GitLab Dependency Firewall blocks risky packages pre-build (early access)

Tue, 06 Oct 2026 17:01:10 +0000

Platform/SRE — Skip
CI/CD — Learn: Early access (pre-GA cap applies), but the framing is worth noting: AI coding agents autonomously pulling unreviewed dependencies represent a new attack surface in the build path. Dependency firewalling at the point of install — before SCA can catch what’s already landed — is a supply-chain hardening pattern to track as the feature matures toward GA.
Leader — Skip

Dependency-Security on CuraDevOps