GitHub Adds Anonymous Authentication for Organization-Level Dependabot Private Registries, but Two Docs Pages Still List Only Three Methods
GitHub's October 12 changelog adds an Anonymous option for organization-level Dependabot private registries; two docs pages read October 13 still list Token, Username and password, and OIDC.
Overview
GitHub said on October 12, 2026, in a changelog entry categorized as an improvement, that organizations can now select “Anonymous” as the authentication method for an organization-level private registry used with Dependabot. According to the entry, the option is meant for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads. The same entry says the option is generally available on github.com and will be available in GitHub Enterprise Server 3.24.
What the Changelog Says
The entry describes the network constraint behind the change. On github.com, GitHub states, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries a customer configures. A private registry that is only defined in a file such as .npmrc or nuget.config is blocked, the entry adds.
Organization-level registries apply to every repository the organization grants access to. That includes repositories that only use Dependabot security updates and do not have a dependabot.yml file, according to the changelog.
To add one, the entry directs users to the organization’s Settings, then Secrets and variables, then Private registries, and then New private registry. It also addresses teams that previously worked around the lack of an anonymous option: those that used a placeholder token should delete that registry and add it again with Anonymous authentication, because the authentication method of an existing registry cannot be changed. GitHub’s documentation on giving organizations access to private registries makes the same point in general terms, stating that the authentication type of a private registry cannot be changed after creation.
Where the Documentation Differs
Two documentation pages read on October 13, 2026 do not list the new option among the organization-level methods. The page on giving organizations access to private registries instructs readers to select the authentication method for the registry and lists three: Token, Username and password, and OIDC. Its OIDC section names Azure, AWS CodeArtifact, Cloudsmith, Google Cloud Artifact Registry and JFrog Artifactory. The page on configuring Dependabot access to private registries likewise says: “Organization-level registries support Token, Username and password, and OIDC authentication.”
The changelog and the documentation are not necessarily in conflict, since the changelog entry is dated October 12 and documentation can lag a release. But as of October 13, they describe different sets of options, and the documentation pages do not say which applies.
The configuring page also carries guidance about registries defined in dependabot.yml. It says to declare a registry under the top-level registries key even if it allows anonymous access, because defining it only in an ecosystem-native configuration file, such as .npmrc or nuget.config, does not allow its host. That sentence concerns the file-based configuration path. Neither it nor the changelog entry says whether declaring the same mirror at the organization level replaces a dependabot.yml declaration.
Diagnosing Blocked Hosts
GitHub’s guide to resolving a blocked host in a Dependabot update job says the proxy checks the host of every outbound request against an egress allowlist, and that the “egress not allowlisted” line in the job log names the exact host that failed the check. The changelog entry also links to this guide.
What We Don’t Know
- Whether the documentation pages will be updated to list Anonymous as a fourth authentication method. The two pages read on October 13 do not.
- Whether the Anonymous option is available for every registry type Dependabot supports. The changelog entry does not list registry types.
- How many organizations relied on placeholder tokens as a workaround. The entry mentions the practice but gives no figure.
- The Enterprise Server 3.24 release date. The changelog says only that the option “will be available” there.