GitHub has updated Dependabot so it can fetch private packages from GitHub Packages and GHCR using the repository’s GITHUB_TOKEN instead of a personal access token (PAT). The change removes the need to embed PAT credentials in dependabot.yml and aligns Dependabot’s authentication with the standard token used by GitHub Actions workflows.
Token flow and fallback behavior
When Dependabot runs, it now includes the automatically generated GITHUB_TOKEN in requests to any *.pkg.github.com or ghcr.io endpoint. Packages that have granted the repository read access via the “Manage Actions access” setting will accept this token, just as a normal Action would. After a brief rollback due to a routing conflict with npm, the feature was re‑enabled with the token acting only as a fallback; explicit registry credentials and normal routing still take precedence.
Configuring repository access
To enable the new behavior, open the settings page for each private package (found under the organization’s or user’s Packages tab). In the “Manage Actions access” section, add the repository that runs Dependabot and assign it Read permission. No changes to dependabot.yml are required, and any existing PAT‑based entries for those registries can be removed.
Operational and security implications
Eliminating PATs reduces the surface area for credential leakage, since the token is short‑lived and scoped to the repository. Engineers no longer need to manage secret rotation for Dependabot‑specific PATs. The fallback mode ensures that existing explicit credentials continue to be used when present, preventing accidental rerouting of public packages through GitHub Packages—a problem that triggered the temporary rollback.
Related CloudNinjas coverage: DevOps.
What This Means For Practitioners
Adopt the “Manage Actions access” grant for any private package Dependabot consumes, clean up PAT entries from your configuration, and verify that your CI pipelines still respect explicit registry credentials. Monitor upcoming GitHub release notes for any refinements to the fallback logic, as changes could affect package resolution order.