Summary

Add 5 well-maintained security and vulnerability scanning tools:

• Safety - Python dependency vulnerability scanner (MIT License)
• pip-audit - Python package vulnerability scanner by PyPA (Apache 2.0)
• OSV-Scanner - Multi-language vulnerability scanner by Google (Apache 2.0)
• Dockle - Container image security linter (Apache 2.0)
• Grype - Container vulnerability scanner by Anchore (Apache 2.0)

Verification

All tools verified as actively maintained with recent commits and releases:

• Safety: v3.6.1 (Sep 2025), 831 commits, 46 contributors
• pip-audit: Active PyPA project, 765 commits, backed by Trail of Bits & Google
• OSV-Scanner: v2.2.2 (Aug 2025), 1,490 commits, 85 contributors
• Dockle: Active development, 237 commits, 3k+ stars
• Grype: Active Anchore project, 1,940 commits, ongoing community meetings

Coverage

These tools fill important gaps in the catalog:

• Python dependency security scanning
• Container image security analysis
• Multi-language vulnerability detection
• Supply chain security assessment