Anonymous organization-level registries for Dependabot
Dependabot now supports anonymous authentication for organization-level private registries, enabling access to internal package mirrors and other registries that don't require credentials.
You can now select Anonymous as the authentication method for an organization-level private registry. Use it for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads.
On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries you configure. A private registry that’s only defined in a file such as .npmrc or nuget.config is blocked. Organization-level registries apply to every repository you grant access to, including repositories that only use Dependabot security updates and don’t have a dependabot.yml file.
To add a registry, go to your organization’s Settings, select Secrets and variables, then Private registries, and choose New private registry. If you used a placeholder token as a workaround, delete that registry and add it again with Anonymous authentication. This is necessary because you can’t change the authentication method of an existing registry.
The Anonymous option is now generally available on github.com and will be available in GitHub Enterprise Server 3.24.
Learn more about giving security features access to private registries and resolving a blocked host in a Dependabot update job.
The post Anonymous organization-level registries for Dependabot appeared first on The GitHub Blog.
Source: original entry ↗
More from GitHub
Follow GitHub to get its new changes in your feed and email digest.
GitHub App improvements for least privilege and management
GitHub has released improvements to GitHub Apps that enable developers to migrate away from classic personal access tokens, enhance app management capabilities, and request fewer sensitive permissions for better security.
Gemini 4 Argon now available in GitHub Copilot
Google's Gemini 4 Argon frontier model is now generally available in GitHub Copilot, designed for complex coding, agentic, and reasoning tasks to enhance developer productivity.
Audit GitHub Code Quality finding dismissals and reopenings
Users can now review manual dismissals and reopenings of GitHub Code Quality findings in their organization or enterprise audit log, enabling better tracking and governance of code quality decisions.