Anonymous organization-level registries for Dependabot
By Steven Van ·
The option is generally available on github.com and will arrive in GitHub Enterprise Server 3.24.
Internal package mirrors that allow anonymous reads can now be configured for Dependabot without a token. GitHub has added Anonymous as an authentication method for organization-level private registries.
Access across repositories
On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and configured private registries. A private registry defined only in .npmrc or nuget.config is blocked, even if it requires no credentials.
Organization-level registries apply to every repository granted access, including repositories that use only Dependabot security updates and have no dependabot.yml file.
Configure anonymous access
Organization owners can open Settings, select Secrets and variables, then Private registries, and choose New private registry. Enter the registry’s URL and type, select Anonymous authentication, and choose which repositories can access it.
Existing registries that use a placeholder token must be deleted and added again with Anonymous authentication. The authentication method cannot be changed after a registry is created.
Availability
Anonymous authentication is generally available on github.com and will be available in GitHub Enterprise Server 3.24. GitHub’s private registry documentation explains organization-level access.
