Configuration

Place emendant.json in the root of the repository being scanned. Emendant works without configuration; add the file only for stable project-specific choices.

{
  "ignore": ["legacy/**", "generated/**"],
  "packages": ["openai", "ai"],
  "severity": ["breaking", "deprecation"],
  "adopted": false
}

Unknown keys and invalid values are errors. This is deliberate: a misspelled exclusion must not produce a scan that looks correctly narrowed.

Keys

Key	Type	Meaning
ignore	string[]	Repository-relative glob patterns excluded from the source walk.
packages	string[]	Registry package names to scan. Empty means every directly declared package with feed coverage.
severity	string[]	Any of breaking, deprecation, or behaviour. Empty uses the built-in default.
adopted	boolean	Include findings for releases the project has already adopted.
testCommand	string	Accepted for the upcoming validated-fix workflow; unused by scan.
maxPatchLines	integer	Accepted for the upcoming fix workflow; unused by scan.

Ignore paths

Patterns are matched against paths relative to the repository root:

{
  "ignore": [
    "legacy/**",
    "apps/demo/src/generated/**"
  ]
}

A pattern ending in /** excludes the named directory and its complete subtree. This is separate from .gitignore: Emendant respects committed .gitignore files automatically, while ignore expresses a scanner-specific choice.

Command-line overrides

When --package is supplied, its repeated values replace the configured package list for that run. Likewise, --severity replaces the configured severity list. --adopted enables adopted findings even when the file leaves them disabled.

npx emendant scan --package openai --severity breaking

Use a different file

npx emendant scan --config config/emendant.ci.json

A relative path is resolved from the directory being scanned. An explicitly named file that cannot be read is an error.