---
name: "glab-dependency-firewall"
section: "1"
platform: "linux"
package: "glab"
version: "1.126.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/glab-dependency-firewall"
---

# glab-dependency-firewall(1)

Configure and monitor GitLab Dependency Firewall for local package managers. (BETA)

## NAME

glab-dependency-firewall - Configure and monitor GitLab Dependency Firewall for local package managers. (BETA)

## SYNOPSIS

**glab dependency-firewall  \[flags\]**

## DESCRIPTION

Commands to configure GitLab Dependency Firewall for local package managers, run local package managers with a summary of blocked or flagged packages, and view activity during the current session.

Each package manager command, like **glab dependency-firewall npm**, runs the package manager binary and forwards every argument to it verbatim. While the package manager runs, the command:

- 1\.

  Starts a local proxy and routes the package manager's HTTPS traffic through it.

- 2\.

  Reads the name and version of each package the package manager downloads or publishes.

- 3\.

  Asks GitLab to evaluate the package against the policies for the project in your Git remote.

- 4\.

  Refuses blocked packages with a **403 Forbidden** response, and lets allowed and warned packages through.

- 5\.

  Records blocked and warned packages in **.gitlab/df/ci-log.json** and prints a summary.

When the package manager finishes, the command prints a summary of the packages that matched your policies. A **✖** marks a blocked package, and a **▲** marks a package with a warning. If no package matched, the command prints no summary. A run with at least one blocked package prints the summary to standard error. A run with only warnings prints it to standard output.

Evaluation results are cached for the length of a run, so a package that appears many times in a dependency tree is evaluated once.

If GitLab can't evaluate a package, the command blocks it. If the Dependency Firewall isn't evaluating the project, the command allows every package.

The command does not change your registry configuration. For the length of the run, it sets environment variables that route the package manager's traffic through the proxy and make the package manager trust the proxy certificate. Your existing CA bundles stay trusted.

The command writes **.gitlab/df/ci-log.json** to the working directory on every run, including local runs. Add **.gitlab/df/** to your **.gitignore** file.

To run a package manager command in a GitLab CI/CD job, set **GLAB\_ENABLE\_CI\_AUTOLOGIN** to **true** so the command signs in with the CI/CD job token. When the firewall blocks a package, the install fails, and so does the job. For more information, see CI/CD auto-login ⟨https://docs.gitlab.com/cli/authentication/#auto-login⟩.

```
install:
  variables:
    GLAB_ENABLE_CI_AUTOLOGIN: "true"
  script:
    - glab dependency-firewall npm ci
```

Package manager commands exit with the following codes:

| | |
| --- | --- |
| **Exit code** | **Meaning** |
| The package manager exit code | The package manager ran and exited. |
| **1** | The package manager was not found on your **PATH** or could not start. |
| **130** | The run was interrupted or stopped, for example, with Control+C or when a CI/CD job is canceled. |

This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development\_stages\_support/.

## OPTIONS INHERITED FROM PARENT COMMANDS

**-h**, **--help**\[=false\]\
 	Show help for this command.

## SEE ALSO

**[glab(1)](/glab/1.md)**, **[glab-dependency-firewall-bundle(1)](/glab-dependency-firewall-bundle/1.md)**, **[glab-dependency-firewall-cargo(1)](/glab-dependency-firewall-cargo/1.md)**, **[glab-dependency-firewall-ci-summary(1)](/glab-dependency-firewall-ci-summary/1.md)**, **[glab-dependency-firewall-gem(1)](/glab-dependency-firewall-gem/1.md)**, **[glab-dependency-firewall-go(1)](/glab-dependency-firewall-go/1.md)**, **[glab-dependency-firewall-gradle(1)](/glab-dependency-firewall-gradle/1.md)**, **[glab-dependency-firewall-maven(1)](/glab-dependency-firewall-maven/1.md)**, **[glab-dependency-firewall-npm(1)](/glab-dependency-firewall-npm/1.md)**, **[glab-dependency-firewall-package(1)](/glab-dependency-firewall-package/1.md)**, **[glab-dependency-firewall-pip(1)](/glab-dependency-firewall-pip/1.md)**, **[glab-dependency-firewall-pipenv(1)](/glab-dependency-firewall-pipenv/1.md)**, **[glab-dependency-firewall-pnpm(1)](/glab-dependency-firewall-pnpm/1.md)**, **[glab-dependency-firewall-poetry(1)](/glab-dependency-firewall-poetry/1.md)**, **[glab-dependency-firewall-twine(1)](/glab-dependency-firewall-twine/1.md)**, **[glab-dependency-firewall-uv(1)](/glab-dependency-firewall-uv/1.md)**, **[glab-dependency-firewall-yarn(1)](/glab-dependency-firewall-yarn/1.md)**