Release notes
Product changes and additions to the Bytesafe Dependency Firewall.
July 2026
The next generation: a firewall in front of your registries
The Bytesafe Dependency Firewall is a checkpoint in front of the registries your builds already pull from. Every install and publish passes your rules on the way through: block a package, filter it out of the version list, or delay it until the version has aged.
Rules act on what is known about a package, not just its name: vulnerabilities, malware, licenses, install scripts, and how long the version has been public. An exception waives one with a reason and an expiry.
improvedRules replace policies and plugins: one model combining an execution phase, a selector (name, version range, upstream, or a computed check), and an effect. Any rule can be scoped to one package, one prefix, or one upstream.
improvedExceptions carry a reason and an optional expiry, so a waiver is documented and ends by itself.
improvedRepository managers: run the firewall in front of, behind, or on both sides of Artifactory or Nexus.
newGo and Conda (beta) join npm, PyPI, Maven, and NuGet. Container images coming.
newMalware blocking on download.
newSecrets scanning on publish, so credentials do not leave in a package.
newTrust downgrade detection for npm releases published with weaker provenance than earlier versions.
newFirewall log and audit log: every decision with package, rule, and requester; every configuration change with who made it.
newWebhooks: signed events for firewall decisions, audit events, configuration changes, and publishes.
newTrusted Builders: GitHub Actions authenticate with their OIDC identity, no stored secrets in CI.
newConfig as code: firewall configuration in git, with rollback.
newThis documentation site. Start at the Quickstart or What is a dependency firewall?
Running previous-generation Bytesafe? The migration guide maps every policy and plugin to its replacement and covers moving private packages to a repository manager.
Early access is open. Request access today.