Automatic Dependabot access to GitHub-hosted registries

Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant.

Dependabot’s GITHUB_TOKEN can now request packages: read, and Dependabot jobs send that token when pulling from *.pkg.github.com and ghcr.io. Any package that has granted your repository access through “Manage Actions access” will accept it, the same as a regular GitHub Actions workflow.

This is available for every GitHub Packages ecosystem that Dependabot supports.

For each package Dependabot needs to read:

1. Open the package’s settings page (under your organization’s or personal account’s Packages tab).
2. Under “Manage Actions access”, add the repository that runs Dependabot with Read access.

You don’t need to change dependabot.yml, and you can remove any PAT-based registry entries you added for these packages.

• Ensuring workflow access to your package
• Configuring access to private registries for Dependabot

Shortly after the initial release on June 23, 2026, we temporarily rolled back this feature after identifying a conflict that caused some npm update jobs to resolve public packages through GitHub Packages. We have re-enabled the feature with automatic GitHub Packages credentials used only as fallback authentication, so explicit registry credentials and normal registry routing continue to take precedence.