Dependabot now supports reading from private GitHub Packages registries by leveraging the GITHUB_TOKEN without requiring a personal access token. When a package has authorized repository access via the "Manage Actions access" mechanism in package settings, Dependabot automatically reuses that authorization.
What's new
The GITHUB_TOKEN available to Dependabot jobs can now request the packages: read permission. When Dependabot pulls dependencies from *.pkg.github.com and ghcr.io, it automatically transmits this token. Packages that have previously granted repository access through "Manage Actions access" will recognize and accept the token, functioning identically to standard GitHub Actions workflows.
This functionality extends across all GitHub Packages ecosystems that Dependabot currently supports.
How to enable it
For each package that Dependabot requires access to, follow these steps:
- Navigate to the package's settings page, located under the Packages tab in your organization or personal account.
- Locate the "Manage Actions access" section and grant the repository running Dependabot Read access permissions.
No modifications to dependabot.yml are necessary, and any personal access token-based registry configurations previously added for these packages can be safely removed.
Learn more
- Ensuring workflow access to your package
- Configuring access to private registries for Dependabot
Following the initial launch on June 23, 2026, GitHub temporarily disabled this feature after discovering an issue where certain npm update operations were routing public packages through GitHub Packages. The feature has since been restored with automatic GitHub Packages credentials functioning as a secondary authentication method, preserving the priority of explicit registry credentials and standard registry routing logic.
Source: GitHub Blog