v1.31.0 - Action informational mode, npm links in HTML report

Added

• HTML report: package names in the findings table now link directly to the npm registry page (#1021, @bharatmalik-cs)

Fixed

• GitHub Action: scan step now truly informational when fail-on is not configured - the CLI's internal default was applying even when the action input was empty, causing exit 1 on criticals regardless of intent; split into three paths so only real errors propagate in the no-fail-on case; same fix applied to the overrides audit step; reachesFailOn now returns false for empty failOn
• Scanner: findFirstFixedVersion scoped to the package being evaluated, preventing a multi-package advisory from surfacing a fix version meant for a different package in the same advisory (@vaibhav8a, closes #1042)
• pnpm v9: strip leading slash from package keys in pnpm-lock.yaml (@Kunal241207, closes #1012)
• Flag validation: conflict and missing-argument errors now include the correct flag name and a concrete suggestion (@Anikesh348, closes #401)

Tests

• Add SARIF fingerprint hash coverage (@ramcharan07-gh)

Docs

• CLI reference: document --create-pr, --base, and --debug flags (@Kakashi15-pix, closes #993)

Validation

• npm test
• npm run build

Contributors

@bharatmalik-cs, @vaibhav8a, @Kunal241207, @Anikesh348, @ramcharan07-gh, @Kakashi15-pix