Summary
On October 12, 2026, GitHub made it possible to select Anonymous as the authentication method for an organization-level private registry in Dependabot, removing the need for a placeholder token when a registry requires no credentials. The feature is generally available on github.com and slated for GitHub Enterprise Server 3.24.
What changed
Organizations can now choose Anonymous authentication for an organization-level private registry in Dependabot, so no placeholder credential is needed for registries that do not require one. Because organization-level registries apply to every repository the org grants access to, this reaches repositories that use only security updates and have no dependabot.yml. The authentication method cannot be changed on an existing registry, so teams using the placeholder workaround must delete and re-add the registry with Anonymous auth.
Why it matters
It removes a long-standing friction point and a weak security practice: storing fake or throwaway tokens just to satisfy Dependabot's registry configuration. Org-level scope also extends automated dependency security updates to repositories that never had per-repo Dependabot config.
Evidence excerpt
"You can now select Anonymous as the authentication method for an organization-level private registry." Org-level registries apply to every repository the org grants access to, including repos that use only security updates with no dependabot.yml; the method can't be changed on an existing registry, so teams must delete and re-add with Anonymous auth. GA on github.com, slated for GitHub Enterprise Server 3.24.