GitLab's Dependency Firewall blocks packages before the build

GitLab launched Dependency Firewall in early access at its Transcend event, blocking malicious, vulnerable and non-compliant packages before they reach a build. It is available to Premium and Ultimate customers on GitLab.com and Self-Managed, supporting npm, pip, Poetry, Maven, Gradle and Bundler plus Nexus and Artifactory registries.

• Checks run before install, while the job still holds its credentials
• Policies match on malicious status, severity, license type and package age
• Warn and Block modes, plus a logged bypass for designated users or tokens
• Supports npm, pip, Poetry, Maven, Gradle, Bundler, Nexus and Artifactory