Automatic Dependabot access to GitHub-hosted registries

Dependabot can now authenticate to private GitHub Packages registries (npm, ghcr.io, and other GitHub-supported ecosystems) using its GITHUB_TOKEN with packages:read scope, eliminating the need for personal access tokens. Repositories granted Read access under a package's 'Manage Actions access' settings will automatically have Dependabot reuse that grant, no dependabot.yml changes required and existing PAT-based registry entries can be removed. The feature was briefly rolled back after launch due to a conflict causing some npm jobs to resolve public packages through GitHub Packages, and has now been re-enabled with automatic credentials acting only as fallback authentication.

Source: https://github.blog/changelog/2026-09-08-automatic-dependabot-access-to-github-hosted-registries. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.