Release notes

RSS feed

Product changes and additions to the Bytesafe Dependency Firewall.

November 2026

Route developers, CI and AI agents through the firewall with no local configuration

Package installs from developers, build agents, and AI coding agents now reach your dependency firewall endpoints with nothing set up on their machines. Connect the web proxy your company already runs, such as Zscaler or Squid, to a Bytesafe proxy.

Routing is configured once, in one place, so protection no longer depends on every developer getting their setup right. A new developer or a new agent behind the web proxy is covered from the first install.

newConnect a web proxy (beta) to route package installs through your dependency firewall endpoints without configuring a package manager. The dashboard gives the hosts to forward, the certificate to trust, and a Squid or Zscaler setup. Enabled per organization on request.

October 2026

Request exceptions from your policy team, and get alerts on packages already in use

Let one team, such as security, grant exceptions, while developers request what they need from the blocked install. Every request and decision is recorded in the audit log.

Packages your builds already downloaded are now checked every day against the latest advisory and malware data. When a new vulnerability or malware report turns up, or a known vulnerability becomes critical or exploited, the team you choose gets an email, and your own tools can get a webhook event.

The API reference is now generated from the firewall's OpenAPI schema, with a page per operation and real request and response examples. The schema is public, so you can build your own tools on it.

Exception requests page in the dashboard on Needs review, listing pending requests with package, firewall, rule, requester, and time
improvedCargo and Composer firewalls are out of beta.
newException requests: request an exception from a blocked install, review every pending request in one place, and route requests to your own tools with webhook events.
newRisk alerts: packages served in the last 30 days are monitored daily, and a team you choose gets an email or a webhook event when a new risk turns up.
newDownload the OpenAPI schema to generate a client or import the API into your own tools.

September 2026

Docker and OCI images now pass the same rules as your packages

Point Docker at a container firewall and every image you pull or push is checked on the way through. The OS packages inside it are matched against known vulnerabilities, and each layer is scanned for malware and leaked credentials.

Rust and Ruby teams can now put crates and gems behind the rules the rest of your dependencies already follow.

When something is blocked, the vulnerability or malware ID in the log entry now opens its page in the dashboard. You see the scores, whether it is known to be exploited, and what a malicious package does, without leaving to search for it.

Malware report page in the dashboardVulnerability page in the dashboardContainer image page in the dashboard, with build steps grouped by base image and the image's vulnerabilities
newPull and push container images through a container firewall (beta), with vulnerability checks on the OS packages in each image and malware and secrets scanning of every layer. Enabled per organization on request.
newSearch advisories in the dashboard, and open a page per vulnerability with scores by vendor, EPSS, known-exploited status, the EUVD record, and every affected package.
newOpen the report behind a malware block, with what the package does, affected versions, and indicators of compromise.
newRoute Rust dependencies through a Cargo firewall (beta), with controls for vulnerabilities, yanked crates, licenses, release maturity, and malware.
newRoute Ruby dependencies through a RubyGems firewall, with controls for vulnerabilities, licenses, release maturity, malware, install-time code execution, and secrets scanning on publish.

August 2026

Self-service trials, Composer, the CLI, and clearer firewall logs

You can now sign up directly and start a 14-day trial. PHP projects can install dependencies through a Composer firewall. The Bytesafe Dependency Firewall CLI has been released for macOS, Linux, and Windows. Firewall logs record upstream failures and can be filtered by outcome. Firewalls with a parent show their inherited configuration.

Firewalls overview in the dashboard, with firewalls showing the parent they inherit from and how many rules and exceptions they inherit
improvedView rules, exceptions, and upstreams inherited from a parent firewall in the dashboard and API.
improvedFind relevant firewall log entries with improved filtering.
improvedAdding rules is simpler: choose what you want to prevent, or start from scratch. See Delay new versions.
newStart a 14-day trial directly from the signup page, without requesting access first.
newRoute PHP dependencies through a Composer firewall (beta), with controls for vulnerabilities, abandoned packages, licenses, release maturity, and install-time code execution.
newThe Bytesafe Dependency Firewall CLI, bsfw, is released for macOS, Linux, and Windows. Install it with Homebrew, the install script, or a direct download.
newRecord upstream failures in the firewall log. Each entry identifies the registry and its response. Failures are logged even when another upstream serves the request.

July 2026

The next generation: a firewall in front of your registries

The Bytesafe Dependency Firewall is a checkpoint in front of the registries your builds already pull from. Every install and publish passes your rules on the way through: block a package, filter it out of the version list, or delay it until the version has aged.

Rules act on what is known about a package, not just its name: vulnerabilities, malware, licenses, install scripts, and how long the version has been public. An exception waives one with a reason and an expiry.

improvedRules replace policies and plugins: one model combining an execution phase, a selector (name, version range, upstream, or a computed check), and an effect. Any rule can be scoped to one package, one prefix, or one upstream.
improvedExceptions carry a reason and an optional expiry, so a waiver is documented and ends by itself.
improvedRepository managers: run the firewall in front of, behind, or on both sides of Artifactory or Nexus.
newGo and Conda (beta) join npm, PyPI, Maven, and NuGet.
newMalware blocking on download.
newSecrets scanning on publish, so credentials do not leave in a package.
newTrust downgrade detection for npm releases published with weaker provenance than earlier versions.
newFirewall log and audit log: every decision with package, rule, and requester; every configuration change with who made it.
newWebhooks: signed events for firewall decisions, audit events, configuration changes, and publishes.
newTrusted Builders: GitHub Actions authenticate with their OIDC identity, no stored secrets in CI.
newConfig as code: firewall configuration in git, with rollback.
newThis documentation site. Start at the Quickstart or What is a dependency firewall?

Running previous-generation Bytesafe? The migration guide maps every policy and plugin to its replacement and covers moving private packages to a repository manager.

Start a 14-day trial

The trial runs on the Cloud plan and includes every capability.

What is a dependency firewall?

How the Bytesafe Dependency Firewall works, what it protects against, and where it fits next to SCA tools and repository managers.

On this page

November 2026Route developers, CI and AI agents through the firewall with no local configurationOctober 2026Request exceptions from your policy team, and get alerts on packages already in useSeptember 2026Docker and OCI images now pass the same rules as your packagesAugust 2026Self-service trials, Composer, the CLI, and clearer firewall logsJuly 2026The next generation: a firewall in front of your registries