Dependabot can now authenticate to private GitHub Packages registries automatically using its built-in GITHUB_TOKEN with packages: read permission, eliminating the need for personal access tokens (PATs). Any package that has granted repository access via "Manage Actions access" in package settings will accept the token, just like a regular GitHub Actions workflow. To enable it, add the repository running Dependabot with Read access under the package's "Manage Actions access" settings — no changes to dependabot.yml required, and existing PAT-based registry entries can be removed.
211 Impressions