Dependabot Gains Automatic Access to GitHub-Hosted Registries
GitHub has enabled Dependabot to automatically access private GitHub Packages registries without requiring a personal access token. This streamlines dependency updates by reusing existing "Manage Actions access" grants, enhancing security and simplifying configuration. The feature benefits developers and organizations leveraging Dependabot with private packages hosted on GitHub. Initially rolled out on June 23, 2026, it was briefly rolled back due to an npm conflict and is now re-enabled with automatic credentials serving as fallback authentication.
Features (1) ›
- Automatic Dependabot Access for Private GitHub Packages
Dependabot can now read from private GitHub Packages registries without requiring a personal access token. It reuses existing access granted via a package's 'Manage Actions access' settings, similar to how GitHub Actions workflows function.
https://github.blog/changelog/2026-09-08-automatic-dependabot-access-to-github-hosted-registries
Related releases
- GitHub unveils a redesigned customer portal at help.github.com GitHub Changelog ·
- GitHub Copilot Expands Model Choices, Content Protections, and VS Code Agent Features GitHub Changelog ·
- GitHub Copilot integrates GPT-6 Astra for enhanced autonomous coding GitHub Changelog ·
- GitHub introduces privacy-safe API for repository star history GitHub Changelog ·
- GitHub Actions Adds New API, Permissions, and Workflow Context Properties GitHub Changelog ·
- npm adds multiple trusted publishing configurations, improves security for staged releases GitHub Changelog ·