Bringing private packages under Dependabot’s watch
Dependabot has long kept public dependencies patched and current, but internal libraries and shared packages were left out of that coverage. Private dependencies—whether published to an internal registry or pulled straight from a private GitHub repository—could drift out of date without automated oversight. That gap is now closed: Dependabot version updates can authenticate against private package registries and access private GitHub repositories.
Working with private registries
Most ecosystems publish private packages to registries that require credentials, such as npm, Artifactory, Nexus, or Azure Artifacts. To let Dependabot resolve and update those packages, store the registry’s access token or secret in the repository’s or organization’s secret store. Once the credential is available, Dependabot handles version updates against that registry just as it does for public sources.
Pulling directly from private repositories
For ecosystems like Go modules and npm, dependencies are frequently consumed directly from a private GitHub repository rather than from a published package. In this case, Dependabot needs explicit access to those repositories. Granting access is done at the organization level, in the security and analysis settings, by allowing Dependabot to access the required private repositories.
Moving past Dependabot Preview blockers
Users still on Dependabot Preview—identified by pull requests authored by dependabot-preview rather than dependabot—may have hit a wall when migrating due to the lack of private registry or repository support. The migration path is now clear: trigger a pull request from the Dependabot dashboard, transfer existing secrets over, and complete the move to GitHub Dependabot.
Further enhancements, including additional ecosystem support and quieter notifications, are tracked on the public GitHub roadmap.
