
Dependabot & Code Scanning: Org-Level Private Registries
GitHub changelog entry describing a new capability where organizations can register multiple private registries per ecosystem (npm, Maven, NuGet, Docker, pip, RubyGems, etc.) at the org level for both Dependabot and code scanning, instead of being limited to one registry per ecosystem type. It also adds OIDC-based authentication support (via UI and REST API) for Azure DevOps Artifacts, AWS CodeArtifact, and JFrog Artifactory, available now on github.com/GHEC and coming to GHES 3.24.
TL;DR GitHub now lets orgs configure multiple private package registries per ecosystem for Dependabot/code scanning, with OIDC auth for Azure DevOps Artifacts, AWS CodeArtifact, and JFrog Artifactory.
Technologies named here
Related in DevSecOps
JFrog: The Governance Gap Between Your Policy and Your Pipeline

Dev Machine Guard Now Supports Windows - StepSecurity

Socket: TanStack npm Packages Compromised
