Update OIDC authentication section for clarity

[loganvolkers]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries

What part(s) of the article would you like to see updated?

1. The Conflict in the Documentation

• The Stale Callout: Lower down in the doc, an older note reads:
  [!NOTE] OIDC authentication for organization-level private registries is currently supported by Dependabot. It is not supported by code scanning default setup.

• The Live Reality & Main Text: In the very same document, GitHub's table and procedure explicitly state:
  Code scanning default setup supports:

  Java: Maven Repository

  C#: NuGet Feed

  Go: GOPROXY server, Git Source

Step 5: Select the authentication method: ... OIDC (OpenID Connect)

GitHub rolled out OIDC for Dependabot first, and in April 2026 published a [changelog expanding org-level private registries with OIDC to code scanning default setup](https://github.blog/changelog/2026-04-14-dependabot-and-code-scanning-org-level-private-registries/). The UI and setup steps were updated, but that static [!NOTE] block was never scrubbed.

Additional information

No response

[subatoi]

Thanks for reporting this, @loganvolkers—we'll investigate this and report back as soon as possible.