---
name: "glab-dependency-firewall-package"
section: "1"
platform: "linux"
package: "glab"
version: "1.126.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/glab-dependency-firewall-package"
---

# glab-dependency-firewall-package(1)

Check a package against the GitLab Dependency Firewall. (BETA)

## NAME

glab-dependency-firewall-package - Check a package against the GitLab Dependency Firewall. (BETA)

## SYNOPSIS

**glab dependency-firewall package  \[flags\]**

## DESCRIPTION

Check a single package coordinate against the GitLab Dependency Firewall policy for the current project and report the outcome (allow, warning, blocked). No package manager binary is required.

Supported package URL (PURL) types are **npm**, **pypi**, **maven**, **gem**, **cargo**, and **golang**. The PURL must include a version, for example **pkg:npm/left-pad@1.3.0**. For **golang**, the module path keeps its case, for example **pkg:golang/github.com/BurntSushi/toml@v1.4.0**.

An allowed package prints one line, for example, **left-pad@1.3.0: allowed by the Dependency Firewall.** A warned or blocked package prints the same summary as the package manager commands.

This command does not write to the CI log at **.gitlab/df/ci-log.json**, so **glab dependency-firewall ci-summary** does not include its result.

Exit codes:

| | |
| --- | --- |
| **Exit code** | **Meaning** |
| **0** | Allowed or warned, or the Dependency Firewall is not evaluating the project. |
| **1** | The PURL is invalid or has no version, the project or credentials can't be resolved, or the request to GitLab failed. |
| **3** | Blocked. |

An exit code of **0** does not always mean GitLab checked the package. If the Dependency Firewall is not evaluating the project, the command prints a line that ends with **the Dependency Firewall is not evaluating this project; allowing.**

Unlike the package manager commands, this command does not block the package when the request to GitLab fails. It exits with **1** instead.

This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development\_stages\_support/.

## OPTIONS INHERITED FROM PARENT COMMANDS

**-h**, **--help**\[=false\]\
 	Show help for this command.

## EXAMPLE

```
# Check an npm package version
glab dependency-firewall package pkg:npm/left-pad@1.3.0
# Check a PyPI package version
glab dependency-firewall package pkg:pypi/requests@2.31.0
# Check a Maven package version
glab dependency-firewall package pkg:maven/org.slf4j/slf4j-api@2.0.13
# Check a RubyGems package version
glab dependency-firewall package pkg:gem/rails@7.1.3
# Check a Cargo package version
glab dependency-firewall package pkg:cargo/serde@1.0.197
# Check a Go module version
glab dependency-firewall package pkg:golang/github.com/pkg/errors@v0.9.1
```

## SEE ALSO

**[glab-dependency-firewall(1)](/glab-dependency-firewall/1.md)**