v1.32.0 - License scanning, EPSS scores, and broader CVE coverage

Added

• `--check-licenses` flag: detect copyleft (LC001: GPL-2.0/3.0, AGPL-3.0, LGPL, EUPL, OSL, CDDL, CPL, EPL) and unknown (LC002: no declared license) licenses across the dependency tree in the same pass as the CVE scan. Informational only - never affects exit code or `--fail-on`. Surfaces in terminal, JSON, SARIF, and HTML reports. GitHub Action gains `check-licenses` input
• EPSS scores: findings are enriched with FIRST.org Exploit Prediction Scoring System data after the OSV pass. Highest-EPSS score shown in terminal top-3 block, verbose table column, and HTML report detail panel; full array in JSON output. Skipped in offline mode and for GHSA-only findings
• npm advisory secondary source: packages with zero OSV matches are checked against the npm registry advisory API, closing the coverage gap for CVEs that exist in OSV but have no npm ecosystem mapping. Skips in offline mode, non-fatal on error
• `--incomplete-policy warn|error` (default: `warn`): control exit behavior when detection data is incomplete. `error` exits 3. GitHub Action gains `incomplete-policy` input

Fixed

• Direct parent version collision: same package installed at multiple versions could produce wrong `currentVersion` baselines and downgrade suggestions in the transitive remediation output

Tests

• Add unit coverage for `src/utils/advisory.ts`

Docs

• README comparison table rows now link to their corresponding docs pages
• Comparison tables, homepage, and workflow guide updated for `--check-licenses`
• Data source descriptions updated to reflect OSV + npm advisory API dual-source approach

Validation

• npm test
• npm run build

Contributors

@luojiyin1987, @suhanemathur