Coming soon: GitLab dependency firewall
Mar 26, 2024Tim Rizzi

Summary
This post introduces the upcoming 'dependency firewall' feature, which will act as a first line of defense against software supply chain attacks. It outlines the planned capabilities: preventing malicious packages, checking against GitLab policy, quarantining packages, managing quarantined packages, and reporting package usage. The initial implementation will support a 'warn' policy for packages with known critical vulnerabilities downloaded through the dependency proxy. Future enhancements include support for lower severity vulnerabilities, UI warnings, quarantine rules, and review capabilities.