New Configuration Options for Dependabot Runners on GitHub

• •New runner settings for Dependabot enhance control for repository administrators.
• •Labeled runners can target both self-hosted and GitHub-hosted environments.
• •Security configurations for Dependabot runners are currently optional.

GitHub has introduced new settings for repository administrators to configure Dependabot runners, allowing for more control over where Dependabot jobs run. This feature is available for private and internal repositories, enabling the use of labeled runners that can target both self-hosted and GitHub-hosted environments. Administrators can specify a custom label and runner group, enhancing access to private package registries. The settings are not applicable to public repositories or GitHub Enterprise Server. The changes aim to improve security and flexibility in managing dependency updates. Security configurations currently do not enforce these runner settings, meaning they are optional. This update was announced in a blog post dated September 29, 2026, just before the documentation release on September 30, 2026.