BytesafeDependency Firewall

Release notes

Product changes and additions to the Bytesafe Dependency Firewall.

August 2026

Self-service trials, Composer, the CLI, and clearer firewall logs

You can now sign up directly and start a 14-day trial. PHP projects can install dependencies through a Composer firewall. The Bytesafe Dependency Firewall CLI has been released for macOS, Linux, and Windows. Firewall logs record upstream failures and can be filtered by outcome. Firewalls with a parent show their inherited configuration.

improvedView rules, exceptions, and upstreams inherited from a parent firewall in the dashboard and API.
improvedFind relevant firewall log entries with improved filtering.
improvedAdding rules is simpler: choose what you want to prevent, or start from scratch. See Delay new versions.
newStart a 14-day trial directly from the signup page, without requesting access first.
newRoute PHP dependencies through a Composer firewall (beta), with controls for vulnerabilities, abandoned packages, licenses, release maturity, and install-time code execution.
newThe Bytesafe Dependency Firewall CLI, bsfw, is released for macOS, Linux, and Windows. Install it with Homebrew, the install script, or a direct download.
newRecord upstream failures in the firewall log. Each entry identifies the registry and its response. Failures are logged even when another upstream serves the request.
Early access is open. Start a 14-day trial.

July 2026

The next generation: a firewall in front of your registries

The Bytesafe Dependency Firewall is a checkpoint in front of the registries your builds already pull from. Every install and publish passes your rules on the way through: block a package, filter it out of the version list, or delay it until the version has aged.

Rules act on what is known about a package, not just its name: vulnerabilities, malware, licenses, install scripts, and how long the version has been public. An exception waives one with a reason and an expiry.

improvedRules replace policies and plugins: one model combining an execution phase, a selector (name, version range, upstream, or a computed check), and an effect. Any rule can be scoped to one package, one prefix, or one upstream.
improvedExceptions carry a reason and an optional expiry, so a waiver is documented and ends by itself.
improvedRepository managers: run the firewall in front of, behind, or on both sides of Artifactory or Nexus.
newGo and Conda (beta) join npm, PyPI, Maven, and NuGet. Container images are coming in Q4 2026.
newMalware blocking on download.
newSecrets scanning on publish, so credentials do not leave in a package.
newTrust downgrade detection for npm releases published with weaker provenance than earlier versions.
newFirewall log and audit log: every decision with package, rule, and requester; every configuration change with who made it.
newWebhooks: signed events for firewall decisions, audit events, configuration changes, and publishes.
newTrusted Builders: GitHub Actions authenticate with their OIDC identity, no stored secrets in CI.
newConfig as code: firewall configuration in git, with rollback.
newThis documentation site. Start at the Quickstart or What is a dependency firewall?

Running previous-generation Bytesafe? The migration guide maps every policy and plugin to its replacement and covers moving private packages to a repository manager.

Early access

Start a 14-day Dependency Firewall trial, learn what early access means, and report feedback.

What is a dependency firewall?

How the Bytesafe Dependency Firewall works, what it protects against, and where it fits next to SCA tools and repository managers.

On this page

August 2026Self-service trials, Composer, the CLI, and clearer firewall logsJuly 2026The next generation: a firewall in front of your registries