release: v1.20.0

[sonukapoor]

Bumps version to 1.20.0 and updates CHANGELOG and docusaurus version badge.

Added

• --create-pr flag: after --fix, commits lockfile changes and opens a GitHub PR via gh with a descriptive title listing upgraded packages and vulnerability count (feat: add --create-pr flag to open GitHub PR after --fix #518)
• --base <branch> flag to set the base branch for --create-pr (default: main)
• Bun parser updated to reconstruct transitive paths from package relationships; within-range remediation now works for Bun lockfiles (Feature/bun within range fixture #562)
• pnpm-within-range, deep-chain-no-fix, pnpm-aliased-chain regression fixtures (Add pnpm-within-range regression fixture (#528) #557, Add deep-chain-no-fix regression fixture (#528) #558, Add pnpm-aliased-chain regression fixture (#528) #559)
• CamoFox Browser case study (Add CamoFox Browser lockfile example and verified case study #556)
• mal-private-registry example fixture (fix: mark MAL- advisories as unverifiable when package resolves from a private registry #588)

Fixed

• Yarn Classic parser now reconstructs full transitive dependency paths; within-range resolver correctly suggests yarn upgrade <pkg> for deep chains (fix: reconstruct transitive dependency paths from yarn.lock (#421). #576)
• MAL- advisories for packages resolved from a private registry now surface as "Unverifiable (private source)" instead of a false-positive "Malicious" finding (fix: mark MAL- advisories as unverifiable when package resolves from a private registry #588)

Validation

• npm test (428/428)
• npm run build