-lock.yaml.
New outputs: blocking-count and error-count.

New dependencies that have install scripts are now shown in the table. Before, they were counted but hidden.
Changes to your own root preinstall/install/postinstall/prepare scripts and to overrides/resolutions get their own tables.
A collapsible list of advisories shows the fixed version for each one.
A warning appears when results are partial.

npmscan only edits its own PR comment. Before, it could overwrite another bot's comment.
Several npmscan steps in one workflow each keep their own comment.
A lockfile added in the PR is compared against an empty lockfile of the same type.
Package names and script contents from the PR are escaped in the comment.
Clearer messages when the comment can't be posted, for example on Dependabot PRs without pull-requests: write, or on PRs from forks.