release: v1.31.0

[sonukapoor]

Release v1.31.0.

Added

• HTML report: package names in the findings table now link directly to the npm registry page (feat: link package names to npm in html report #1021, @bharatmalik-cs)

Fixed

• GitHub Action: scan step now truly informational when fail-on is not configured - the CLI's internal default was applying even when the action input was empty, causing exit 1 on criticals regardless of intent; split into three paths so only real errors propagate in the no-fail-on case; same fix applied to the overrides audit step; reachesFailOn now returns false for empty failOn (fix: make action scan informational when fail-on is not configured #1048, closes fix: action scan fails on criticals when fail-on is not configured #1047)
• Scanner: findFirstFixedVersion scoped to the package being evaluated, preventing a multi-package advisory from surfacing a fix version meant for a different package (fix(scanner): scope findFirstFixedVersion to the package being scanned #1044, @vaibhav8a, closes findFirstFixedVersion ignores package identity: multi-package advisories leak fixed versions across packages #1042)
• pnpm v9: strip leading slash from package keys in pnpm-lock.yaml (fix(pnpm): strip leading slashes from pnpm v9 package keys #1014, @Kunal241207, closes [Bug] pnpm v9 package keys starting with leading slash bypass vulnerability scanning #1012)
• Flag validation: conflict and missing-argument errors now include the correct flag name and a concrete suggestion (fix: improve flag validation guidance #1022, @Anikesh348, closes fix: incompatible flag errors should explain which option to use, not just state the conflict #401)

Tests

• Add SARIF fingerprint hash coverage (Add SARIF fingerprint hash tests #1045, @ramcharan07-gh)

Docs

• CLI reference: document --create-pr, --base, and --debug flags (docs: add --create-pr, --base, and --debug flags to CLI reference #998, @Kakashi15-pix, closes docs: document --base, --create-pr, and --debug in the CLI reference #993)