#45681·docs

Dependabot - Private "Registries"/"Dependencies"/"Repositories" is misleading

Author: Malix-LabsCreated Aug 31, 2026Updated Sep 9, 2026
Labelscontentdependabotneeds SME

Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories

What part(s) of the article would you like to see updated?

Dependabot sometimes cannot resolve private dependencies for some ecosystems (e.g. Nix, currently)

However, this is expressed in 3 different expressions:

  1. Private Registries
  2. Private Dependencies
  3. Private Repositories

Those can be misleading

For example: I personally thought dependabot was completely not working for some ecosystems independently of private dependencies when the dependabot.yml file was inside of a private repository

Harmonizing the "Private *" term with a single word (probably "Private Dependencies", since it encompasses both registries and repositories) would have cleared up any confusion

Additional information

No response