`private_registry_config_not_found` with org-level private registries configured

[h3rmanj]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

No response

Updated dependency

No response

What you expected to see, versus what you actually saw

When I've configured org-level private registry access, dependabot runs in repositories without a .npmrc fails with private_registry_config_not_found.

This has worked until now, so PR #15347 early failure gets triggered when it shouldn't, as there is no registry configuration in dependabot.yml that should fail. This is related to #15415, but this is surfaced from the explicit org-level private registry configuration, not from the automatic github packages feature. Might also be related to the https://github.blog/changelog/2026-06-30-dependabot-no-longer-infers-npmrc/ change.

While they are related, none of them seems to take the org-level configuration in account. If i use org-level private registry, I read the feature as "auth is available for repos wanting to use these registries". If the repo doesn't have a .npmrc, it should just use whatever is package-manager default, like it always has.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

Example repo for this error: https://github.com/intility/helm-version

dependabot.yml does not have a registry section configured.

Dependabot runs failed until I added a .npmrc with the default public registry (not the one configured in org-level private registries).