# New Guide: Firewall's Policy Compliant Component Selection for npm

**URL:** <https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626>\
**Category:** Sonatype Lifecycle & Firewall\
**Tags:** customer-education, firewall, documentation, npm\
**Created:** [November 9, 2021, 4:11pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626 "2021-11-09T16:11:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\
**Post date:** [November 9, 2021, 4:11pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626/1 "2021-11-09T16:11:34Z")

</div>

The Technical Content team is excited to announce the release of a brand new guide, **["Firewall’s Policy Compliant Component Selection for npm."](https://guides.sonatype.com/iqserver/technical-guides/fw-component-selection/)**

To protect against unknown, suspicious, and malicious components, **Nexus Firewall will quarantine new versions of some components until they are deemed safe.**

To make managing package versions easier, **repositories using Firewall now return the latest package version that complies with your policy standards,** unless there is a specified version in the package.json. Any quarantined versions will be removed from your repository. **This saves developers and security teams time managing dependency versions.**

Check out [this guide](https://guides.sonatype.com/iqserver/technical-guides/fw-component-selection/) that covers Nexus Firewall’s **policy compliant component selection for npm.**

Let us know what you think below!

---

<div class="post-metadata">

**Author:** ![jeff.wise](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jeff.wise/32/2421_2.png) [@jeff.wise](https://community.sonatype.com/u/jeff.wise)\
**Post date:** [September 8, 2022, 4:27pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626/2 "2022-09-08T16:27:54Z")

</div>

I’d love to see this feature in the Java ecosystem. Is this on the roadmap?

---

<div class="post-metadata">

**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\
**Post date:** [September 8, 2022, 5:21pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626/3 "2022-09-08T17:21:34Z")

</div>

@jeff.wise I spoke with our Firewall Product Manager and he let me know that it is a candidate for next year’s road map and something being considered. He would be interested to know more about why you need it (either in this thread or feel free to DM me and I can connect you with him!)

---

<div class="post-metadata">

**Author:** ![ingmar.vis](https://avatars.discourse-cdn.com/v4/letter/i/4af34b/32.png) [@ingmar.vis](https://community.sonatype.com/u/ingmar.vis)\
**Post date:** [September 8, 2022, 9:58pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626/4 "2022-09-08T21:58:32Z")

</div>

Great feature to take care of all kind of vulnerabilities associated with using :latest.

---

<div class="post-metadata">

**Author:** ![William\_Leo](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/william_leo/32/3877_2.png) [@William\_Leo](https://community.sonatype.com/u/William_Leo)\
**Post date:** [July 16, 2025, 12:59pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626/5 "2025-07-16T12:59:18Z")

</div>

Thanks for sharing the update! The new guide on Nexus Firewall’s policy-compliant selection for npm sounds like a valuable resource for simplifying secure package management. Looking forward to exploring it further.