Dependabot can finally pull from private GitHub Packages without a PAT

Short summary

GitHub Dependabot now authenticates to private GitHub Packages using its built-in GITHUB_TOKEN instead of requiring a manually-created PAT, eliminating credential drift and reducing security overhead. Teams can audit each package's Manage Actions access list, verify consuming repos are authorized, and remove old PAT secrets from their config. The change works across all package ecosystems Dependabot supports (npm, Maven, NuGet, Docker) but only covers GitHub-hosted registries; private infrastructure and third-party registries still require PATs or service accounts.

• •Dependabot now uses its scoped GITHUB_TOKEN for GitHub Packages instead of requiring a manually-created PAT
• •Eliminates credential drift from token expiration, offboarding, and manual rotation — reduces security review friction
• •Works across npm, Maven, NuGet, Docker; covers GitHub Packages and GHCR; third-party registries still need PATs

Generated with AI, which can make mistakes.