Dependency Firewall offer: 50% off the base fee. See pricing

Dependency Firewallvs. Sonatype Repository Firewall

Both block risky packages before they reach developers and CI/CD. Sonatype Repository Firewall runs on Nexus Repository or self-hosted Artifactory. Dependency Firewall works in front of any registry and is sold on its own.

See pricingBook a demo

Where they differ

From Sonatype's public documentation. If something is out of date, tell us.

Works in front of Artifactory
Dependency FirewallYesCloud or self-hosted Artifactory
Sonatype Repository FirewallPartlySelf-hosted only. Artifactory SaaS is not supported
Works with other registries
Dependency FirewallYesPublic registries, GitHub Packages, GitLab, Azure Artifacts. All 10 ecosystems and every rule
Sonatype Repository FirewallPartlyFirewall Pro blocks malware for 4 ecosystems: npm, Maven, PyPI and NuGet
Different rules per team
Dependency FirewallYesA firewall per team or pipeline, inheriting a baseline
Sonatype Repository FirewallPartlyPolicies apply per proxy repository
Configuration as code
Dependency FirewallYesJSON files in Git, a full API, or the user interface
Sonatype Repository FirewallPartlyREST API
EU-based vendor
Dependency FirewallYesBitfront AB, Sweden
Sonatype Repository FirewallNoHeadquartered in the US

Where they match

  • Works in front of Nexus RepositoryNexus stays as the upstream. No plugin. Sonatype Repository Firewall: Nexus Repository Pro.
  • SaaSIn the EU, France by default. Sonatype Repository Firewall: Firewall Cloud.
  • Self-hostedManaged Cloud, BYO Cloud or on-premises, on Enterprise.
  • npm, Maven, PyPI, NuGet, GoIncluding Yarn, pnpm, Bun, Gradle, uv and Poetry.
  • Composer, Cargo, RubyGems, CondaCovered by both.
  • Docker / OCI imagesLayers scanned for malware, secrets and vulnerable OS packages. Sonatype Repository Firewall: Docker, through the repository manager.
  • Block malicious packagesKnown malware. A separate rule can block install scripts on npm, PyPI and Composer.
  • Block known vulnerabilitiesCVSS and EPSS thresholds per firewall. Sonatype Repository Firewall: Security policies in IQ Server.
  • License rulesCovered by both.
  • Hold newly published versionsSafety delay holds new versions, for example 7 or 14 days. Sonatype Repository Firewall: Release integrity quarantines suspicious new releases for npm, Maven, PyPI, NuGet and Hugging Face.
  • Dependency confusion protectionUpstream priority rules, so the private package wins. Sonatype Repository Firewall: Namespace confusion protection.
  • Exceptions and waiversTime-limited. Developers request them from the blocked install, and the team you choose approves or denies. Sonatype Repository Firewall: Waivers, and automatic release from quarantine.
  • Audit logEvery block, allow and exception, exportable to your SIEM.

How Dependency Firewall works differently

Any registry, all features

Dependency Firewall sits between your package managers and wherever packages come from: Nexus, Artifactory in the cloud or self-hosted, GitHub Packages, GitLab, Azure Artifacts or the public registries directly. All 10 ecosystems and every rule work the same whatever sits behind it: npm, Maven, PyPI, NuGet, Go, Composer, Cargo, RubyGems, Conda and Docker / OCI images.

Use case: CI/CD pipeline protectionUse case: AI coding agents

Sonatype Repository Firewall: The full Repository Firewall runs on Nexus Repository Pro or self-hosted Artifactory. For other repositories, Firewall Pro blocks malware for 4 ecosystems: npm, Maven, PyPI and NuGet.

A firewall per team, on one baseline

Run a separate firewall per team, pipeline or registry, each with its own rules and exceptions. Point them at a baseline firewall: its rules run first and cannot be weakened downstream. A CI firewall can be stricter than a local one without holding everyone to the same policy.

Use case: Policy governance

Sonatype Repository Firewall: Firewall policies live in IQ Server and apply to proxy repositories. Different rules for different teams most often means separate repositories.

Every block explains itself

A blocked request shows the package, version, rule and requester. The developer requests an exception from the same view, and the team you choose approves it, narrowing the version or the expiry, or denies it with a comment. The exception covers one rule, and every other rule keeps applying.

Use case: Malicious packages

Sonatype Repository Firewall: Quarantined components are listed in IQ Server, with waivers and automatic release once a component clears policy.

Which one fits

Most teams can tell from which registries they run and how they want to buy it.

Dependency Firewall fits when

  • Your packages come from more than one place: public registries, Nexus, Artifactory, GitHub Packages, GitLab or Azure Artifacts.
  • You want the firewall as a standalone product, without buying into a repository platform.
  • Each team or pipeline needs its own rules, on top of a baseline nobody can weaken.
  • You want firewall configuration as JSON files in Git, reviewed as code.
  • You want an EU company, with SaaS hosted in the EU.

Sonatype Repository Firewall fits when

  • You want one vendor for your repository manager, component intelligence and firewall.
  • You already use Sonatype Lifecycle and want firewall policy in the same IQ Server.
  • You need a package format Dependency Firewall doesn't cover yet.

Questions

Can Dependency Firewall run in front of Nexus Repository?
Yes. Package managers point at Dependency Firewall, and Nexus stays as its upstream. There is no plugin and no change to your Nexus setup.
Do we need to change code or lockfiles?
No. Routing is a package manager setting: a registry URL, a Maven mirror entry, a GOPROXY value or a docker login. Code, manifests and lockfiles stay as they are.
Can each team have its own rules?
Yes. Create a firewall per team, pipeline or registry. Each can inherit from a baseline firewall, whose rules run first and cannot be weakened downstream.
Where is Dependency Firewall hosted?
The SaaS runs in the EU, on Scaleway in France by default, with AWS in the EU on request. Enterprise adds Managed Cloud, BYO Cloud and on-premises deployment. Bitfront AB is a Swedish company.
How is Dependency Firewall priced?
Cloud is priced on the largest of three meters: active users, packages scanned or downloads served. There is no overage. Enterprise is a custom agreement. See the price list.

Run it in front of your current repository

Point one package manager at Dependency Firewall and read the decisions in the log. No agent installs, no workflow changes.

Start a free trialBook a demo