carabiner v0.1.5

Dependencies in subprojects were silently skipped.

Found on the first repository carabiner was pointed at that I had not written myself: backend/ and frontend/ each carried a package-lock.json, the deps engine looked only at the top level, found nothing, and therefore said nothing. The scan looked like a repo with no dependency problems rather than one where dependencies were never checked.

The root cause was carabiner's own gate — osv-scanner is invoked with -r and recurses perfectly well. Now a depth-bounded walk that prunes node_modules and friends: 0.017s on that repo against a 2s budget, so the performance concern that justified "top level only" was unfounded.

On that repository the fix surfaced 186 advisories that had been invisible, including a CRITICAL and 90 HIGH.