Automatic Dependabot access to GitHub-hosted registries

Dependabot can now authenticate to private GitHub Packages registries automatically using its built-in GITHUB_TOKEN with packages: read permission, eliminating the need for personal access tokens (PATs). Any package that has granted repository access via "Manage Actions access" in package settings will accept the token, just like a regular GitHub Actions workflow. To enable it, add the repository running Dependabot with Read access under the package's "Manage Actions access" settings — no changes to dependabot.yml required, and existing PAT-based registry entries can be removed.

Source: https://github.blog/changelog/2026-06-23-automatic-dependabot-access-to-github-hosted-registries. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.