Dependency Firewall: Block risky packages before the build
GitLab announced Dependency Firewall, now in early access for GitLab.com and GitLab Self-Managed Premium and Ultimate customers. It blocks or warns on packages that match a policy covering malware status, vulnerability severity, license type, and minimum package age, before they are installed in a build. The source also cites five malicious PyPI packages GitLab researchers found in June 2026, four of them typosquats of Flask, Requests, and NumPy.
What changes for platform teams
Platform teams can set policy once at the top-level group, with project-level overrides where the strictest rule applies, and run warn mode before switching to block mode with logged bypasses. Teams using Sonatype Nexus or JFrog Artifactory can apply it at the registry, and the GitLab CLI can check a package before it is added.
Editor: Correction 2026-10-20: this was listed as a GitLab release by mistake. It is GitLab Blog coverage, not release notes from the project.
Read the original at GitLab Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules