Fixed regex to correctly extract version spec when package includes extras like django[argon2]==4.2.0. The previous pattern consumed the version spec in the non-greedy .*? part when extras were present.
- scripts/vulnerability_scanner.py: scan Python dependencies against OSV CVE database - tests/test_vulnerability_scanner.py: 10 comprehensive tests - Supports requirements.txt parsing with -r includes - Outputs text, JSON, and markdown reports - Filters by severity (critical/high/medium/low) - Exit codes 0/1/2 for CI integration