Dependabot Private GitHub Packages Without PATs: Migration Guide
GitHub re-enabled automatic Dependabot access to private GitHub-hosted package registries on September 8, 2026. When a private GitHub Package or Container Registry package grants the repository running Dependabot Read access through Manage Actions access, Dependabot can request packages: read on its GITHUB_TOKEN and authenticate to supported *.pkg.github.com registries and ghcr.io without a personal access token or a matching PAT-based registry entry in dependabot.yml. GitHub says this applies to every GitHub Packages ecosystem Dependabot supports. The automatic credential is fallback authentication: explicit registry credentials and normal registry routing continue to take precedence. Teams should migrate package by package, verify the repository has only Read access, remove obsolete PAT registry entries only after a successful Dependabot run, and keep third-party private registries on their appropriate explicit authentication path.
Dependabot needs a package stored in private GitHub Packages or GitHub Container Registry and the repository currently stores a PAT-backed registry entry
A team wants to remove a long-lived personal access token from Dependabot configuration without breaking private dependency updates
A package is accessible to Actions but Dependabot still fails because repository access, package scope or routing has not been verified
An organization is unsure whether automatic GitHub Packages access also eliminates credentials for Artifactory, Azure Artifacts, Nexus or another third-party registry
Possible causes
GitHub now lets Dependabot's GITHUB_TOKEN request packages: read for supported GitHub-hosted registries
The package must explicitly grant the Dependabot repository access through Manage Actions access; the capability does not grant blanket package access
The feature was briefly rolled back after a June 2026 release because some npm jobs routed public packages through GitHub Packages, then re-enabled with automatic credentials used only as fallback authentication
Third-party private registries still require their supported explicit authentication configuration rather than inheriting GitHub-hosted package access
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Inventory Dependabot registry entries and identify which ones exist solely to read packages hosted by GitHub Packages or ghcr.io. Do not remove credentials for third-party registries during this inventory.
Step 2. For each required GitHub-hosted package, open the package settings and use Manage Actions access to add the repository that runs Dependabot. Grant Read access; GitHub's documentation says Dependabot only needs read access to pull packages.
Step 3. Confirm the dependency ecosystem is supported by Dependabot and that the package reference actually resolves through the intended GitHub-hosted registry. Automatic authentication should not be used to mask an incorrect registry URL or package name.
Step 4. Run a Dependabot version-update or security-update job while the existing PAT configuration is still recoverable. Verify the job can resolve the private package and does not unexpectedly route public packages through the private registry.
Step 5. After successful verification, remove only the PAT-based registry entries that are redundant for those GitHub-hosted packages. GitHub says no dependabot.yml registry change is required for automatic access once the package grants the repository access.
Step 6. Re-run the job after PAT removal and confirm private package reads still succeed. Review logs for registry routing and authentication errors without printing or copying secret values into tickets, documentation or AI prompts.
Step 7. Keep explicit credentials for third-party private registries such as Artifactory, Azure Artifacts or Nexus unless those registries are separately migrated to another supported authentication method such as organization-level credentials or OIDC.
Step 8. Review package access periodically. Remove repository grants that are no longer needed and avoid granting Write or Admin package access merely to make a read-only dependency update succeed.
Step 9. If npm or another ecosystem resolves from an unexpected source, stop and verify registry configuration rather than adding broader credentials. GitHub's September editor's note says automatic GitHub Packages credentials are now fallback authentication so explicit routing should continue to take precedence.
Step 10. Document the package, repository grant, verification date and removed secret so future maintainers understand why a PAT is no longer present and can distinguish GitHub-hosted packages from third-party registries.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Test the migration on a controlled Dependabot run before deleting the old PAT-backed entry.
Use least-privilege package grants and preserve normal repository/organization security policy.
Keep a reversible record of the removed registry configuration without retaining the secret value itself.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not grant package Write or Admin access when Dependabot only needs Read access.
Do not remove credentials used by third-party private registries; automatic access is for supported GitHub-hosted registries.
Do not paste PATs, GITHUB_TOKEN values or package-registry secrets into logs, issues, chat transcripts or migration notes.
Do not treat repository access to one package as blanket access to every private package; GitHub documents granting access for each package Dependabot needs.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Does Dependabot still need a PAT for private GitHub Packages?
Not when the package grants the repository Read access through Manage Actions access and the ecosystem is supported. GitHub says Dependabot can then use its GITHUB_TOKEN automatically.
Do I need to add a new registry block to dependabot.yml?
No for this GitHub-hosted package path. GitHub says no dependabot.yml change is required and PAT-based entries for those packages can be removed after verification.
Does this work for GitHub Container Registry?
Yes. GitHub's documentation says the automatic access method applies to supported GitHub Packages ecosystems, including container images in the Container Registry.
Can I remove Artifactory or Nexus credentials too?
No. GitHub's documentation says third-party private registries still require their supported explicit authentication configuration.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
