- render_sarif() maps each Signal to a SARIF result, rules deduped by kind
- Severity -> level: critical/high = error, medium = warning, low/info = note
- Evidence file/line become physicalLocation so GitHub code scanning
renders inline source links
- --format sarif on scan and diff subcommands
Recursive dependency-tree scanning for npm and PyPI, a security-scored
version-diff engine, baseline-vs-self deviation detection, and forensics
for unpublished (yanked) versions reconstructed from CDN archives.
Stdlib-only Python 3.11+.
