Supported package managers and functionality

The GitLab package registry supports different functionalities for each package type. This support includes publishing and pulling packages, request forwarding, managing duplicates, and authentication.

Supported package managers

The package registry supports the following package manager types:

View what each status means.

You can also use the API to administer the package registry.

Publishing packages

Packages can be published to your project, group, or instance.

Pulling packages

Packages can be pulled from your project, group, or instance.

Forwarding requests

Prerequisites:

• On GitLab.com: You must be the Owner of the group.
• On GitLab Self-Managed: You must be an administrator.

When a package is not found in your project’s package registry, requests are forwarded to the corresponding public registry of the package manager.

The default forwarding behavior varies by package type and can introduce a dependency confusion vulnerability. The table below shows which package managers support package forwarding.

To reduce the associated security risks:

• Verify the package is not being actively used.
• Implement a version control tool, like Git, to track changes to packages.
• Turn off request forwarding:
  • Instance administrators can disable forwarding in the Admin area. For more information, see Control package forwarding.
  • Group owners can turn off package forwarding in the group settings.

To turn off request forwarding for a group:

1. On the left sidebar, select Search or go to and find your group. If you’ve turned on the new navigation, this field is on the top bar.
2. On the left sidebar, select Settings > Packages and registries.
3. Under Package forwarding, clear either of the following checkboxes:
   • Forward npm package requests
   • Forward PyPI package requests
4. Select Save changes.

Deleting packages

When package requests are forwarded to a public registry, package deletion can cause a dependency confusion vulnerability.

If a system tries to pull a deleted package, the request forwards to the public registry. If a package with the same name and version is in the public registry, that package is pulled instead. The package pulled from the registry might not be what you expect, and could be malicious.

To reduce the associated security risks, before you delete a package:

• Verify the package is not being actively used.
• Disable request forwarding.

To delete packages, you can:

• Delete packages in the UI.
• Delete packages with the API.

Importing packages from other repositories

You can use GitLab pipelines to import packages from other repositories, such as Maven Central or Artifactory with the package importer tool.

Allow or prevent duplicates

By default, the GitLab package registry either allows or prevents duplicates based on the default of that specific package manager format.

Authenticate with the registry

Authentication depends on the package manager you’re using. To learn what authentication protocols are supported for a specific package type, see Authentication protocols.

For most package types, the following authentication tokens are valid:

• Personal access token
• Project deploy token
• Group deploy token
• CI/CD job token

The following table lists which authentication tokens are supported for a given package manager:

Authentication protocols

The following authentication protocols are supported:

Supported hash types

Hash values are used to ensure you are using the correct package. You can view these values in the user interface or with the API.

The package registry supports the following hash types: