release: v1.18.2

[sonukapoor]

Bumps version to 1.18.2 and updates CHANGELOG and docusaurus version badge.

Added

• --debug flag for structured network and runtime logging (feat: add --debug flag for verbose network and runtime logging #471)
• Unknown-severity findings shown in compact and verbose output; compact mode shows all direct unknown findings (feat: centralize finding display across compact, verbose, report, JSON, and SARIF outputs #385)

Fixed

• pnpm v9 aliased dependency graph gaps and downstream remediation bugs — wrong direct-install commands, missing parent upgrade suggestions, blank context column, reason text overwrite (fix: pnpm v9 aliased deps break transitive graph and remediation for deep chains #515)
• Spinner completion lines no longer printed to stdout in --json mode (fix: suppress spinner output in --json mode #509)
• Offline advisory database errors now include a cve-lite advisories sync hint (fix: add offline advisory db sync hint #407)
• SARIF empty artifactChanges arrays causing GitHub Code Scanning rejections
• Case studies index page Docusaurus build break (fix: add case-studies index page to resolve Docusaurus build break #514)

Changed

• CI workflow declares explicit permissions: contents: read (ci: declare least-privilege workflow-level contents: read #506)

Tests

• Unit tests for src/cli/validate.ts flag-conflict validation (Fix/issue 461 #464)

Docs

• VS Code case study (Add VS Code root lockfile example and verified case study #484)
• Storybook case study
• Help Net Security monthly roundup (docs: add Help Net Security monthly roundup (May 2026) to press coverage #486)
• Case studies navbar link (docs: add case studies navbar link #508)

Validation

• npm test (360/360)
• npm run build