depcurfew 1.2.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depcurfew",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
   "license": "MIT",
   "author": "depcurfew",
@@ -29,7 +29,7 @@
     "schema.json"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=18.3.0"
   },
   "packageManager": "npm@11.19.1",
   "scripts": {

package/schema.json

@@ -167,6 +167,36 @@
         }
       ],
       "default": "auto"
+    },
+    "projects": {
+      "description": "Directories of independent projects in this repository, each with its own manifest and lockfile (e.g. frontend and backend). depcurfew configures each one with this policy as a project of its own, and configures Renovate and Dependabot once, from the repository root, for all of them. The repository root is always configured as well. A project must not be inside another one, must not be a workspace package of the root and must not have a depcurfew.json of its own.",
+      "type": "array",
+      "items": {
+        "description": "A directory relative to the repository root, with / between directories, e.g. \"frontend\" or \"services/api\". No patterns, no \"..\", no / at either end.",
+        "type": "string",
+        "pattern": "^(?!\\.\\.?(?:/|$))(?!.*/\\.\\.?(?:/|$))(?!(?:.*/)?(?:node_modules|\\.git)(?:/|$))[^/\\\\:*?\"<>|\\u0000-\\u001f\\u007f]+(?:/[^/\\\\:*?\"<>|\\u0000-\\u001f\\u007f]+)*$",
+        "examples": [
+          "frontend",
+          "services/api"
+        ]
+      },
+      "uniqueItems": true,
+      "default": []
+    },
+    "doctor": {
+      "description": "How depcurfew doctor and the GitHub Action treat findings. Without this section only errors fail, as before; depcurfew init writes \"failOn\": \"warning\".",
+      "type": "object",
+      "properties": {
+        "failOn": {
+          "description": "Which findings make depcurfew doctor exit with 1 and fail the GitHub Action: \"error\" (only errors, also when left out) or \"warning\" (warnings too). Notes never fail. doctor --fail-on and the input fail-on of the Action override it.",
+          "type": "string",
+          "enum": [
+            "error",
+            "warning"
+          ]
+        }
+      },
+      "additionalProperties": false
     }
   },
   "required": [