release: v1.32.0

[sonukapoor]

Release v1.32.0.

Added

• --incomplete-policy warn|error: control exit behavior when scan data is incomplete; GitHub Action gains matching input (feat(completeness): add --incomplete-policy to control exit behavior on incomplete scan data #1019, @luojiyin1987)
• EPSS scores: findings enriched with FIRST.org exploit prediction data, shown in terminal, HTML report, and JSON (feat: enrich findings with EPSS scores from FIRST.org #1053)
• npm advisory secondary source: packages with zero OSV matches are now checked against the npm registry advisory API, closing coverage gaps for CVEs without npm ecosystem mappings (feat: add npm advisory API as supplemental vulnerability source #1056)
• --check-licenses: detect copyleft (LC001) and unknown (LC002) licenses in the same pass as the CVE scan; informational only (feat: add --check-licenses flag for copyleft and unknown license detection #1059)

Fixed

• Direct parent version collision: same package installed at multiple versions could produce wrong currentVersion baselines and downgrade suggestions (fix: direct parent version collision when same package installed at multiple versions #1051)

Tests

• Unit coverage for src/utils/advisory.ts (test: add unit coverage for src/utils/advisory.ts #1046, @suhanemathur)

Docs

• README comparison table rows now link to their docs pages (docs: link comparison table rows to their docs pages in README #1064)
• Comparison tables, homepage, and workflow guide updated for --check-licenses (docs: add license scanning row to comparison table in README #1061)
• Data source descriptions updated for OSV + npm advisory dual-source approach (docs: update vulnerability data source descriptions to include npm advisory API #1062)

Validation

• npm test: 1617 passed
• npm run build: clean

Closes #1063, #1058, #1057, #1060, #1054, #1050, #1024, #898