glab(1)

💅 glab(1) — the dependency firewall package checker, bestie edition

Okay so real talk, this is a page from glab(1), and we're about to go through it together. Grab a snack. 🍓

---

✨ NAME ✨

glab-dependency-firewall-package — check a single package against the GitLab Dependency Firewall. (BETA) 👑

---

🦋 SYNOPSIS 🦋

glab dependency-firewall package  [flags]

---

🌸 DESCRIPTION 🌸

So what this does is check one package coordinate against the GitLab Dependency Firewall policy for the current project, and then reports the outcome: allow, warning, or blocked. And the best part? No package manager binary is required. None. Zero. Nada. 🎀

The supported package URL (PURL) types are npm, pypi, maven, gem, cargo, and golang. The PURL must include a version, like for example pkg:npm/left-pad@1.3.0. And for golang, the module path keeps its case, for example pkg:golang/github.com/BurntSushi/toml@v1.4.0 — don't go lowercasing it, iykyk. 🫶

An allowed package prints one line, for example, left-pad@1.3.0: allowed by the Dependency Firewall. A warned or blocked package prints the same summary as the package manager commands. Consistent queen behavior. 💅

Heads up bestie: this command does not write to the CI log at .gitlab/df/ci-log.json, so glab dependency-firewall ci-summary does not include its result. Like, it's just not invited to that party. 🙈

💀 Exit codes (the vibe check)

• 0 — Allowed or warned, or the Dependency Firewall is not evaluating the project.
• 1 — The PURL is invalid or has no version, the project or credentials can't be resolved, or the request to GitLab failed.
• 3 — Blocked.

An exit code of 0 does not always mean GitLab checked the package. If the Dependency Firewall is not evaluating the project, the command prints a line that ends with the Dependency Firewall is not evaluating this project; allowing. So 0 is giving "we didn't really look but sure" energy sometimes, no cap. 😭

Unlike the package manager commands, this command does not block the package when the request to GitLab fails. It exits with 1 instead. Different coping mechanism, same drama. ⭐

Beta warning, fr fr: this feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development_stages_support/. Do not come for me, come for the docs. 🧚

---

🌈 OPTIONS INHERITED FROM PARENT COMMANDS 🌈

• -h, --help[=false] — Show help for this command. The classic. The icon. 🎀

---

🔥 EXAMPLE 🔥

# Check an npm package version
glab dependency-firewall package pkg:npm/left-pad@1.3.0

# Check a PyPI package version
glab dependency-firewall package pkg:pypi/requests@2.31.0

# Check a Maven package version
glab dependency-firewall package pkg:maven/org.slf4j/slf4j-api@2.0.13

# Check a RubyGems package version
glab dependency-firewall package pkg:gem/rails@7.1.3

# Check a Cargo package version
glab dependency-firewall package pkg:cargo/serde@1.0.197

# Check a Go module version
glab dependency-firewall package pkg:golang/github.com/pkg/errors@v0.9.1

---

💖 SEE ALSO 💖

• glab-dependency-firewall(1) — the parent, the main character, go read it. ✨

---

And that's the whole page, bestie! 🦋 Auto generated by spf13/cobra, dated Nov 2026, and this was glab(1). Slay, bye! 💜🌸