Dependabot adds anonymous organization registries, without removing network limits
GitHub announced an Anonymous authentication option for organization-level private registries on October 12. It is intended for registries Dependabot can reach without credentials, such as an internal package mirror allowing anonymous reads. It does not make a credential-protected registry public.
On github.com, Dependabot update jobs can reach only hosts on the egress allowlist and configured private registries. Defining a registry solely in a package-manager file such as .npmrc or nuget.config does not satisfy that requirement; GitHub says such a host is blocked.
An organization-level registry applies to repositories granted access. That includes repositories using only Dependabot security updates without a dependabot.yml file. The organization must still decide which repositories receive access.
The setting is added through organization Settings, under Secrets and variables, then Private registries. For a placeholder-token workaround, GitHub describes deleting the old registry and adding it again with Anonymous authentication because an existing registry's authentication method cannot be changed.
The Anonymous option is generally available on github.com. GitHub says it will be available in GitHub Enterprise Server 3.24, so the announcement should not be presented as evidence that all current Server installations support it.
This change removes a configuration obstacle for a reachable registry that already allows unauthenticated reads. It does not bypass private-network connectivity, package access policy or egress restrictions, and it does not establish access to an air-gapped network. Administrators should review existing consumers before replacing a registry configuration.