[Perruer]

Adds Sapper to OSS and Dependency management.

• Tool: Perruer/sapper, Apache-2.0, Go.
• Why: SBOM generators and scanners answer "what is in this product". Sapper answers the next question for teams that ship many products: which of them a given vulnerability reaches and through which dependency path, with actively exploited (CISA KEV) and likely exploited (EPSS) vulnerabilities first. It reads CycloneDX/SPDX SBOMs, OSV data and OpenVEX, and outputs a table, Markdown or JSON, so it fits into CI reporting.
• Stars and maturity, honestly: the repository is new (v1.0.0 released on 2026-09-25, few stars yet). It is a maintained continuation of bitbomdev/minefield (733★, archived in August 2025), and keeps its history. CI covers Linux/macOS/Windows, Redis, a Docker end-to-end run, govulncheck, CodeQL and OSV-Scanner.
• Topic: SBOM consumption and vulnerability triage.

Disclosure: I maintain Sapper.

🤖 Generated with Claude Code