As a repository administrator, you can now configure the runner type, optional custom label, and optional runner group for Dependabot version and security updates. This extends the runner configuration already available at the organization level , giving you more control over where each repository’s Dependabot jobs run.
Labeled runners can target both self-hosted and larger GitHub-hosted runners suited to your project’s needs, such as access to private package registries or specialized environments.
These repository-level settings are available for private and internal repositories on github.com. The controls are hidden for public repositories and on GitHub Enterprise Server.
To get started, open your repository settings and select Advanced Security . Under “Dependency scanning”, find “Dependabot version updates”, then edit Runner type . Choose Labeled runner , then optionally enter a custom label and runner group. If you do not specify a label, Dependabot uses the dependabot label. Alternatively, choose Standard GitHub runner to use the default GitHub-hosted environment.
Security configurations do not currently enforce Dependabot runner settings.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
