You can now select Anonymous as the authentication method for an organization-level private registry. Use it for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads.
On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries you configure. A private registry that’s only defined in a file such as .npmrc or nuget.config is blocked. Organization-level registries apply to every repository you grant access to, including repositories that only use Dependabot security updates and don’t have a dependabot.yml file.
To add a registry, go to your organization’s Settings, select Secrets and variables, then Private registries, and choose New private registry. If you used a placeholder token as a workaround, delete that registry and add it again with Anonymous authentication. This is necessary because you can’t change the authentication method of an existing registry.
The Anonymous option is now generally available on github.com and will be available in GitHub Enterprise Server 3.24.
Learn more about giving security features access to private registries and resolving a blocked host in a Dependabot update job.