Automatic Dependabot access to GitHub-hosted registries
Dependabot reuses a package's "Manage Actions access" grant to read private GitHub Packages registries, no personal access token required.
GitHub's Dependabot can now read private GitHub Packages registries without a personal access token. If a package has already granted a repository access through "Manage Actions access" in its settings, Dependabot reuses that same grant.
- Dependabot's GITHUB_TOKEN can now request packages: read, and Dependabot jobs send that token when pulling from *.pkg.github.com and ghcr.io.
- Any package that has granted the repository access through "Manage Actions access" accepts it, the same as a regular GitHub Actions workflow, across every GitHub Packages ecosystem Dependabot supports.
- No changes to dependabot.yml are needed, and PAT-based registry entries added for these packages can be removed.
To enable it, add the repository that runs Dependabot with Read access under Manage Actions access on each package's settings page. The feature first shipped on June 23, 2026 but was briefly rolled back after a conflict caused some npm update jobs to resolve public packages through GitHub Packages. It has now returned with the automatic credentials used only as fallback authentication, so explicit registry credentials and normal registry routing still take precedence.
